joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475300
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x475334
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.00475210
test eax, eax
jne 0x47534d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.00475280
cmp eax, 1
je 0x4754da
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x475386
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x475402
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x475482
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.00475140
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x475499
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x4753a2
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x475450
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.00474df0
test eax, eax
je 0x475482
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x47541e
cmp dword [esp + 0x18], 1
jb 0x475482
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push closesocket
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.00474cd0
cmp eax, 1
je 0x4754cb
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4754a9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x475482
push ebp
mov ecx, ebx
call fcn.004754f0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4754da
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x4754f0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x475522
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.00475280
test eax, eax
jne 0x47553f
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x475566
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x4755b4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.00474f90
test eax, eax
jne 0x47559d
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x475583
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
mov ecx, edi
call fcn.00474d60
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x4755d7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4

Function at 0x47aac0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x47ab63
test eax, eax
jbe 0x47ab63
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x47ab63
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x47ab0e
xor esi, esi
jmp 0x47ab14
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x47ab3f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00413a50
add esi, eax
push esi
mov ebx, esi
call fcn.00413a50
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x47ab20
pop ebp
test edi, edi
pop edi
jne 0x47ab63
test ebx, ebx
je 0x47ab63
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0047ff00
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x47ac85
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x47ad9d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47ad9d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0049133c
mov esi, eax
test esi, esi
je 0x47ad9d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x47ad9d
mov ecx, esi
call fcn.0047ac10
cmp edi, eax
jge 0x47ad9d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x47ad23
mov dword [esp + 0x34], 1
jmp 0x47ad7e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x47ad9d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0047a210
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x491ce0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x491d18
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048fd94
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048fd6c
jmp 0x491d24
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4933ce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x493410
call fcn.00498e87
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x493410
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x493407
xor eax, eax
jmp 0x493418
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0049341e
pop edi
pop esi
pop ebx
ret 4

Function at 0x4993b7
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4993e5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x499403
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049931d
jmp 0x499403
mov eax, dword [esi + 0x14]
test eax, eax
je 0x499403
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049931d
test edi, edi
mov eax, edi
jne 0x4993ed
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40290f
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x402927
push dword [esp + 4]
push 0x4028a8
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x402964
push esi
mov esi, dword [0x40c234]
test esi, esi
je 0x402963
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x40295b
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x40c234
call fcn.00408ad6
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x402934
pop edi
pop ebx
pop esi
ret 4
Function at 0x403dd5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
push dword [0x40ca18]
xor esi, esi
call fcn.004088b3
push edi
push edi
push 3
push edi
push edi
push 0x80000000
push dword [ebp + 0xc]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x403f3a
push edi
lea ecx, [ebp - 0xc]
push ecx
push 2
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [ebp - 4], 0x4d42
jne 0x403e9a
mov al, byte [ebp + 0x10]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xffffe000
add eax, 0x2010
push eax
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [0x40c20c]
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, eax
cmp esi, edi
je 0x403f3a
lea eax, [ebp - 0x38]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectA]
cmp word [ebp - 0x26], 8
ja 0x403f10
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x10
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [0x40c20c]
call dword [sym.imp.USER32.dll_LoadImageA]
jmp 0x403efd
push 0x10
push edi
push edi
push 1
push dword [ebp + 0xc]
push dword [0x40c20c]
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, eax
cmp esi, edi
je 0x403ee7
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x403f10
lea eax, [ebp - 0x38]
push eax
push 0x18
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_GetObjectA]
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x403f10
push edi
push dword [ebp + 0xc]
call fcn.00408139
cmp eax, edi
je 0x403f10
push dword [ebp + 0x10]
push eax
call fcn.00403f55
mov esi, eax
cmp esi, edi
je 0x403f3a
lea eax, [ebp - 0x38]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectA]
cmp esi, edi
je 0x403f3a
cmp dword [ebp + 8], 0xffffffff
mov dword [ebx], esi
mov ax, word [ebp - 0x34]
mov word [ebx + 4], ax
mov ax, word [ebp - 0x30]
mov word [ebx + 6], ax
mov al, byte [ebp - 0x26]
mov byte [ebx + 8], al
mov al, byte [ebp + 0x10]
mov byte [ebx + 9], al
jne 0x403f3a
mov esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x404eb9
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x40ca3c]
call fcn.00408917
mov edi, eax
test edi, edi
je 0x404f1b
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x404ee2
push dword [esp + 0xc]
push edi
call eax
jmp 0x404f1b
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.00408cb0
mov ebx, eax
lea eax, [esi + 1]
push eax
push ebx
mov byte [ebx], 0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
sub esi, eax
push esi
call fcn.00408d30
pop esi
pop ebx
pop edi
ret 8
Function at 0x406528
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 9
call esi
test al, al
jns 0x406596
push 0x11
call esi
test al, al
js 0x406596
push 0x10
call esi
test al, al
js 0x406596
push 0x12
call esi
test al, al
js 0x406596
mov esi, dword [sym.imp.USER32.dll_GetFocus]
push 5
lea eax, [ebp - 8]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
push 4
lea eax, [ebp - 8]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x406596
push eax
push eax
push 0x44e
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test ax, 0x800
je 0x4065ba
push str.PB_WindowID
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x4065ba
dec eax
push eax
push dword [0x40ca44]
call fcn.00408917
mov eax, dword [eax + 8]
jmp 0x4065bc
xor eax, eax
pop esi
leave
ret 4

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x30bb22f1
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x759b7512
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40659e
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push 0xc
mov eax, 0x5c2306
call fcn.0053a7a4
mov ebx, ecx
mov ecx, dword [ebx + 0x558]
test ecx, ecx
je 0x406745
mov edx, dword [ebx + 0x564]
test edx, edx
je 0x406745
xor esi, esi
cmp dword [ebx + 0x5d0], esi
je 0x406745
cmp dword [ebx + 0x580], esi
je 0x406745
mov eax, dword [ecx]
push 1
push edx
call dword [eax + 0x298]
mov ecx, dword [ebx + 0x580]
push esi
mov eax, dword [ecx]
call dword [eax + 0x138]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
push ecx
mov eax, esp
mov dword [ebp - 4], esi
push ecx
lea ecx, [ebp - 0x18]
mov dword [eax], str.APP.7Z
mov eax, esp
mov dword [eax], 0x5fcfe8
call fcn.00409cf9
mov esi, dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 0x14]
push dword [0x62a280]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test esi, esi
je 0x40664d
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
xor edx, edx
mov ecx, edi
call fcn.0053af10
mulsd xmm0, qword [0x605880]
divsd xmm0, qword [0x6058c8]
call fcn.0053ade1
mov esi, eax
call fcn.00408b3b
mov edi, dword [eax]
test edi, edi
je 0x406699
mov eax, dword [edi + 8]
mov edx, str.global_install_progress_elapse
movd xmm0, esi
mov ecx, edi
cvtdq2pd xmm0, xmm0
movsd qword [eax], xmm0
add eax, 8
mov dword [edi + 8], eax
call fcn.00431f90
xor eax, eax
push eax
push eax
push dword [ebx + 4]
push 0x40675e
push eax
push eax
call fcn.0059495f
mov esi, eax
add esp, 0x18
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
mov ecx, dword [ebx + 0x5d0]
push 0
call fcn.00482210
mov ecx, dword [ebx + 0x5d0]
push 0xc8
push 0x7c6
call fcn.00486ee0
mov edx, str.global_app_id
mov ecx, edi
call fcn.00431d10
push 0
or edx, 0xffffffff
mov ecx, edi
call fcn.00431650
pop ecx
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.00431000
mov edi, dword [ebx + 0x564]
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x12c]
push eax
push 0x7c5
mov ecx, edi
call fcn.00486ee0
mov ecx, dword [ebx + 0x564]
push 0
mov eax, dword [ecx]
call dword [eax + 0x130]
test esi, esi
je 0x406735
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x406758
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x406758
call fcn.00417397
mov ecx, eax
call fcn.004174dc
mov ecx, ebx
call fcn.00406782
call fcn.0053a76d
ret
Function at 0x409098
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x624500]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
test edi, edi
je 0x409104
cmp edi, 0xffffffff
je 0x409104
push 0
push 2
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x409104
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4090f9
cmp edi, dword [ebp - 0x228]
je 0x409114
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4090e3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00539e65
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x409106
Function at 0x40bbc9
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x4bc
mov eax, 0x5c2825
call fcn.0053a7d8
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x354]
mov ebx, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x4c8], esi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edi, 0x104
lea eax, [ebp - 0x11c]
push edi
push 0
push eax
call fcn.0058d810
movzx eax, word [ebp - 0x34e]
push eax
movzx eax, word [ebp - 0x352]
push eax
movzx eax, word [ebp - 0x354]
push eax
push ebx
lea eax, [ebp - 0x11c]
push str._s__d__02d__02d.log
push eax
call fcn.0040bbac
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x358], 0xf
add esp, 0x24
mov byte [ebp - 0x36c], 0
and dword [ebp - 0x35c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40bc53
sub ecx, edx
lea eax, [ebp - 0x11c]
push ecx
push eax
lea ecx, [ebp - 0x36c]
call fcn.00416e38
and dword [ebp - 4], 0
lea eax, [ebp - 0x224]
push edi
push 0
push eax
call fcn.0058d810
push edi
lea eax, [ebp - 0x32c]
push 0
push eax
call fcn.0058d810
push esi
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.00596e25
push 0x5fe0e0
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.00596dbc
add esp, 0x30
lea eax, [ebp - 0x4c4]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40bcdf
push 0x5fe0e8
call fcn.0040bad0
pop ecx
jmp 0x40be5c
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x40be4a
lea eax, [ebp - 0x498]
push 0x5fe0f4
push eax
call fcn.00596d30
pop ecx
pop ecx
test eax, eax
je 0x40be4a
lea eax, [ebp - 0x498]
push 0x5fe0f8
push eax
call fcn.00596d30
pop ecx
pop ecx
test eax, eax
je 0x40be4a
and dword [ebp - 0x334], 0
lea ecx, [ebp - 0x498]
mov dword [ebp - 0x330], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x344], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40bd41
sub ecx, edx
lea eax, [ebp - 0x498]
push ecx
push eax
lea ecx, [ebp - 0x344]
call fcn.00416e38
lea eax, [ebp - 0x344]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x36c]
push eax
call fcn.0040e73a
pop ecx
pop ecx
test al, al
jne 0x40be3b
cmp dword [ebp - 0x330], 0x10
lea eax, [ebp - 0x344]
push 1
cmovae eax, dword [ebp - 0x344]
push 0x5fe0fc
push 0
push dword [ebp - 0x334]
push eax
call fcn.0040bafa
add esp, 0x14
lea ecx, [ebp - 0x344]
push eax
push 0
lea eax, [ebp - 0x384]
push eax
call fcn.0040c61b
push eax
lea ecx, [ebp - 0x344]
call fcn.00410d72
lea ecx, [ebp - 0x384]
call fcn.00416ec0
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40bddb
sub ecx, edx
lea eax, [ebp - 0x344]
cmp dword [ebp - 0x330], 0x10
push ecx
cmovae eax, dword [ebp - 0x344]
push ebx
push dword [ebp - 0x334]
push eax
call fcn.0040bb79
add esp, 0x10
test eax, eax
jne 0x40be3b
lea eax, [ebp - 0x498]
push eax
push dword [ebp - 0x4c8]
lea eax, [ebp - 0x32c]
push str._s_s
push eax
call fcn.0040bbac
add esp, 0x10
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x344]
mov byte [ebp - 4], 0
call fcn.00416ec0
lea eax, [ebp - 0x4c4]
push eax
push edi
call esi
test eax, eax
jne 0x40bcea
lea ecx, [ebp - 0x36c]
call fcn.00416ec0
call fcn.0053a782
ret 8
Function at 0x40c083
Capabilities:
Write file on windows

Disassembly:
push 0x2a4
mov eax, 0x5c28be
call fcn.0053a7d8
mov edi, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 0x60]
mov dword [ebp - 0x284], ecx
mov eax, dword [ecx + 0xc]
cmp eax, dword [edi + 0x64]
jl 0x40c101
jg 0x40c0af
cmp dword [ecx + 8], edx
jb 0x40c101
mov bl, byte [edi + 0x8c]
push eax
push dword [ecx + 8]
lea eax, [ebp - 0x2b0]
push eax
call fcn.0040c93b
push eax
lea edx, [edi + 0x3c]
lea ecx, [ebp - 0x28]
call fcn.0040c82d
pop ecx
and dword [ebp - 4], 0
lea ecx, [edi + 0x68]
push ebx
push eax
call fcn.0040c485
lea ecx, [ebp - 0x28]
call fcn.00416ec0
lea eax, [ebp - 0x28c]
mov ecx, edi
push eax
call fcn.0040c981
mov ecx, dword [eax]
mov dword [edi + 0x60], ecx
mov eax, dword [eax + 4]
mov dword [edi + 0x64], eax
and dword [ebp - 0x278], 0
lea eax, [ebp - 0x270]
mov dword [ebp - method.fmt::v5::basic_memory_buffer_char__128__class_std::allocator_char__.virtual_0], vtable.fmt::v5::basic_memory_buffer_char__500__class_std::allocator_char__.0
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x274], 0x1f4
xor ebx, ebx
lea edx, [ebp - 0x280]
inc ebx
mov dword [ebp - 4], ebx
mov ecx, dword [edi + 8]
push edx
push dword [ebp - 0x284]
mov eax, dword [ecx]
call dword [eax + 4]
push dword [edi + 0x70]
mov esi, dword [ebp - 0x278]
push esi
push ebx
push dword [ebp - 0x27c]
call fcn.00596121
add esp, 0x10
cmp eax, esi
jne 0x40c173
lea ecx, [ebp - 0x280]
call fcn.004141b9
call fcn.0053a782
ret 4
call fcn.00591458
lea edx, [edi + 0x74]
lea ecx, [ebp - 0x64]
mov esi, dword [eax]
call fcn.0040c46a
push eax
mov edx, str.Failed_writing_to_file
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x7c]
call fcn.0040c438
pop ecx
push esi
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 3
call fcn.00410dd7
push 0x61fa98
lea eax, [ebp - 0x4c]
push eax
call fcn.0058dfba
int3

Function at 0x40da8c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push esi
mov esi, 0x811c9dc5
mov eax, dword [eax]
mov dword [ebp + 8], eax
movzx eax, byte [ebp + edx + 8]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x40da9f
mov eax, dword [ecx + 0x18]
and eax, esi
pop esi
pop ebp
ret 4