joyce8/EMBER2024-capa huggingface dataset:
Function at 0x629b3d
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
mov sp, 0xd0d
sbb dword [ecx - 0x463a1d71], ebx
invalid
mov dl, 0x4c
aad 0xc2
jge 0x629a88
popal
out dx, al
invalid
and al, 0x6f
cmc
dec esp
xor esp, dword [eax - 0x2ace5ee3]
mov ch, 0x8c
insb byte es:[edi], dx
push cs
imul ah
je 0x629aa9
sub byte [edi - 0x7b], ch
xlatb
mov ch, bl
jecxz 0x629b60
popfd
std
mov ebx, 0x2e707d07
aam 0x90
mov bh, ch
xor eax, 0x6eb60d30
stc
stc
jg 0x629b76
push 0x75
div eax
in al, 0x1e
lodsd eax, dword [esi]
aaa
aam 0x36
les esp, [edi]
test byte [edi + 0xd7eed0f], bl
sbb dword [edi], 0xffffff89
pop ss
mov dh, 0xdf
xor dword [ebx + edi - 0x1078fde7], ebp
fucom st(4)
xchg esp, eax
mov dword [0xeded7b34], eax
sal ch, 0xf0
sub dword [ecx - 0x55], 0x6c8c2d9e
mul byte cs:[ebx + 0x54fcc25f]
inc esi
cmpsd dword [esi], dword es:[edi]
cmp dl, dh
jne 0x629b15
xlatb
xlatb
sbb eax, 0xbfe2ef84
adc ecx, esi
push edi
je 0x629ad1
and ecx, dword [ebp - 0x3226d6bc]
in al, 0x43
inc esp
lodsb al, byte [esi]
adc dword [ebx - 0x590c8c02], ebp
daa
and al, 0x9d
jle 0x629b9e
int3
cmp dh, byte [ebx - 0x1870ff33]
fdiv dword [esi - 0x72]
sbb dword [edx + edi*8 + 0x2b1f508c], ebx
sti
mov word [eax + 0x1f], ss
sub edi, ebx
ljmp 0x155a:0x5fcd8366
pop edx
adc eax, 0x69624d3d
sbb al, 0x8a
jne 0x629b80
mov edx, 0x9d56dd2c
jbe 0x629b6c
ja 0x629bd5
inc ebx
or al, 0x64
enter 0xffffffffffffa751, 0x3f
rcr byte [0xb6181476], cl
push ecx
je 0x629bf8
aam 0x39
invalid
mov ch, 0x65
in eax, dx
dec ecx
dec ebx
mov eax, 0x2add15fa
out dx, eax
loope 0x629ba6
invalid
fnsave dword [ebp - 0x6b]
vpackssdw ymm3, ymm0, ymmword [edx + edi*2]
xchg dword [ebp - 0x2c], edi
popfd
jmp 0x629bdc
sti
lea eax, [edx*2 + 0x1ea53914]
push ds
aad 0xb3
jmp 0x629c3b
hlt
sbb dword [ebx], 0xffffff87
add al, 0xf
int1
xlatb
in eax, 0x91
iretd
Function at 0x64c6ad
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
dec eax
lea eax, [edi + esi*8]
das
push 0x758c5ff8
test dword [ebx + 0x5b], esp
cmp al, 0xb1
cwde
add byte [ebx], 0x4e
lds ecx, [ebp + 0x47]
xchg esi, eax
mov dh, 0xfd
cmc
jmp 0x9a4af01b
push ds
das
dec edx
dec edi
insd dword es:[edi], dx
push esi
mov bl, 0xc2
bound ebp, qword [esi - 0x1179a6cb]
add al, 0x64
push ds
cmp dh, byte [ebp - 0x72]
and eax, 0x45880beb
mov dword [ebp + 0x2e], eax
xor byte [esi + 0xf10ec33], bh
ret 0xae62
jecxz 0x64c735
pushfd
jo 0x64c6b4
and eax, eax
movsb byte es:[edi], byte [esi]
stosb byte es:[edi], al
dec esi
fadd qword [esi + eax - 0x15]
adc edx, edi
loopne 0x64c6e3
jae 0x64c689
inc ebx
push eax
sal dword [ecx + 0x44], 1
mov dh, 0xdd
pop esp
aas
stosb byte es:[edi], al
push esi
insd dword es:[edi], dx
lcall 0x7662, 0xadecde42
stosd dword es:[edi], eax
inc edx
fsubp st(4)
lodsd eax, dword [esi]
bound esi, qword [esi - 0x55]
mov ebx, 0x9715dadb
mov al, byte ds:[0xb681ec03]
push ds
push eax
sub al, 0x2d
daa
pop esi
xor byte [edx], al
mov bl, 0x15
sahf
push 0xb0e27b97
jnp 0x64c6f2
cmp eax, 0x5c823ccb
add eax, 0x80d6c23
fst qword [edx + 0x47]
mov esp, 0x33c857f9
adc dword [edi], 0x31
mov ah, 0xec
xor ecx, dword [edi + eax*8]
les edx, fs:[ecx - 0x39]
int 0xe0
cmp byte [edi], ch
loopne 0x64c76f
das
or eax, 0xeeb604ab
cmc
and dword [ebx], 0x93721f85
std
je 0x64c6cf
sub al, cl
xchg esi, eax
lea edx, [0x6c9b769b]
cld
xor esi, dword [ebp - 0x78ae2aad]
adc dword [eax], edx
push esi
dec ecx
scasb al, byte es:[edi]
Function at 0x64e2dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6593d8
cmp edx, dword [eax]
je 0x64e2ff
add eax, 8
inc ecx
cmp eax, 0x659468
jl 0x64e2f0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6593d8]
jne 0x64e42d
mov eax, dword [0xa5cd44]
cmp eax, 1
je 0x64e407
test eax, eax
jne 0x64e330
cmp dword [0x659304], 1
je 0x64e407
cmp edx, 0xfc
je 0x64e42d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64e367
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064ecc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064f150
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64e3aa
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064f150
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x653f4c
push edi
call fcn.00651020
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064ecc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064ecd0
lea eax, [ebp - 0xa0]
push 0x653f2c
push eax
call fcn.0064ecd0
push dword [esi + 0x6593dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064ecd0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00650f94
add esp, 0x2c
pop edi
jmp 0x64e42d
lea eax, [ebp + 8]
lea esi, [esi + 0x6593dc]
push 0
push eax
push dword [esi]
call fcn.0064f150
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403a04
Capabilities:
Write file on windows

Disassembly:
in eax, dx
and eax, 0x8b348b49
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x403a06
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x403a06
call fcn.00401819
pushfd
mov ebp, 0x5a8b46f1
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00401819
or al, 0xf3
dec eax
sar edi, 0x75
or bh, bh
jne 0x403a4f
push dword [ebp]
call fcn.00402019
mov edx, dword [eax + 0xc]
test edx, edx
jle 0x403a74
invalid
xor ecx, ecx
mov dword [eax + 0xc], ecx
push ecx
lea ecx, [esp + 4]
push ecx
push edx
push dword [eax + 0x14]
push dword [eax]
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x403a78
xor eax, eax
pop ecx
ret
call sub.kernel32.dll_GetLastError
jmp 0x403a76

Function at 0x4051fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405235
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40523e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x401aa0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401adf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401adf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401adf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401adf
cmp dword [ecx + 0x74], 0xe
jbe 0x401adf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407b37
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
invalid
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
jmp fcn.004011d0
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [0x444000]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, eax
mov esi, ebx
mov ebx, esi
xor esi, ebx
xor eax, ebx
xor eax, ebx
mov eax, eax
xor esi, eax
mov ebx, eax
neg eax
mov esi, 0xad
not edx
ror esi, 0x33
neg eax
or edi, 0xb
inc ebx
bswap eax
sub edi, 0x9e
dec edi
not eax
sub ebx, 0xcb
rcl eax, 0x77
not esi
not edi
not edx
and edx, 0xa1
and esi, 0x56
and eax, 0x82
not edi
not edx
not eax
inc eax
rol edi, 0x6c
inc esi
sbb esi, 0x6c
neg esi
rol edi, 0xa
inc edi
bswap esi
dec edi
or edi, 0xe7
imul edx
mov edi, 0xc
rcr edi, 0x56
rol eax, 0xcd
imul esi
rcl eax, 0x19
mov ebx, 0x48
bswap edx
inc ebx
sbb esi, 0xc
neg eax
dec edi
or edx, 0xb7
neg eax
neg ebx
inc eax
rol esi, 0x26
rcr ebx, 0xa2
xor ecx, ecx
xor edi, edi
xor ebx, ebx
xor eax, ebx
xor esi, esi
xor esi, ebx
mov esi, esi
mov esi, esi
sbb ebx, 0x4e
sbb edx, 0xb1
or edx, 0x51
and esi, 0xb1
or ebx, 0xfe
dec edx
mov edi, 0x94
mov ebx, 0xf7
inc ebx
and esi, 0x4b
inc edi
neg esi
rol eax, 0x58
inc edx
bswap edi
mov edi, 0xab
add edi, 0xc3
rol edx, 0x62
dec eax
add edi, 0x6e
bswap esi
rcr ebx, 9
rcl esi, 0xe7
and esi, 0xa3
imul eax
add ebx, 0x73
or edi, 0xe4
dec edi
imul edi
dec edx
sbb esi, 0x67
bswap edx
neg ebx
mov edx, 0x2c
or edi, 0x54
not edi
or eax, 0x61
imul ebx
imul edi
imul ebx
not esi
inc eax
imul edx
inc edx
not edx
or ebx, 0x77
neg eax
ror esi, 0x75
rcl edi, 0x7a
inc edx
mov eax, esi
xor ebx, eax
mov ebx, ebx
mov esi, ebx
mov eax, ebx
mov eax, esi
xor esi, ebx
mov esi, ebx
mov esi, esi
mov ecx, dword [ebp + 0xc]
and eax, 0x92
or ebx, 0x4d
rcr esi, 0x34
and edi, 0x50
not edx
inc ebx
not edi
neg esi
sbb edi, 0xe3
and eax, 0xac
and ebx, 0x49
add ebx, 0xf1
or esi, 0xae
bswap ebx
mov ebx, 0xf4
rcr ebx, 0x17
neg eax
mov ebx, 0xc9
neg esi
rcr edx, 0x3d
imul esi
sbb eax, 0xf6
dec ebx
inc ebx
dec edi
add ebx, 0x56
imul ebx
inc edi
mov edi, 0x1a
and edi, 0x92
imul esi
rcl eax, 0x3c
inc edx
inc edx
rcr edi, 0x33
bswap edi
ror eax, 0x45
bswap eax
inc esi
neg edx
sub edx, 0x38
not ebx
sub eax, 0x6f
bswap edi
inc eax
sub edi, 0x46
neg eax
sub edi, 0x32
not esi
ror eax, 0x7b
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, eax
mov eax, eax
xor eax, ebx
xor ebx, eax
mov ebx, esi
xor esi, eax
xor ebx, eax
mov esi, eax
not byte [edi]
xor eax, esi
xor esi, ebx
xor ebx, ebx
xor esi, ebx
xor eax, eax
xor eax, esi
mov eax, eax
mov esi, ebx
mov ebx, eax
xor eax, eax
mov eax, esi
xor esi, esi
sub byte [edi], 0x39
mov eax, esi
xor eax, esi
xor eax, esi
mov ebx, eax
mov ebx, eax
xor esi, esi
add byte [edi], 0x68
mov eax, ebx
xor eax, esi
mov ebx, esi
mov esi, ebx
xor eax, eax
mov esi, esi
xor esi, ebx
xor ebx, ebx
xor esi, esi
imul byte [edi]
inc edi
loop 0x4011f8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004013a0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401b9f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401bde
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401bde
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401bde
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401bde
cmp dword [ecx + 0x74], 0xe
jbe 0x401bde
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407aa6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4196b8
push 0x4196b0
push str.FlsAlloc
push 0x1f
call fcn.00407965
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407ada
push dword [ebp + 8]
mov ecx, esi
call dword [0x418130]
call esi
jmp 0x407ae0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x407b24
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4196c8
push 0x4196c0
push str.FlsGetValue
push 0x21
call fcn.00407965
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407b5b
push dword [ebp + 8]
mov ecx, esi
call dword [0x418130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x407b63
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4196d0
push 0x4196c8
push str.FlsSetValue
push 0x22
call fcn.00407965
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407b9d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x418130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40b0e8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b185
push ebx
push esi
call fcn.0040b0b1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b045
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b132
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b184
push edi
push eax
call fcn.00408255
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b152
call fcn.004077f8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b183
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b045
add esp, 0x20
test eax, eax
jne 0x40b171
push edi
call fcn.004077f8
jmp 0x40b179
push ebx
call fcn.004077f8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x413240
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41326d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41326d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x43f744
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x48fcd8]
shr eax, 0x11
mov dword [ebp - 4], 1
push esi
push edi
test al, 1
je 0x43f773
cmp dword [0x48ffa4], 0
je 0x43f773
mov esi, 0x48ff94
push esi
call fcn.0043fa26
jmp 0x43f79d
and dword [0x48ffa4], 0
mov esi, 0x48ff94
cmp dword [0x48ffa8], 0x10
mov eax, esi
push esi
cmovae eax, dword [0x48ff94]
push 0x3fc
mov byte [eax], 0
call fcn.0043fa04
call fcn.0043fb1f
mov edi, eax
test edi, edi
je 0x43f7fe
mov edx, dword [0x48ffa8]
mov eax, esi
cmp edx, 0x10
cmovae eax, dword [0x48ff94]
mov eax, dword [eax]
cmp eax, dword [0x459947]
jne 0x43f7f2
mov eax, dword [0x48ffa4]
cmp edx, 0x10
mov ecx, esi
cmovae ecx, dword [0x48ff94]
add eax, 0xfffffffc
push edi
push 1
push eax
lea eax, [ecx + 4]
push eax
call fcn.004251b7
add esp, 0x10
dec eax
neg eax
sbb al, al
inc al
mov byte [ebp - 4], al
push edi
call fcn.00424c3c
mov eax, dword [ebp - 4]
pop ecx
jmp 0x43f800
xor al, al
and dword [0x48ffa4], 0
cmp dword [0x48ffa8], 0x10
pop edi
cmovae esi, dword [0x48ff94]
mov byte [esi], 0
pop esi
leave
ret

Function at 0x43f81c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x469034]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x48fbf0], 0
push esi
mov esi, 0x48fbe0
jne 0x43f937
push ebx
lea eax, [ebp - 0x804]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x804]
mov ecx, esi
push eax
call fcn.00402e90
cmp dword [0x48fbf4], 8
mov eax, esi
cmovae eax, dword [0x48fbe0]
xor ebx, ebx
push ebx
push eax
call fcn.00424645
pop ecx
pop ecx
test eax, eax
je 0x43f895
push 0x45de50
mov ecx, esi
call fcn.00402e90
mov ecx, esi
call fcn.00407f19
cmp dword [0x48fbf0], ebx
je 0x43f8ba
cmp dword [0x48fbf4], 8
mov eax, esi
push ebx
cmovae eax, dword [0x48fbe0]
push eax
call fcn.00424645
pop ecx
pop ecx
test eax, eax
je 0x43f8cd
push str.TEMP
call fcn.0042548f
pop ecx
push eax
mov ecx, esi
call fcn.00402e90
cmp dword [0x48fbf0], ebx
je 0x43f8f2
cmp dword [0x48fbf4], 8
mov eax, esi
push ebx
cmovae eax, dword [0x48fbe0]
push eax
call fcn.00424645
pop ecx
pop ecx
test eax, eax
je 0x43f905
push 0x460360
call fcn.0042548f
pop ecx
push eax
mov ecx, esi
call fcn.00402e90
cmp dword [0x48fbf0], ebx
je 0x43f92a
cmp dword [0x48fbf4], 8
mov eax, esi
push ebx
cmovae eax, dword [0x48fbe0]
push eax
call fcn.00424645
pop ecx
pop ecx
test eax, eax
je 0x43f936
push 0x48fbb0
mov ecx, esi
call fcn.00404c8b
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041b52d
leave
ret
Function at 0x4030b5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4030e0
mov ecx, dword [0x447798]
push esi
add eax, ecx
push esi
push eax
mov dword [0x4284dc], eax
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.004031bd
cmp eax, esi
jl 0x4031b7
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00405d52
test eax, eax
je 0x4031a7
push dword [ebp + 8]
add dword [0x4284dc], 4
call fcn.004031bd
mov ebx, eax
cmp ebx, esi
jl 0x4031b5
cmp dword [ebp + 0x10], esi
jne 0x403183
cmp dword [ebp + 8], esi
jle 0x4031b5
mov esi, 0x41c4d8
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x403145
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00405d52
test eax, eax
je 0x4031a7
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00405d81
test eax, eax
je 0x40317f
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x4284dc], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x403134
jmp 0x4031b5
push 0xfffffffffffffffe
jmp 0x4031a9
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x40318e
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4031ac
push 0xfffffffffffffffd
pop eax
jmp 0x4031b7
mov ebx, dword [ebp - 4]
add dword [0x4284dc], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x40572e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x40837c
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x40836c
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40577f
xor eax, eax
jmp 0x4057a6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x4057a6
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
jne 0x40577b
call esi
pop esi
leave
ret 4

Function at 0x4057e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x43e538], 0x44
push eax
xor eax, eax
push 0x43e538
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40581f
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405823
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
ret 4

Function at 0x4058c1
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405cb5
mov edi, eax
cmp edi, 0xffffffff
je 0x405902
test byte [esp + 0x10], 1
push esi
je 0x4058e4
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x4058ea
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4058f3
xor eax, eax
inc eax
jmp 0x405904
test byte [esp + 0x10], 4
jne 0x405902
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x405909
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405bc7
test bl, 8
mov dword [ebp - 0xc], eax
je 0x405948
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4477c8], eax
jmp 0x405ad2
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405962
test eax, eax
je 0x405a80
test bl, 2
je 0x405a80
mov esi, 0x43a538
push edi
push esi
call fcn.00406141
cmp dword [ebp + 8], 0
je 0x405981
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405987
push edi
call fcn.00405b20
cmp byte [edi], 0
jne 0x405995
cmp byte [0x43a538], 0x5c
jne 0x4059a0
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405a76
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405b04
cmp byte [eax], 0
je 0x4059e6
cmp byte [ebp - 0x1c], 0
je 0x4059e6
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x4059fc
mov al, byte [esi + 1]
test al, al
je 0x405a55
cmp al, 0x2e
jne 0x4059fc
cmp byte [esi + 2], 0
je 0x405a55
push esi
push ebx
call fcn.00406141
test byte [ebp - 0x14c], 0x10
je 0x405a21
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405a55
push dword [ebp + 0xc]
push edi
call fcn.00405909
jmp 0x405a55
push dword [ebp - 4]
push edi
call fcn.004058c1
test eax, eax
jne 0x405a4d
cmp dword [ebp - 4], eax
je 0x405a45
push edi
push 0xfffffffffffffff1
call fcn.00405268
push 0
push edi
call fcn.00405f20
jmp 0x405a55
inc dword [0x4477c8]
jmp 0x405a55
push edi
push 0xfffffffffffffff2
call fcn.00405268
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4059c4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405a80
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405ad2
cmp dword [ebp - 0xc], esi
jne 0x405a94
inc dword [0x4477c8]
jmp 0x405ad2
push edi
call fcn.00406444
test eax, eax
je 0x405ad2
push edi
call fcn.00405ad9
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004058c1
test eax, eax
jne 0x405aca
cmp dword [ebp - 4], esi
je 0x405a8c
push edi
push 0xfffffffffffffff1
call fcn.00405268
push esi
push edi
call fcn.00405f20
jmp 0x405ad2
push edi
push 0xffffffffffffffe5
call fcn.00405268
pop edi
pop esi
pop ebx
leave
ret 8