joyce8/EMBER2024-capa huggingface dataset:
Function at 0x611e64
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.00480390
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret

Function at 0x616100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, edx
mov esi, eax
mov edx, esi
mov eax, dword [0x6c2bc8]
call fcn.0041ff98
inc eax
je 0x6161c6
test bl, bl
je 0x61613b
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xe4]
test al, al
jne 0x61613b
xor eax, eax
mov dword [esi + 0x24c], eax
jmp 0x6161c6
mov edx, esi
mov eax, dword [0x6c2bc8]
call fcn.004200d8
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x124]
mov byte [0x6bddc8], 1
mov dword [0x6c2bbc], esi
xor eax, eax
push ebp
push 0x6161bf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.0046fb3c
call fcn.00612120
push eax
call sub.user32.dll_ShowWindow
mov eax, esi
call fcn.00485c18
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x120]
call sub.user32.dll_GetCapture
mov edx, eax
mov eax, esi
call fcn.00611ca8
test al, al
je 0x6161aa
xor eax, eax
call fcn.004662ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6161c6
mov byte [0x6bddc8], 0
ret
pop esi
pop ebx
pop ebp
ret
Function at 0x61c27c
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x61c284
push ebx
mov ebx, 0x6c2bf8
xor eax, eax
push ebp
push 0x61c499
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [0x6c0114]
call fcn.0059914c
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00404cf4
lea edx, [ebp - 8]
mov eax, dword [0x6bfe4c]
call fcn.0059914c
mov edx, dword [ebp - 8]
lea eax, [ebx + 4]
call fcn.00404cf4
lea edx, [ebp - 0xc]
mov eax, dword [0x6bfe38]
call fcn.0059914c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 8]
call fcn.00404cf4
lea edx, [ebp - 0x10]
mov eax, dword [0x6bf5f0]
call fcn.0059914c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0xc]
call fcn.00404cf4
lea edx, [ebp - 0x14]
mov eax, dword [0x6bf7b0]
call fcn.0059914c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404cf4
lea edx, [ebp - 0x18]
mov eax, dword [0x6c01c4]
call fcn.0059914c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404cf4
lea edx, [ebp - 0x1c]
mov eax, dword [0x6c02f4]
call fcn.0059914c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x18]
call fcn.00404cf4
lea edx, [ebp - 0x20]
mov eax, dword [0x6bf908]
call fcn.0059914c
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x1c]
call fcn.00404cf4
lea edx, [ebp - 0x24]
mov eax, dword [0x6bf5a8]
call fcn.0059914c
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 0x20]
call fcn.00404cf4
lea edx, [ebp - 0x28]
mov eax, dword [0x6bf730]
call fcn.0059914c
mov edx, dword [ebp - 0x28]
lea eax, [ebx + 0x24]
call fcn.00404cf4
lea edx, [ebp - 0x2c]
mov eax, dword [0x6bf32c]
call fcn.0059914c
mov edx, dword [ebp - 0x2c]
lea eax, [ebx + 0x28]
call fcn.00404cf4
lea edx, [ebp - 0x30]
mov eax, dword [0x6bf6b4]
call fcn.0059914c
mov edx, dword [ebp - 0x30]
lea eax, [ebx + 0x2c]
call fcn.00404cf4
lea edx, [ebp - 0x34]
mov eax, dword [0x6bf598]
call fcn.0059914c
mov edx, dword [ebp - 0x34]
lea eax, [ebx + 0x30]
call fcn.00404cf4
lea edx, [ebp - 0x38]
mov eax, dword [0x6bfe34]
call fcn.0059914c
mov edx, dword [ebp - 0x38]
lea eax, [ebx + 0x34]
call fcn.00404cf4
lea edx, [ebp - 0x3c]
mov eax, dword [0x6c00b0]
call fcn.0059914c
mov edx, dword [ebp - 0x3c]
lea eax, [ebx + 0x38]
call fcn.00404cf4
lea edx, [ebp - 0x40]
mov eax, dword [0x6bfdd8]
call fcn.0059914c
mov edx, dword [ebp - 0x40]
lea eax, [ebx + 0x3c]
call fcn.00404cf4
lea edx, [ebp - 0x44]
mov eax, dword [0x6bfc54]
call fcn.0059914c
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x40]
call fcn.00404cf4
lea edx, [ebp - 0x48]
mov eax, dword [0x6bf698]
call fcn.0059914c
mov edx, dword [ebp - 0x48]
lea eax, [ebx + 0x44]
call fcn.00404cf4
lea edx, [ebp - 0x4c]
mov eax, dword [0x6c0154]
call fcn.0059914c
mov edx, dword [ebp - 0x4c]
lea eax, [ebx + 0x48]
call fcn.00404cf4
lea edx, [ebp - 0x50]
mov eax, dword [0x6bf33c]
call fcn.0059914c
mov edx, dword [ebp - 0x50]
lea eax, [ebx + 0x4c]
call fcn.00404cf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61c4a0
lea eax, [ebp - 0x50]
mov edx, 0x14
call fcn.00404cc4
ret
Function at 0x66749f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x6bed5a
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x6674f7
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x6bed7b
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x6674ed
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x6674fb
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x6a9794
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405160
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x6a98f7
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.00603130
mov ebx, eax
mov dword [esi], 0x128
mov edx, esi
mov eax, ebx
call fcn.00603150
jmp 0x6a98c9
lea eax, [ebp - 0x138]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404f20
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a974
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409900
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409900
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004050bc
je 0x6a98ab
lea eax, [ebp - 0x144]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404f20
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409900
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409900
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004050bc
jne 0x6a98c0
push 0
mov eax, dword [esi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, esi
mov eax, ebx
call fcn.00603170
test eax, eax
jne 0x6a980c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a98fe
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404cc4
lea eax, [ebp - 4]
call fcn.00404ca0
ret
Function at 0x6b1f90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405160
xor eax, eax
push ebp
push 0x6b204a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404f70
test eax, eax
jle 0x6b202f
lea eax, [ebp - 0x10]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004051d0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00409900
mov eax, dword [ebp - 0xc]
mov edx, 0x6b2060
call fcn.004050bc
jne 0x6b1ffb
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404d38
jmp 0x6b200b
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x6b2070
call fcn.00404fbc
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405170
push eax
push 0x6b2078
mov eax, dword [0x6bfd90]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b2051
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404cc4
ret
Function at 0x6b336c
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
lea ebx, [ebp - 0x84]
xor eax, eax
push ebp
push 0x6b35aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx], 0x53
mov dword [ebx + 4], 0x21
mov dword [ebx + 8], 0x49
mov dword [ebx + 0xc], 0xe
mov dword [ebx + 0x10], 0x17
mov dword [ebx + 0x14], 0x38
mov dword [ebx + 0x18], 0x1c
mov dword [ebx + 0x1c], 0x5c
mov dword [ebx + 0x20], 0xd
mov dword [ebx + 0x24], 0x11
mov dword [ebx + 0x28], 0x87
mov dword [ebx + 0x2c], 0xa6
mov dword [ebx + 0x30], 0x90
mov dword [ebx + 0x34], 0x72
mov dword [ebx + 0x38], 0x7b
mov dword [ebx + 0x3c], 0x9c
mov dword [ebx + 0x40], 0x80
mov dword [ebx + 0x44], 0xc0
mov dword [ebx + 0x48], 0xb7
mov dword [ebx + 0x4c], 0x75
mov dword [ebx + 0x28], 0xf5
mov dword [ebx + 0x2c], 0x10a
mov dword [ebx + 0x58], 0xe9
mov dword [ebx + 0x5c], 0xd6
mov dword [ebx + 0x60], 0xdf
mov dword [ebx + 0x64], pe_nt_image_headers32
mov dword [ebx + 0x68], 0xe4
mov dword [ebx + 0x6c], 0x124
mov dword [ebx + 0x70], 0x11b
mov dword [ebx + 0x74], 0xd9
lea edx, [ebp - 0x8c]
mov eax, dword [0x6bfd90]
mov eax, dword [eax]
call fcn.004898a0
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x88]
call fcn.0040a8ac
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 8]
mov ecx, 0x6b35c0
call fcn.00404fbc
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, 0x6b35e0
mov eax, 0x6b35ec
call fcn.006b2260
mov eax, dword [ebp - 0xc]
call fcn.00404f70
cmp eax, 0x140
je 0x6b34e8
mov eax, dword [ebp - 4]
call fcn.00404ca0
jmp 0x6b357f
xor eax, eax
push ebp
push 0x6b3526
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x90]
push eax
mov ecx, 2
mov edx, 0x64
mov eax, dword [ebp - 0xc]
call fcn.004051d0
mov eax, dword [ebp - 0x90]
call fcn.0040a07c
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6b353f
cmp esi, 0x1e
jle 0x6b354e
mov eax, dword [ebp - 4]
call fcn.00404ca0
jmp 0x6b357f
test esi, esi
jle 0x6b357f
lea eax, [ebp - 0x94]
push eax
mov edx, dword [ebx]
mov ecx, 1
mov eax, dword [ebp - 0xc]
call fcn.004051d0
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 4]
call fcn.00404f78
mov eax, dword [ebp - 4]
add ebx, 4
dec esi
jne 0x6b3552
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b35b1
lea eax, [ebp - 0x94]
mov edx, 4
call fcn.00404cc4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404cc4
ret
Function at 0x6b36b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405160
xor eax, eax
push ebp
push 0x6b37d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404cf4
mov eax, dword [ebp - 4]
call fcn.00404f70
mov esi, eax
test esi, esi
jle 0x6b373c
mov ebx, 1
mov eax, edi
call fcn.004051c8
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
movzx ecx, word [ebp - 6]
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [edi]
movzx eax, byte [eax + ebx - 1]
add ax, word [ebp - 6]
imul ax, ax, 0xce6e
add ax, 0x58c0
mov word [ebp - 6], ax
inc ebx
dec esi
jne 0x6b3705
lea eax, [ebp - 4]
mov edx, dword [edi]
call fcn.00404d38
mov eax, edi
call fcn.00404ca0
mov eax, dword [ebp - 4]
call fcn.00404f70
mov esi, eax
test esi, esi
jle 0x6b37b1
mov ebx, 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
mov dword [ebp - 0xc], eax
push dword [edi]
mov eax, dword [ebp - 0xc]
mov ecx, 0x1a
cdq
idiv ecx
mov edx, eax
add dl, 0x41
lea eax, [ebp - 0x10]
call fcn.00404e88
push dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ecx, 0x1a
cdq
idiv ecx
add dl, 0x41
lea eax, [ebp - 0x14]
call fcn.00404e88
push dword [ebp - 0x14]
mov eax, edi
mov edx, 3
call fcn.00405030
inc ebx
dec esi
jne 0x6b3760
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b37db
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404cc4
lea eax, [ebp - 4]
call fcn.00404ca0
ret
Function at 0x6b37e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405160
xor eax, eax
push ebp
push 0x6b38e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404ca0
mov eax, dword [ebp - 4]
call fcn.00404f70
mov esi, eax
sar esi, 1
jns 0x6b3829
adc esi, 0
test esi, esi
jle 0x6b386e
mov ebx, 1
mov eax, ebx
add eax, eax
mov edx, dword [ebp - 4]
movzx edx, byte [edx + eax - 2]
sub edx, 0x41
imul edx, edx, 0x1a
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
sub eax, 0x41
add dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
mov dl, byte [ebp - 0xc]
call fcn.00404e88
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00404f78
inc ebx
dec esi
jne 0x6b3832
lea eax, [ebp - 4]
mov edx, dword [edi]
call fcn.00404d38
mov eax, dword [ebp - 4]
call fcn.00404f70
mov esi, eax
test esi, esi
jle 0x6b38c3
mov ebx, 1
mov eax, edi
call fcn.004051c8
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
movzx ecx, word [ebp - 6]
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
add ax, word [ebp - 6]
imul ax, ax, 0xce6e
add ax, 0x58c0
mov word [ebp - 6], ax
inc ebx
dec esi
jne 0x6b388b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b38e8
lea eax, [ebp - 0x10]
call fcn.00404ca0
lea eax, [ebp - 4]
call fcn.00404ca0
ret
Function at 0x40549c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x42bff8], 0x44
push eax
xor eax, eax
push 0x42bff8
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4054d7
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x40557d
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00405833
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x4055b1
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42ec08], eax
jmp 0x40574a
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x4055cf
test eax, eax
je 0x4056f5
test byte [ebp + 0xc], 2
je 0x4056f5
mov esi, 0x42aff8
push edi
push esi
call fcn.00405c67
test ebx, ebx
je 0x4055ec
push 0x409340
push esi
call fcn.00405c8a
jmp 0x4055f2
push edi
call fcn.00405797
cmp byte [edi], 0
jne 0x405600
cmp byte [0x42aff8], 0x5c
jne 0x40560b
push 0x409010
push edi
call fcn.00405c8a
push edi
call fcn.00405c7d
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4056eb
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.0040577b
cmp byte [eax], 0
je 0x405651
cmp byte [ebp - 0x18], 0
je 0x405651
lea esi, [ebp - 0x18]
mov al, byte [esi]
cmp al, 0x2e
jne 0x40566c
cmp byte [esi + 1], 0
je 0x4056ca
cmp al, al
jne 0x40566c
cmp byte [esi + 1], al
jne 0x40566c
cmp byte [esi + 2], 0
je 0x4056ca
push esi
push ebx
call fcn.00405c67
test byte [ebp - 0x148], 0x10
je 0x405691
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4056ca
push dword [ebp + 0xc]
push edi
call fcn.0040557d
jmp 0x4056ca
push edi
call fcn.0040591d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4056c2
test byte [ebp + 0xc], 4
je 0x4056ba
push edi
push 0xfffffffffffffff1
call fcn.00404fd0
push 0
push edi
call fcn.004059b4
jmp 0x4056ca
inc dword [0x42ec08]
jmp 0x4056ca
push edi
push 0xfffffffffffffff2
call fcn.00404fd0
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40562f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x4056f5
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x40574a
cmp dword [ebp - 8], esi
jne 0x40570a
inc dword [0x42ec08]
jmp 0x40574a
push edi
call fcn.00405f8c
test eax, eax
je 0x40574a
push edi
call fcn.00405750
push edi
call fcn.0040591d
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405742
test byte [ebp + 0xc], 4
je 0x405702
push edi
push 0xfffffffffffffff1
call fcn.00404fd0
push esi
push edi
call fcn.004059b4
jmp 0x40574a
push edi
push 0xffffffffffffffe5
call fcn.00404fd0
pop edi
pop esi
leave
ret 8
Function at 0x4059b4
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405fb3
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4059d8
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405b11
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x42c180], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x42c180
je 0x405a1c
push 1
push 0
push esi
call fcn.0040593c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405b17
cmp eax, edi
jg 0x405b17
mov esi, 0x42bbf8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405b17
cmp eax, edi
jg 0x405b17
push esi
push ebp
push 0x40934c
push 0x42b7f8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x42eb90]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405c9b
push 4
push 0xc0000000
push esi
call fcn.0040593c
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405b11
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405b0a
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405b0a
cmp edi, dword [esp + 0x18]
jne 0x405b0a
push str._Rename__r_n
push esi
call fcn.004058ab
test eax, eax
jne 0x405b1e
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405c67
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x42b7f8
push eax
call fcn.004058f7
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x42ec10]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409348
push eax
call fcn.004058ab
test eax, eax
je 0x405ad5
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405b45
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405b3a
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405ad7
Function at 0x402d20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 0xc]
test byte [0x407080], 1
jne 0x402d3c
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__d__semi_stub:_no_script_engine_clean_up_n
mov dword [esp + 8], str.Host_Quit
mov dword [esp + 4], 0x407080
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x402d33
Function at 0x403df0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x403e48
cmp byte [esi + ebx - 1], 0xa
je 0x403e1c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x40717c], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x406520
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x4065ab
cmp ax, 9
je 0x406598
cmp ax, 0x20
je 0x406598
mov dword [ebp - 0x6c], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x406600
cmp ax, 0x22
je 0x406610
mov dword [ebp - 0x6c], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x4065ab
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x406550
test edi, 1
jne 0x406550
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x406598
cmp ax, 0x20
je 0x406598
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x406628
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc dword [ebp - 0x6c]
jmp 0x40656b
and dword [ebp - 0x6c], 1
jne 0x406564
xor edi, 1
jmp 0x40656b
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x4065c4

Function at 0x406640
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop