joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407670
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov eax, 0x1b68
call fcn.0040a710
mov eax, dword [0x423640]
xor eax, esp
mov dword [esp + 0x1b64], eax
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push str.PSAPI.DLL
mov edi, ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [esp + 0x1c], ebx
cmp ebx, ebp
je 0x4076cb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetModuleFileNameExA
push ebx
call esi
push str.EnumProcessModules
push ebx
mov dword [esp + 0x1c], eax
call esi
mov dword [esp + 0x10], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x20], esi
cmp esi, 0xffffffff
je 0x4077a9
lea eax, [esp + 0x1028]
push eax
push esi
mov dword [esp + 0x1030], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4077a2
mov ecx, dword [esp + 0x1030]
push ecx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4077cf
lea edx, [esp + 0x1150]
push edx
push ebp
mov dword [esp + 0x1158], 0x224
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x407782
jmp 0x407740
lea eax, [esp + 0x1374]
push eax
lea ecx, [esp + 0x1274]
call fcn.00407060
add esp, 4
test eax, eax
je 0x40776c
push 0
lea esi, [esp + 0x1378]
call fcn.00407460
add esp, 4
lea ecx, [esp + 0x1150]
push ecx
push ebp
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x407740
mov esi, dword [esp + 0x20]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x1028]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x407704
lea ebp, [eax + 1]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x4077b4
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x1b74]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00409279
add esp, 0x1b68
ret
cmp dword [esp + 0x14], 0
je 0x407789
cmp dword [esp + 0x10], 0
je 0x407789
mov edx, dword [esp + 0x1030]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
test ebp, ebp
je 0x407789
lea eax, [esp + 0x18]
push eax
push 0x1000
lea ecx, [esp + 0x30]
push ecx
push ebp
mov dword [esp + 0x28], 0
call dword [esp + 0x20]
test eax, eax
je 0x407884
mov esi, dword [esp + 0x18]
shr esi, 2
xor ebx, ebx
mov dword [esp + 0x24], esi
test esi, esi
jbe 0x407880
lea esp, [esp]
mov eax, dword [esp + ebx*4 + 0x28]
push 0x400
lea edx, [esp + 0x1778]
push edx
push eax
push ebp
call dword [esp + 0x24]
test eax, eax
je 0x40787b
lea ecx, [esp + 0x1374]
push ecx
lea ecx, [esp + 0x1778]
call fcn.00407060
add esp, 4
test eax, eax
je 0x40787b
push 0
lea esi, [esp + 0x1378]
call fcn.00407460
mov esi, dword [esp + 0x28]
add esp, 4
inc ebx
cmp ebx, esi
jb 0x407830
mov ebx, dword [esp + 0x1c]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x20]
jmp 0x407789
Function at 0x4078a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x920
mov eax, dword [0x423640]
xor eax, esp
mov dword [esp + 0x91c], eax
mov eax, dword [esp + 0x924]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push ebp
push esi
xor ebp, ebp
push edi
mov edi, 0x423158
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], edi
mov edx, dword [edi - 4]
mov eax, dword [edi - 8]
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
mov dword [esp + 0x20], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x407a4a
mov esi, dword [edi]
mov ecx, esi
mov eax, str._ALLVALUES_
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407928
test dl, dl
je 0x407924
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407928
add eax, 2
add ecx, 2
test dl, dl
jne 0x407908
xor eax, eax
jmp 0x40792d
sbb eax, eax
sbb eax, 0xffffffff
mov dword [esp + 0x10], 0x400
cmp eax, ebp
jne 0x4079f1
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x130]
push edx
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x3c]
push edx
push 0
push eax
mov dword [esp + 0x38], 0x104
call ebx
test eax, eax
jne 0x407a48
jmp 0x407980
lea ecx, [esp + 0x52c]
push ecx
lea ecx, [esp + 0x130]
call fcn.00407060
add esp, 4
test eax, eax
je 0x4079b4
mov edi, dword [esp + 0x24]
push 1
lea esi, [esp + 0x530]
call fcn.00407460
mov edi, dword [esp + 0x20]
add esp, 4
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x3c]
push eax
inc ebp
push ebp
push ecx
mov dword [esp + 0x30], 0x400
mov dword [esp + 0x38], 0x104
call ebx
test eax, eax
je 0x407980
jmp 0x407a48
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407a48
lea eax, [esp + 0x52c]
push eax
lea ecx, [esp + 0x130]
call fcn.00407060
add esp, 4
test eax, eax
je 0x407a48
mov edi, dword [esp + 0x24]
push 1
lea esi, [esp + 0x530]
call fcn.00407460
mov edi, dword [esp + 0x20]
add esp, 4
xor ebp, ebp
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x407a59
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 0xc
cmp edi, 0x423404
mov dword [esp + 0x1c], edi
jl 0x4078e0
mov ecx, dword [esp + 0x92c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00409279
add esp, 0x920
ret
Function at 0x408070
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x810
mov eax, dword [0x423640]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov edi, ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov ebx, 0x4235f8
lea esp, [esp]
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
lea eax, [esp + 0x10]
push eax
push ecx
push edx
mov dword [esp + 0x1c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x408139
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 8]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x20]
push edx
push ebp
push eax
push ecx
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408139
lea edx, [esp + 0x1c]
push str.___t_n
push edx
call fcn.0040a73b
add esp, 8
cmp eax, ebp
je 0x408139
jmp 0x408100
lea ecx, [esp + 0x41c]
push ecx
mov ecx, eax
call fcn.00407060
add esp, 4
test eax, eax
je 0x408127
push 1
lea esi, [esp + 0x420]
call fcn.00407460
add esp, 4
push str.___t_n
push ebp
call fcn.0040a73b
add esp, 8
cmp eax, ebp
jne 0x408100
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x408148
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 0xc
cmp ebx, 0x423628
jl 0x4080a0
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00409279
add esp, 0x810
ret
Function at 0x408180
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x91c
mov eax, dword [0x423640]
xor eax, esp
mov dword [esp + 0x918], eax
mov eax, dword [esp + 0x920]
push esi
push edi
lea ecx, [esp + 8]
push ecx
xor edi, edi
push str.SYSTEMCurrentControlSetServices
push 0x80000002
mov dword [esp + 0x24], eax
xor esi, esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4082de
mov eax, dword [esp + 8]
push ebx
push 0x104
lea edx, [esp + 0x24]
push edx
push edi
push eax
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4082d8
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4082d7
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x12c]
push edx
lea eax, [esp + 0x24]
push eax
push edi
push str.Start
mov esi, 0x400
push ecx
mov dword [esp + 0x2c], esi
call ebp
test eax, eax
jne 0x4082ad
cmp dword [esp + 0x1c], 4
jne 0x4082ad
cmp dword [esp + 0x128], 2
ja 0x4082ad
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0x24]
push ecx
push edi
push str.ImagePath
push edx
mov dword [esp + 0x2c], esi
call ebp
test eax, eax
jne 0x4082ad
lea eax, [esp + 0x528]
push eax
lea ecx, [esp + 0x12c]
call fcn.00407060
add esp, 4
test eax, eax
je 0x4082ad
mov edi, dword [esp + 0x20]
push 2
lea esi, [esp + 0x52c]
call fcn.00407460
add esp, 4
xor edi, edi
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
push 0x104
lea edx, [esp + 0x28]
push edx
inc ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x4081f6
pop ebp
mov esi, 1
pop ebx
mov eax, dword [esp + 8]
cmp eax, edi
je 0x4082ed
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x920]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.00409279
add esp, 0x91c
ret
Function at 0x408a90
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
mov eax, 0x1148
call fcn.0040a710
mov eax, dword [0x423640]
xor eax, esp
mov dword [esp + 0x1144], eax
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
push esi
mov esi, 0x423628
push edi
mov edi, ecx
mov dword [esp + 0x10], esi
lea ecx, [ecx]
mov ecx, dword [esi]
push 0x400
lea eax, [esp + 0x158]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edx, [esp + 0x154]
push edx
lea eax, [esp + 0x958]
push str._s.
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x958]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x408be2
mov edi, edi
mov ecx, 0x41cae4
lea eax, [esp + 0x40]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408b40
test dl, dl
je 0x408b3c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408b40
add eax, 2
add ecx, 2
test dl, dl
jne 0x408b20
xor eax, eax
jmp 0x408b45
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x408bc3
mov ecx, 0x41cd3c
lea eax, [esp + 0x40]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408b72
test dl, dl
je 0x408b6e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408b72
add eax, 2
add ecx, 2
test dl, dl
jne 0x408b52
xor eax, eax
jmp 0x408b77
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x408bc3
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x158]
push ecx
lea edx, [esp + 0x55c]
push str._s_s
push edx
call ebp
lea eax, [esp + 0xd64]
push eax
lea ecx, [esp + 0x568]
call fcn.00407060
add esp, 0x14
test eax, eax
je 0x408bc3
push 4
lea esi, [esp + 0xd58]
call fcn.00407460
add esp, 4
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408b10
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x10]
add esi, 4
cmp esi, 0x423668
mov dword [esp + 0x10], esi
jl 0x408ac0
mov ecx, dword [esp + 0x1154]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00409279
add esp, 0x1148
ret
Function at 0x408c20
Capabilities:
Get file size
Query environment variable
Read file on windows

Disassembly:
sub esp, 0x814
mov eax, dword [0x423640]
xor eax, esp
mov dword [esp + 0x810], eax
mov eax, dword [esp + 0x818]
mov cx, word [0x41cd58]
mov dl, byte [0x41cd5a]
push esi
mov dword [esp + 0xc], eax
push 0x400
lea eax, [esp + 0x18]
push eax
xor esi, esi
push esi
mov word [esp + 0x10], cx
mov byte [esp + 0x12], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x14]
push 0x5c
push ecx
call fcn.00409290
add esp, 8
test eax, eax
je 0x408dac
push edi
push str.K7QScnAp.dat
lea edx, [esp + 0x1c]
push edx
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
push esi
push 3
push esi
push 3
push 0x80000000
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, 0xffffffff
je 0x408dab
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0xc], eax
cmp eax, 8
jb 0x408da4
push ebp
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x408da3
mov edx, dword [esp + 0x10]
push esi
lea ecx, [esp + 0x14]
push ecx
push edx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x408d93
mov esi, dword [esp + 0x10]
mov edx, ebp
call fcn.00406a10
lea eax, [esp + 0xc]
push eax
push ebp
call fcn.0040a73b
add esp, 8
test eax, eax
je 0x408d8e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x408d30
push 0x400
lea ecx, [esp + 0x24]
push ecx
push eax
mov byte [esp + 0x2c], 0
call ebx
cmp byte [esp + 0x20], 0
je 0x408d7a
lea edx, [esp + 0x420]
push edx
lea ecx, [esp + 0x24]
call fcn.00407060
add esp, 4
test eax, eax
je 0x408d7a
mov edi, dword [esp + 0x18]
push 4
lea esi, [esp + 0x424]
call fcn.00407460
mov edi, dword [esp + 0x20]
add esp, 4
lea eax, [esp + 0x10]
push eax
push 0
call fcn.0040a73b
add esp, 8
test eax, eax
jne 0x408d30
pop ebx
mov esi, 1
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [esp + 0x814]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00409279
add esp, 0x814
ret

Function at 0x408f20
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0xc]
test eax, eax
je 0x408f5c
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 8]
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x14]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408f5c
mov eax, 1
cmp dword [esp + 0x10], eax
je 0x408f5e
xor eax, eax
ret 0x10
Function at 0x408fc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409007
cmp dword [esp + 0xc], 4
jne 0x409007
mov al, byte [esp + 8]
mov edx, dword [esp + 0x10]
mov byte [edx], al
mov eax, 1
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc

Function at 0x4091b0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x423640]
xor eax, esp
mov dword [esp + 0x9c], eax
push 0x9c
lea eax, [esp + 4]
push 0
push eax
call fcn.0040a320
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40920c
cmp dword [esp + 4], 6
jb 0x40920c
mov al, 1
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.00409279
add esp, 0xa0
ret
mov ecx, dword [esp + 0x9c]
xor ecx, esp
xor al, al
call fcn.00409279
add esp, 0xa0
ret

Function at 0x409279
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423640]
jne 0x409283
repz ret
jmp fcn.0040b527
Function at 0x412e1b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040c0a7
and dword [ebp - 4], 0
cmp dword [0x426680], 0
mov ebx, eax
jne 0x412ecc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x412f7d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x412f7d
push eax
call fcn.0040c035
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x426680], eax
call esi
push eax
call fcn.0040c035
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x426684], eax
call esi
push eax
call fcn.0040c035
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x426688], eax
call esi
push eax
call fcn.0040c035
pop ecx
mov dword [0x426690], eax
test eax, eax
je 0x412ecc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040c035
pop ecx
mov dword [0x42668c], eax
mov eax, dword [0x42668c]
cmp eax, ebx
je 0x412f24
cmp dword [0x426690], ebx
je 0x412f24
push eax
call fcn.0040c0b0
push dword [0x426690]
mov esi, eax
call fcn.0040c0b0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x412f24
test edi, edi
je 0x412f24
call esi
test eax, eax
je 0x412f1b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x412f1b
test byte [ebp - 0xc], 1
jne 0x412f24
or dword [ebp + 0x10], 0x200000
jmp 0x412f5d
mov eax, dword [0x426684]
cmp eax, ebx
je 0x412f5d
push eax
call fcn.0040c0b0
pop ecx
test eax, eax
je 0x412f5d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x412f5d
mov eax, dword [0x426688]
cmp eax, ebx
je 0x412f5d
push eax
call fcn.0040c0b0
pop ecx
test eax, eax
je 0x412f5d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x426680]
call fcn.0040c0b0
pop ecx
test eax, eax
je 0x412f7d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x412f7f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
mov eax, ecx
push edi
xor esi, esi
mov edi, eax
push 8
mov edx, esi
pop ebx
test dl, 1
je 0x40101d
shr edx, 1
xor edx, 0xedb88320
jmp 0x40101f
shr edx, 1
dec ebx
jne 0x40100e
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x401009
pop edi
pop esi
pop ebx
ret

Function at 0x401034
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 8
push ebx
push esi
push edi
mov esi, 0xff
jb 0x401100
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
shr eax, 3
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
movzx ebx, byte [edx]
mov edi, eax
sub dword [ebp + 0xc], 8
and edi, esi
xor edi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [ecx + edi*4]
xor eax, ebx
inc edx
mov edi, eax
movzx ebx, byte [edx]
and edi, esi
xor edi, ebx
movzx ebx, byte [edx + 1]
mov edi, dword [ecx + edi*4]
shr eax, 8
xor edi, eax
inc edx
mov eax, edi
and eax, esi
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [ecx + eax*4]
shr edi, 8
xor eax, edi
inc edx
mov edi, eax
and edi, esi
xor edi, ebx
movzx ebx, byte [edx + 1]
mov edi, dword [ecx + edi*4]
shr eax, 8
xor edi, eax
inc edx
mov eax, edi
and eax, esi
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [ecx + eax*4]
shr edi, 8
xor eax, edi
inc edx
mov edi, eax
and edi, esi
xor edi, ebx
movzx ebx, byte [edx + 1]
mov edi, dword [ecx + edi*4]
shr eax, 8
xor edi, eax
inc edx
mov eax, edi
and eax, esi
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [ecx + eax*4]
shr edi, 8
xor eax, edi
inc edx
mov edi, eax
and edi, esi
xor edi, ebx
shr eax, 8
mov edi, dword [ecx + edi*4]
xor eax, edi
inc edx
dec dword [ebp - 4]
jne 0x401059
jmp 0x401106
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
je 0x401123
movzx ebx, byte [edx]
mov edi, eax
and edi, esi
xor edi, ebx
shr eax, 8
mov edi, dword [ecx + edi*4]
xor eax, edi
inc edx
dec dword [ebp + 0xc]
jne 0x40110c
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x401ef8
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
lea eax, [ebp - 0x208]
push dword [ebp + 8]
push eax
call fcn.00405650
pop ecx
xor ebx, ebx
pop ecx
push ebx
push 0x8000000
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x401f75
lea eax, [ebp - 0x208]
push 0x5c
push eax
call fcn.00405620
pop ecx
cmp eax, ebx
pop ecx
je 0x401f71
mov byte [eax], bl
lea eax, [ebp - 0x208]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x401f15
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call fcn.00405650
pop ecx
pop ecx
jmp 0x401f15
xor eax, eax
jmp 0x401fcd
push esi
push edi
mov edi, dword [ebp + 0x10]
cmp edi, ebx
jbe 0x401fbd
mov esi, 0x10000
cmp edi, esi
jae 0x401f89
mov esi, edi
lea eax, [ebp - 8]
push ebx
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401fc0
cmp dword [ebp - 8], esi
jne 0x401fc0
push dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
mov dword [ebp + 8], 1
call fcn.00401eaa
sub edi, esi
add dword [ebp + 0xc], esi
jmp 0x401f7a
mov ebx, dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x401fd0
Capabilities:
Delete directory
Delete file

Disassembly:
mov eax, 0x415c80
call fcn.00404d80
sub esp, 0x24
push ebx
and dword [ebp - 4], 0
push esi
push edi
mov dword [ebp - 0x10], esp
push 1
pop edi
lea ecx, [ebp - 0x30]
call fcn.00403c93
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00410d0a
lea eax, [ebp + 8]
push edi
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004104be
mov esi, 0x450560
push esi
push dword [eax]
call fcn.00405770
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp + 8]
setne bl
call fcn.00410c9c
test bl, bl
je 0x40203b
push esi
lea ecx, [ebp - 0x14]
call fcn.00410e4d
push 0x45055c
lea ecx, [ebp - 0x14]
call fcn.00410e4d
push 0
lea ecx, [ebp - 0x30]
push dword [ebp - 0x14]
call fcn.00403d56
mov ebx, eax
test ebx, ebx
lea ecx, [ebp - 0x30]
je 0x4020be
call fcn.00403f76
lea ecx, [ebp - 0x30]
mov ebx, eax
call fcn.00403f3d
test eax, eax
jne 0x402057
lea eax, [ebp + 8]
lea ecx, [ebp - 0x30]
push eax
call fcn.00404045
mov eax, dword [ebp - 0x30]
push 0x10
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call dword [eax + 0x38]
push dword [ebp + 8]
test eax, eax
je 0x4020a8
call fcn.00401fd0
pop ecx
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
and eax, esi
jmp 0x4020ae
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp + 8]
and edi, eax
mov byte [ebp - 4], 2
call fcn.00410c9c
jmp 0x402057
call fcn.00403d0c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00410c9c
and byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00403cd0
jmp 0x4020ea
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret