joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443770
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cae38
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4fa078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
lea edx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
lea ecx, [esi + 0x18]
cmovae edx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x4437b9
mov ecx, dword [ecx]
push 0
push 0
push ecx
call fcn.00423f40
add esp, 0xc
cmp eax, dword [esi + 0x60]
jne 0x443814
test edx, edx
jne 0x443814
push 0x32
push edx
lea eax, [ebp - 0x44]
push eax
call fcn.004a4a80
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
lea edx, [ebp - 0x44]
cmovae ecx, dword [ebp + 8]
add esp, 8
call fcn.00423a50
lea eax, [esi + 0x30]
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x4437ff
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004ac78e
add esp, 8
test eax, eax
jne 0x443814
mov bl, 1
jmp 0x443828
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor bl, bl
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x44385e
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x443854
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44387b
push edx
push ecx
call fcn.0044bea4
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044b735
mov esp, ebp
pop ebp
ret
call fcn.004ab9cc
int3
Function at 0x444b30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb090
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4fa078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], edx
mov ebx, ecx
mov dword [ebp - 4], 0
xor esi, esi
nop dword [eax]
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00403630
mov byte [ebp - 4], 1
lea edx, [ebp - 0x5c]
cmp dword [ebp - 0x48], 8
lea ecx, [ebx + 0x18]
cmovae edx, dword [ebp - 0x5c]
cmp dword [ebx + 0x2c], 0x10
jb 0x444b97
mov ecx, dword [ebx + 0x18]
push dword [ebp - 0x60]
push 1
push ecx
call fcn.00423f40
add esp, 0xc
cmp eax, dword [ebx + 0x60]
jne 0x444c05
test edx, edx
jne 0x444c05
push 0x32
push edx
lea eax, [ebp - 0x44]
push eax
call fcn.004a4a80
cmp dword [ebp - 0x48], 8
lea ecx, [ebp - 0x5c]
lea edx, [ebp - 0x44]
cmovae ecx, dword [ebp - 0x5c]
add esp, 8
call fcn.00423a50
lea eax, [ebx + 0x30]
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x444bde
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004ac78e
add esp, 8
test eax, eax
je 0x444c88
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
cmovae eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x444c43
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x444c39
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444cef
push edx
push ecx
call fcn.0044bea4
add esp, 8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x444b70
xor bl, bl
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x444ccc
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x444cc2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444cea
jmp 0x444cc2
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x444cbe
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x444cb4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444cef
push edx
push ecx
call fcn.0044bea4
add esp, 8
mov bl, 1
jmp 0x444c5a
push edx
push ecx
call fcn.0044bea4
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044b735
mov esp, ebp
pop ebp
ret
call fcn.004ab9cc
call fcn.004ab9cc
int3
Function at 0x44cb50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4fa078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov byte [edi + 0x68], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi + 0xc]
test al, 6
jne 0x44cc74
test al, 1
jne 0x44cbef
nop dword [eax]
push 0
push 0x400
lea eax, [ebp - 0x404]
mov ecx, esi
push eax
call fcn.0044d520
cmp dword [esi + 0xc], 0
mov eax, dword [esi + 8]
jl 0x44cbe3
jg 0x44cbd4
test eax, eax
je 0x44cbe3
push eax
lea eax, [ebp - 0x404]
mov ecx, edi
push eax
call fcn.0044deb0
mov eax, dword [esi]
mov eax, dword [eax + 4]
test byte [eax + esi + 0xc], 1
je 0x44cbb0
cmp dword [esi + 0x5c], 0
push ebx
jne 0x44cc02
mov dword [ebp - 0x408], 0
jmp 0x44cc38
lea ecx, [esi + 0x10]
call fcn.00428900
push dword [esi + 0x5c]
xor edx, edx
lea ecx, [esi + 0x10]
test al, al
cmove ecx, edx
mov dword [ebp - 0x408], ecx
call fcn.004ac0f9
xor ecx, ecx
add esp, 4
test eax, eax
mov eax, dword [ebp - 0x408]
cmovne eax, ecx
mov dword [ebp - 0x408], eax
push 2
push 0
lea ecx, [esi + 0x10]
call fcn.004289c0
cmp dword [ebp - 0x408], 0
pop ebx
jne 0x44cc74
mov eax, dword [esi]
mov ecx, dword [eax + 4]
xor eax, eax
add ecx, esi
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
and eax, 0x17
mov dword [ecx + 0xc], eax
mov ecx, dword [ecx + 0x10]
and ecx, eax
jne 0x44cc88
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0044b735
mov esp, ebp
pop ebp
ret 4
test cl, 4
je 0x44cc94
mov esi, str.ios_base::badbit_set
jmp 0x44cca4
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x40c]
push 1
push eax
call fcn.0040dae0
add esp, 8
lea ecx, [ebp - 0x420]
push eax
push esi
call fcn.0040de80
push 0x4f7a20
lea eax, [ebp - 0x420]
push eax
call fcn.004a448b
int3

Function at 0x44cce0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
mov byte [esi + 0x68], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.0044deb0
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x44eb60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
dec eax
cmp eax, 3
ja case.default.0x44eb75
jmp dword [eax*4 + 0x44ed14]
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x44eb93
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
pop ebp
ret
mov ebx, dword [ebp + 0x10]
mov dword [ebx], 0x10
cmp eax, 0x10
je 0x44ebab
pop edi
pop esi
mov eax, 0x1005
pop ebx
pop ebp
ret
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x28]
push edi
mov dword [edi], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 4], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x3c]
push eax
call fcn.0044f400
push dword [esi + 4]
push 0x10
push edi
call fcn.00451930
mov ecx, eax
add esp, 0x14
cmp ecx, 0xfffffffd
jne 0x44ebee
pop edi
pop esi
mov eax, 0x1003
pop ebx
pop ebp
ret
cmp ecx, 0xffffffff
je case.default.0x44eb75
mov eax, 0x10
pop edi
sub eax, ecx
mov dword [ebx], eax
xor eax, eax
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x38]
test eax, eax
je 0x44eb83
mov ebx, dword [ebp + 0x10]
mov dword [ebx], 0x10
cmp eax, 0x10
jne 0x44eba1
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x28]
push edi
mov dword [edi], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 4], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x3c]
push eax
call fcn.0044f400
mov eax, dword [esi + 0x18]
xor dword [edi], eax
mov eax, dword [esi + 0x1c]
xor dword [edi + 4], eax
mov eax, dword [esi + 0x20]
xor dword [edi + 8], eax
mov eax, dword [esi + 0x24]
xor dword [edi + 0xc], eax
mov eax, dword [esi + 0x28]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x34]
mov dword [esi + 0x24], eax
jmp 0x44ebcf
mov ebx, dword [esi + 0x38]
lea edi, [esi + 0x18]
mov eax, dword [ebp + 0x10]
add esi, 0x3c
push edi
push esi
mov dword [eax], ebx
call fcn.00450930
add esp, 8
test ebx, ebx
je 0x44ecb4
mov ecx, dword [ebp + 0xc]
mov edx, ebx
nop dword [eax]
mov al, byte [edi + 0x10]
lea edi, [edi + 1]
xor al, byte [edi - 1]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x44eca0
mov eax, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ebx
xor eax, eax
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 0x10]
lea edi, [esi + 0x18]
mov eax, dword [esi + 0x38]
mov dword [ebp + 8], eax
push edi
mov dword [ebx], eax
lea eax, [esi + 0x3c]
push eax
call fcn.00450930
mov eax, dword [esi + 0x28]
xor dword [edi], eax
mov eax, dword [esi + 0x2c]
xor dword [esi + 0x1c], eax
mov eax, dword [esi + 0x30]
xor dword [esi + 0x20], eax
mov eax, dword [esi + 0x34]
xor dword [esi + 0x24], eax
mov esi, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
call fcn.004a4500
add esp, 0x14
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 0x1001
pop ebx
pop ebp
ret
Function at 0x450260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
dec eax
cmp eax, 3
ja case.default.0x450275
jmp dword [eax*4 + 0x450404]
push dword [esi + 4]
lea edi, [esi + 0x28]
push 0x10
push dword [esi + 0x38]
push edi
call fcn.004519c0
add esp, 0x10
cmp eax, 0x10
ja 0x4503ff
test eax, eax
jne 0x4502ad
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi]
push ecx
mov dword [ecx], eax
mov eax, dword [esi + 0x2c]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x30]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x34]
add esi, 0x3c
push esi
mov dword [ecx + 0xc], eax
call fcn.00450930
mov eax, dword [ebp + 0x10]
add esp, 8
pop edi
pop esi
mov dword [eax], 0x10
xor eax, eax
pop ebx
pop ebp
ret
push dword [esi + 4]
lea edi, [esi + 0x28]
push 0x10
push dword [esi + 0x38]
push edi
call fcn.004519c0
add esp, 0x10
cmp eax, 0x10
ja 0x4503ff
test eax, eax
jne 0x450314
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
pop ebp
ret
mov eax, dword [edi]
xor eax, dword [esi + 0x18]
mov edi, dword [ebp + 0xc]
push edi
mov dword [edi], eax
mov eax, dword [esi + 0x2c]
xor eax, dword [esi + 0x1c]
mov dword [edi + 4], eax
mov eax, dword [esi + 0x30]
xor eax, dword [esi + 0x20]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x34]
xor eax, dword [esi + 0x24]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x3c]
push eax
call fcn.00450930
mov eax, dword [edi]
add esp, 8
mov dword [esi + 0x18], eax
mov eax, dword [edi + 4]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0x10
xor eax, eax
pop ebp
ret
mov ebx, dword [esi + 0x38]
lea edi, [esi + 0x18]
mov eax, dword [ebp + 0x10]
add esi, 0x3c
push edi
push esi
mov dword [eax], 0x10
call fcn.00450930
add esp, 8
test ebx, ebx
je 0x4503a6
mov ecx, dword [ebp + 0xc]
mov edx, ebx
mov al, byte [edi + 0x10]
lea edi, [edi + 1]
xor al, byte [edi - 1]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x450392
mov eax, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ebx
xor eax, eax
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 0x10]
lea edi, [esi + 0x18]
mov eax, dword [esi + 0x38]
mov dword [ebp + 8], eax
push edi
mov dword [ebx], eax
lea eax, [esi + 0x3c]
push eax
call fcn.00450930
mov eax, dword [esi + 0x28]
xor dword [edi], eax
mov eax, dword [esi + 0x2c]
xor dword [esi + 0x1c], eax
mov eax, dword [esi + 0x30]
xor dword [esi + 0x20], eax
mov eax, dword [esi + 0x34]
xor dword [esi + 0x24], eax
mov esi, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
call fcn.004a4500
add esp, 0x14
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, 0x1001
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x452a70
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov byte [0x50101f], 0
mov dl, 1
push ebx
push esi
push edi
xor ebx, ebx
movzx eax, dl
mov cl, dl
sar cl, 7
and cl, 0x1b
mov byte [ebx + 0x501118], dl
mov byte [eax + 0x501018], bl
mov al, dl
add al, al
inc ebx
xor cl, al
xor dl, cl
cmp ebx, 0x100
jb 0x452a84
mov byte [0x501019], 0
mov cl, 1
xor edx, edx
nop word [eax + eax]
movzx eax, cl
mov dword [edx + 0x501418], eax
mov al, cl
sar al, 7
add cl, cl
and al, 0x1b
add edx, 4
xor cl, al
cmp edx, 0x28
jb 0x452ac0
xor ebx, ebx
nop
test ebx, ebx
je 0x452af6
movzx eax, byte [ebx + 0x501018]
mov ecx, 0x501217
sub ecx, eax
mov dl, byte [ecx]
jmp 0x452af8
xor dl, dl
mov cl, dl
rol cl, 1
xor dl, cl
rol cl, 1
xor dl, cl
rol cl, 1
mov al, cl
rol al, 1
xor al, cl
xor al, dl
xor al, 0x63
mov byte [ebx + 0x501218], al
movzx eax, al
mov byte [eax + 0x501318], bl
inc ebx
cmp ebx, 0x100
jb 0x452ae0
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 8], ebx
mov cl, byte [esi + 0x501218]
movzx edi, cl
mov eax, edi
mov dword [esi*4 + 0x503440], edi
rol eax, 8
mov dword [esi*4 + 0x503840], eax
mov eax, edi
rol eax, 0x10
mov dword [esi*4 + 0x503c40], eax
mov eax, edi
rol eax, 0x18
mov dword [esi*4 + 0x504040], eax
test cl, cl
je 0x452b9e
movzx ecx, byte [edi + 0x501018]
xor edx, edx
movzx eax, byte [0x50101a]
add eax, ecx
div ebx
movzx eax, byte [0x50101b]
add eax, ecx
mov ecx, 0xff
movzx ebx, byte [edx + 0x501118]
xor edx, edx
div ecx
movzx ecx, byte [edx + 0x501118]
jmp 0x452ba2
xor ebx, ebx
xor ecx, ecx
shl ecx, 8
or ecx, edi
shl ecx, 8
or ecx, edi
shl ecx, 8
or ecx, ebx
mov eax, ecx
mov dword [esi*4 + 0x501440], ecx
rol eax, 8
mov dword [esi*4 + 0x501840], eax
mov eax, ecx
rol eax, 0x10
rol ecx, 0x18
mov dword [esi*4 + 0x501c40], eax
mov dword [esi*4 + 0x502040], ecx
mov cl, byte [esi + 0x501318]
movzx edx, cl
mov eax, edx
mov dword [esi*4 + 0x504440], edx
rol eax, 8
mov dword [esi*4 + 0x504840], eax
mov eax, edx
rol eax, 0x10
mov dword [esi*4 + 0x504c40], eax
mov eax, edx
rol eax, 0x18
mov dword [esi*4 + 0x505040], eax
test cl, cl
je 0x452c83
mov bl, byte [edx + 0x501018]
xor edx, edx
movzx ecx, byte [0x501026]
movzx eax, bl
add eax, ecx
mov ecx, 0xff
div ecx
movzx eax, byte [0x501021]
movzx ecx, bl
mov ebx, 0xff
add eax, ecx
movzx edi, byte [edx + 0x501118]
xor edx, edx
div ebx
movzx eax, byte [0x501025]
add eax, ecx
movzx ebx, byte [edx + 0x501118]
xor edx, edx
div dword [ebp - 8]
movzx eax, byte [edx + 0x501118]
xor edx, edx
mov dword [ebp - 4], eax
movzx eax, byte [0x501023]
add eax, ecx
mov ecx, 0xff
div ecx
movzx eax, byte [edx + 0x501118]
jmp 0x452c8c
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ebx
xor eax, eax
shl eax, 8
or eax, dword [ebp - 4]
shl eax, 8
or eax, ebx
mov ebx, 0xff
shl eax, 8
or eax, edi
mov ecx, eax
mov dword [esi*4 + 0x502440], eax
rol ecx, 8
mov dword [esi*4 + 0x502840], ecx
mov ecx, eax
rol ecx, 0x10
rol eax, 0x18
mov dword [esi*4 + 0x502c40], ecx
mov dword [esi*4 + 0x503040], eax
inc esi
cmp esi, 0x100
jb 0x452b30
pop edi
pop esi
mov dword [0x505440], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453c67
Capabilities:
Move file

Disassembly:
push 0x3c
mov eax, 0x4cb873
call fcn.0044c2a5
mov esi, dword [ebp + 0xc]
xor eax, eax
mov edi, dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], eax
mov eax, esi
cmp dword [esi + 0x14], 7
jbe 0x453c8d
mov eax, dword [esi]
cmp dword [edi + 0x14], 7
mov ecx, edi
jbe 0x453c97
mov ecx, dword [edi]
push 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x453ced
cmp dword [esi + 0x14], 7
jbe 0x453cad
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x40]
call fcn.004035e0
and dword [ebp - 4], 0
xor ebx, ebx
inc ebx
cmp dword [edi + 0x14], 7
mov dword [ebp - 0x44], ebx
jbe 0x453cc8
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x28]
call fcn.004035e0
push 3
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x40]
pop ebx
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x44], ebx
push eax
call fcn.00453c67
pop ecx
pop ecx
test al, al
je 0x453cf1
mov byte [ebp - 0x48], 1
test bl, 2
je 0x453d01
lea ecx, [ebp - 0x28]
and ebx, 0xfffffffd
call fcn.0045359b
test bl, 1
je 0x453d0e
lea ecx, [ebp - 0x40]
call fcn.0045359b
mov al, byte [ebp - 0x48]
call fcn.0044c24f
ret

Function at 0x4540c9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 7
jbe 0x4540d7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x4540e6
Capabilities:
Copy file
Delete file

Disassembly:
push 0x3c
mov eax, 0x4cb94c
call fcn.0044c2a5
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x454195
cmp dword [esi + 0x10], 0x104
ja 0x454195
push esi
call fcn.004540c9
pop ecx
test al, al
jne 0x45411b
inc al
jmp 0x454197
push esi
lea ecx, [ebp - 0x28]
call fcn.00403630
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
xor esi, esi
add eax, 2
push esi
push eax
mov dword [ebp - 4], esi
call fcn.0044b5a7
push 0x1e
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.004a4a80
mov eax, dword [ebp - 0x38]
add esp, 0xc
and eax, 0xffbf
mov dword [ebp - 0x32], esi
or eax, 0x414
mov dword [ebp - 0x48], esi
cmp dword [ebp - 0x14], 7
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x2e], esi
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
lea ecx, [ebp - 0x28]
sete bl
call fcn.0045359b
mov al, bl
jmp 0x454197
xor al, al
call fcn.0044c24f
ret
Function at 0x455200
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x98], 5
jne 0x455227
cmp dword [ebp + 0xc], 0
je 0x455227
mov ecx, esi
call fcn.00455092
mov eax, 0x80004005
jmp 0x455339
xor ecx, ecx
push edi
cmp dword [esi + 0x54], ecx
jne 0x455256
push 0x4d3264
call fcn.004554ae
pop ecx
mov ecx, dword [esi + 0x9c]
test ecx, ecx
je 0x455336
mov edx, dword [ecx]
lea eax, [esi + 0x14]
push eax
call dword [edx + 0x14]
jmp 0x455336
cmp byte [esi + 0x64], cl
jne 0x455265
cmp byte [esi + 0x70], cl
jne 0x455265
cmp byte [esi + 0x7c], cl
je 0x4552c3
lea eax, [esi + 0x44]
cmp dword [eax + 0x14], 7
jbe 0x455270
mov eax, dword [eax]
push ecx
push 0x80
push 3
push ecx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4552c3
xor edx, edx
lea ecx, [esi + 0x68]
cmp byte [esi + 0x64], dl
cmovne edx, ecx
xor eax, eax
cmp byte [esi + 0x70], al
lea ecx, [esi + 0x74]
push edx
cmovne eax, ecx
xor ecx, ecx
cmp byte [esi + 0x7c], cl
push eax
lea eax, [esi + 0x80]
cmovne ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0x5d], 0
lea edi, [esi + 0x44]
je 0x4552e0
cmp dword [edi + 0x14], 7
mov eax, edi
jbe 0x4552d6
mov eax, dword [edi]
push dword [esi + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [edi + 0x14], 7
mov eax, edi
jbe 0x4552ea
mov eax, dword [edi]
push eax
push str.FileDone:_s_n
call fcn.004554ae
pop ecx
pop ecx
mov ecx, dword [esi + 0x9c]
test ecx, ecx
je 0x455336
push dword [esi + 0x94]
mov eax, dword [ecx]
push dword [esi + 0x90]
push edi
call dword [eax + 0x1c]
test al, al
jne 0x45531e
mov eax, 0x80004005
jmp 0x455338
mov ecx, dword [esi + 0x9c]
push dword [esi + 0x94]
push dword [esi + 0x90]
mov eax, dword [ecx]
push edi
call dword [eax + 0x10]
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x458c0a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x50546f], 0
jne 0x458ce2
push 0x4d3300
call fcn.00460068
mov dword [esp], 0x4d35b0
call fcn.00460068
mov dword [esp], 0x4d3360
call fcn.00460068
mov dword [esp], 0x4d3384
call fcn.00460068
mov dword [esp], 0x4d333c
call fcn.00460068
mov dword [esp], 0x4d34d8
call fcn.00469106
mov dword [esp], 0x4d3458
call fcn.00469106
mov dword [esp], 0x4d3478
call fcn.00469106
mov dword [esp], 0x4d3498
call fcn.00469106
mov dword [esp], 0x4d34f8
call fcn.00469106
mov dword [esp], 0x4d3518
call fcn.00469106
mov dword [esp], 0x4d3538
call fcn.00469106
mov dword [esp], 0x4d3418
call fcn.00469106
mov dword [esp], 0x4d3438
call fcn.00469106
mov dword [esp], 0x4d3558
call fcn.00469106
mov dword [esp], 0x4d3578
call fcn.00469106
pop ecx
mov byte [0x50546f], 1
jmp 0x46b370
ret
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x5099e0], ecx
inc eax
cmp eax, 0x100
jb 0x46b372
cmp eax, 0x800
jae 0x46b443
nop word [eax + eax]
mov edx, dword [eax*4 + 0x5095e0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x5099e0]
mov dword [eax*4 + 0x5099e0], edx
inc eax
cmp eax, 0x800
jb 0x46b420
mov dword [0x50b9e8], 0x4c6210
mov dword [0x50b9e0], 0x4c6210
mov dword [0x50b9e4], 0x4c6130
call fcn.0047c009
test eax, eax
jne 0x46b474
mov dword [0x50b9e0], 0x4c6130
ret