joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3e91409
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0xc3d2e1f0
pop ebp
ret

Function at 0x3e91980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
push 0x104
push dword [ebp + 8]
mov edx, dword [ebp + 8]
add edx, 0x104
push edx
call fcn.03e91094
add esp, 0xc
cmp dword [ebp - 4], 0x104
jae 0x3e919d4
mov ecx, 0x104
sub ecx, dword [ebp - 4]
push ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push eax
mov edx, dword [ebp + 8]
call dword [edx + 0x20c]
add esp, 8
add dword [ebp - 4], eax
cmp dword [ebp - 4], 0x104
jb 0x3e919ac
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov cl, byte [edx + eax + 0x104]
not cl
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
xor byte [edx + eax], cl
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x104
jb 0x3e919d9
push dword [ebp + 8]
call fcn.03e918cc
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0x104
push ecx
call fcn.03e918cc
pop ecx
pop ecx
pop ebp
ret

Function at 0x3e92eba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x3e92f68
mov edx, dword [ebp + 0x10]
cmp dword [edx + 0x9c], 0x40
jbe 0x3e92ef9
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0x10]
call fcn.03e914e9
add esp, 8
mov eax, dword [ebp + 0x10]
mov dword [eax + 0x9c], 0x14
mov edx, 0x40
mov ecx, dword [ebp + 0x10]
sub edx, dword [ecx + 0x9c]
push edx
push 0
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x10]
add eax, dword [edx + 0x9c]
push eax
call fcn.03e91080
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
xor dword [edx + eax*4], 0x36363636
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x3e92f24
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
call fcn.03e91409
pop ecx
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
push 0x40
push dword [ebp + 0x10]
call fcn.03e9144d
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov dword [edx + 0x9c], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x3e92f83
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.03e9144d
add esp, 0xc
pop ecx
pop ebp
ret
Function at 0x3e92f86
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x3e92fa7
push dword [ebp + 0x10]
push 0
push 0
call fcn.03e92eba
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.03e914e9
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
xor dword [ecx + edx*4], 0x6a6a6a6a
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x3e92fbf
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
call fcn.03e91409
pop ecx
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
push 0x40
push dword [ebp + 0x10]
call fcn.03e9144d
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push 0x14
lea eax, [ebp - 0x18]
push eax
call fcn.03e9144d
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.03e914e9
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jae 0x3e93046
mov ecx, dword [ebp - 4]
mov al, byte [ebp + ecx - 0x18]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov byte [edx + ecx], al
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jb 0x3e9302b
mov esp, ebp
pop ebp
ret
Function at 0x3e944ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
lea eax, [ebp - 0xd8]
push eax
call fcn.03e92e08
pop ecx
lea edx, [ebp - 0xd8]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.03e92e1f
add esp, 0xc
push 0xa0
lea ecx, [ebp - 0xd8]
push ecx
lea eax, [ebp - 0x178]
push eax
call fcn.03e91094
add esp, 0xc
lea edx, [ebp - 0x178]
push edx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.03e92eba
add esp, 0xc
mov eax, dword [ebp + 0x20]
dec eax
mov ecx, 0x14
xor edx, edx
div ecx
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x3e94680
push 0x14
push 0
lea ecx, [ebp - 0x38]
push ecx
call fcn.03e91080
add esp, 0xc
push 0xa0
lea eax, [ebp - 0x178]
push eax
lea edx, [ebp - 0x218]
push edx
call fcn.03e91094
add esp, 0xc
mov ecx, dword [ebp - 4]
inc ecx
shr ecx, 0x18
mov byte [ebp - 0x24], cl
mov eax, dword [ebp - 4]
inc eax
shr eax, 0x10
mov byte [ebp - 0x23], al
mov edx, dword [ebp - 4]
inc edx
shr edx, 8
mov byte [ebp - 0x22], dl
mov cl, byte [ebp - 4]
inc ecx
mov byte [ebp - 0x21], cl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x18]
jae 0x3e9463a
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp - 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.03e92eba
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x14
lea ecx, [ebp - 0x24]
push ecx
call fcn.03e92f86
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp + edx - 0x24]
mov eax, dword [ebp - 0xc]
xor byte [ebp + eax - 0x38], cl
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x14
jb 0x3e945fd
push 0xa0
lea edx, [ebp - 0xd8]
push edx
lea ecx, [ebp - 0x218]
push ecx
call fcn.03e91094
add esp, 0xc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x18]
jb 0x3e945cd
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 4]
shl ecx, 2
lea ecx, [ecx + ecx*4]
mov dword [ebp - 0xc], ecx
jmp 0x3e94663
mov eax, dword [ebp - 8]
mov dl, byte [ebp + eax - 0x38]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
mov byte [ecx + eax], dl
inc dword [ebp - 8]
inc dword [ebp - 0xc]
cmp dword [ebp - 8], 0x14
jae 0x3e94671
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0x20]
jb 0x3e9464d
inc dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x3e94569
mov esp, ebp
pop ebp
ret

Function at 0x3e9c5e0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x180]
mov edx, ebx
mov eax, edi
call fcn.03e9c848
mov esi, eax
mov dword [edi + 0x180], esi
and esi, 0xff
add dword [edi + 0x184], esi
imul esi, dword [edi + 0x184], 0x8088405
inc esi
mov dword [edi + 0x184], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x188]
mov eax, edi
call fcn.03e9c848
mov dword [edi + 0x188], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x3e9c65c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [esi + 0x120]
cmp byte [eax + 0x4c], 0
jne 0x3e9c693
mov edi, ecx
dec edi
test edi, edi
jl 0x3e9c6a4
inc edi
mov eax, esi
call fcn.03e9c63c
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, esi
call fcn.03e9c5e0
inc ebx
dec edi
jne 0x3e9c67a
jmp 0x3e9c6a4
lea eax, [esi + 0x3cc]
push eax
push ecx
push ebx
call fcn.03e9187c
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x3e9c73c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.03cb7f44
xor eax, eax
push ebp
push 0x3e9c7b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.03e9c6ac
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.03e9c63c
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.03e9c5e0
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x3e9c77c
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e9c7b9
lea eax, [ebp - 4]
call fcn.03cb7e74
ret
Function at 0x3e9d708
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x3e9d8f3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp esi, 0xffffffff
jle 0x3e9d8af
mov eax, dword [ebp - 4]
call fcn.03e9f0fc
cmp esi, eax
jge 0x3e9d8af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x128]
mov edx, esi
call fcn.03e8085c
mov edx, dword [0x3e81540]
call fcn.03cb6350
mov edi, eax
mov eax, edi
call fcn.03e849f0
test al, al
je 0x3e9d8a5
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov eax, dword [edi + 0x50]
test eax, eax
je 0x3e9d78b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x3e9d898
xor eax, eax
push ebp
push 0x3e9d891
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.03e9dd38
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x140]
call fcn.03d4eaa4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push dword [edi + 0x34]
push dword [edi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x140]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x20]
lea edx, [ebp - 0x3e]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x140]
mov ecx, 0x2e
mov ebx, dword [eax]
call dword [ebx + 0xc]
movzx eax, word [ebp - 0x22]
movzx edx, word [ebp - 0x20]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x140]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x20]
movzx ebx, word [ebp - 0x1e]
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, ebx
call fcn.03cb894c
mov eax, dword [ebp - 8]
call fcn.03cb8410
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x140]
mov ecx, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x168]
movzx ebx, byte [eax + 0x28]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.03e9da7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x168]
mov byte [eax + 0x28], bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e9d8dd
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x140]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
jne 0x3e9d890
mov eax, dword [ebp - 4]
call fcn.03e9ddc0
ret
mov eax, dword [ebp - 8]
mov edx, dword [edi + 0x50]
call fcn.03cb82cc
jmp 0x3e9d8dd
mov eax, dword [ebp - 8]
call fcn.03cb7e74
jmp 0x3e9d8dd
mov dword [ebp - 0x48], esi
mov byte [ebp - 0x44], 0
lea eax, [ebp - 0x48]
push eax
push 0
lea edx, [ebp - 0x4c]
mov eax, 0xb3
call fcn.03cd29fc
mov ecx, dword [ebp - 0x4c]
mov dl, 1
mov eax, dword [0x3ccbde0]
call fcn.03cd8bb0
call fcn.03cb73d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e9d8fa
lea eax, [ebp - 0x4c]
call fcn.03cb7e50
ret
Function at 0x3ea633c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
mov ebx, eax
call fcn.03ea61d8
test al, al
je 0x3ea6369
lea edx, [ebp - 0x3c]
mov eax, ebx
call fcn.03ea62dc
test al, al
jne 0x3ea6361
call fcn.03cda9e0
mov eax, dword [ebp - 0x38]
imul dword [ebp - 0x34]
jmp 0x3ea6395
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.03cb8d98
push eax
call sub.kernel32.dll_GetDiskFreeSpaceW
test eax, eax
jne 0x3ea638f
call fcn.03cda9e0
mov eax, dword [ebp - 4]
imul dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3eadf44
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
push esi
mov ebx, edx
mov esi, eax
cmp dword [esi + 0x5d8], 0
je 0x3eadf6b
mov eax, dword [esi + 0x5d8]
call fcn.03e7df8c
test al, al
jne 0x3eadf90
lea eax, [ebp - 0x25a]
push eax
push 0x12d
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
lea edx, [ebp - 0x25a]
mov ecx, 0x12d
call fcn.03cb8e3c
jmp 0x3eadf9d
mov eax, ebx
mov edx, dword [esi + 0x5d8]
call fcn.03cb8230
mov eax, dword [ebx]
test eax, eax
je 0x3eadfa8
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x3eadfbe
mov eax, ebx
mov edx, 0x3eadfd0
call fcn.03cb8f94
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3eae0ec
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
mov eax, dword [ebp - 8]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3eae1ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x3eae208
call fcn.03cb936c
test eax, eax
jle 0x3eae140
push 0x20
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
call sub.kernel32.dll_SetFileAttributesW
jmp 0x3eae166
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x3eae218
call fcn.03cb936c
test eax, eax
jle 0x3eae166
push 0x10
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.03cb8d98
mov esi, eax
push esi
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x3eae228
call fcn.03cb936c
test eax, eax
jle 0x3eae191
or ebx, 2
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x3eae238
call fcn.03cb936c
test eax, eax
jle 0x3eae1aa
or ebx, 1
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x3eae248
call fcn.03cb936c
test eax, eax
jle 0x3eae1c3
or ebx, 4
push ebx
push esi
call sub.kernel32.dll_SetFileAttributesW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3eae1f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.03cb7eb0
ret
Function at 0x3eae2d0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_GetDiskFreeSpaceW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
mov eax, dword [ebp - 4]
imul dword [ebp - 8]
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.03cb9d04
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.03cb9d04
mov dword [edi], eax
mov dword [edi + 4], edx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3eae344
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x434], edx
mov dword [ebp - 0x438], edx
mov dword [ebp - 0x43c], edx
mov dword [ebp - 0x440], edx
mov dword [ebp - 0x444], edx
mov dword [ebp - 0x448], edx
mov dword [ebp - 0x430], edx
mov esi, eax
xor eax, eax
push ebp
push 0x3eae531
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x200
call fcn.03cb504c
mov edi, eax
mov ebx, edi
push ebx
push 0x200
call sub.kernel32.dll_GetLogicalDriveStringsW
jmp 0x3eae502
lea eax, [ebp - 0x222]
xor ecx, ecx
mov edx, 0x20a
call fcn.03cb5b68
lea eax, [ebp - 0x42c]
xor ecx, ecx
mov edx, 0x20a
call fcn.03cb5b68
push 0x20a
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x20a
lea eax, [ebp - 0x222]
push eax
push ebx
call sub.kernel32.dll_GetVolumeInformationW
lea eax, [ebp - 0x430]
lea edx, [ebp - 0x222]
mov ecx, 0x105
call fcn.03cb8e3c
cmp dword [ebp - 0x430], 0
jne 0x3eae42d
push esi
push edi
mov esi, 0x3eae540
lea edi, [ebp - 0x222]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
lea ecx, [ebp - 0x10]
lea edx, [ebp - 8]
mov eax, ebx
call fcn.03eae2d0
push dword [esi]
lea eax, [ebp - 0x434]
mov edx, ebx
call fcn.03cb8e00
push dword [ebp - 0x434]
push 0x3eae758
push ebx
call sub.kernel32.dll_GetDriveTypeW
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x438]
call fcn.03cd23bc
push dword [ebp - 0x438]
push 0x3eae768
lea eax, [ebp - 0x43c]
lea edx, [ebp - 0x222]
mov ecx, 0x105
call fcn.03cb8e3c
push dword [ebp - 0x43c]
push 0x3eae778
lea eax, [ebp - 0x440]
lea edx, [ebp - 0x42c]
mov ecx, 0x105
call fcn.03cb8e3c
push dword [ebp - 0x440]
push 0x3eae788
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x444]
call fcn.03cd23bc
push dword [ebp - 0x444]
push 0x3eae798
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x448]
call fcn.03cd23bc
push dword [ebp - 0x448]
push 0x3eae7a8
push 0x3eae7b8
mov eax, esi
mov edx, 0xe
call fcn.03cb9074
add ebx, 8
cmp word [ebx], 0
jne 0x3eae3aa
mov eax, edi
call fcn.03cb5068
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3eae538
lea eax, [ebp - 0x448]
mov edx, 7
call fcn.03cb7eb0
ret
Function at 0x3eae7c0
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x3eae7c9
mov eax, dword [ebp - 4]
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x4038], ecx
mov dword [ebp - 0x4034], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x3eae8fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.03cb7e50
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0
push 2
call sub.mpr.dll_WNetOpenEnumW
test eax, eax
jne 0x3eae8dc
xor eax, eax
push ebp
push 0x3eae8d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0x4020
jmp 0x3eae89e
mov esi, dword [ebp - 8]
dec esi
test esi, esi
jl 0x3eae89e
inc esi
lea ebx, [ebp - 0x402c]
cmp dword [ebx], 1
jne 0x3eae874
push dword [edi]
lea eax, [ebp - 0x4034]
mov edx, dword [ebx + 0x10]
call fcn.03cb8e00
push dword [ebp - 0x4034]
push 0x3eae914
mov eax, edi
mov edx, 3
call fcn.03cb9074
test dword [ebx + 8], 2
jbe 0x3eae898
lea edx, [ebp - 0x4038]
lea eax, [ebx - 4]
call fcn.03eae7c0
mov edx, dword [ebp - 0x4038]
mov eax, edi
call fcn.03cb8f94
add ebx, 0x20
dec esi
jne 0x3eae848
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x4030]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceW
test eax, eax
je 0x3eae839
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3eae8dc
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetCloseEnum
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3eae901
lea eax, [ebp - 0x4038]
mov edx, 2
call fcn.03cb7eb0
ret
Function at 0x3eae92c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3eaea66
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x3eaea45
mov dl, 1
mov eax, dword [0x3d2d3f4]
call fcn.03cb60c0
mov ebx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x3eae980
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp word [edx + eax*2 - 2], 0x5c
je 0x3eae998
lea eax, [ebp - 4]
mov edx, 0x3eaea80
call fcn.03cb8f94
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x3eaea90
mov edx, dword [ebp - 4]
call fcn.03cb8fec
mov eax, dword [ebp - 0x25c]
call fcn.03cb8d98
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov esi, eax
cmp esi, 0xffffffff
je 0x3eaea45
lea edx, [ebp - 0x258]
mov ecx, 0x250
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x10]
jmp 0x3eae9f0
lea edx, [ebp - 0x258]
mov ecx, 0x250
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x10]
lea eax, [ebp - 0x258]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x3eae9de
push esi
call sub.kernel32.dll_FindClose_1
push 0
push 0
mov eax, ebx
call fcn.03d4eacc
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.03cb8f14
mov eax, dword [ebp - 8]
mov eax, dword [eax]
test eax, eax
je 0x3eaea30
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, eax
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.03cb60f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3eaea6d
lea eax, [ebp - 0x25c]
call fcn.03cb7e50
lea eax, [ebp - 4]
call fcn.03cb7e50
ret
Function at 0x3eaee00
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd74
push ebx
xor ecx, ecx
mov dword [ebp - 0x288], ecx
mov dword [ebp - 0x28c], ecx
mov dword [ebp - 0x280], ecx
mov dword [ebp - 0x284], ecx
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
mov eax, dword [ebp - 8]
call fcn.03cb7f34
lea eax, [ebp - 0x278]
mov edx, dword [0x3ccae10]
call fcn.03cb969c
xor eax, eax
push ebp
push 0x3eaefd5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.03cd3148
lea eax, [ebp - 0x27c]
mov ecx, 0x3eaeff0
mov edx, dword [ebp - 4]
call fcn.03cb8fec
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.03cd3550
test eax, eax
jne 0x3eaef8c
mov eax, dword [ebp - 0x264]
mov edx, 0x3eaf008
call fcn.03cb9124
je 0x3eaef79
mov eax, dword [ebp - 0x264]
mov edx, 0x3eaf018
call fcn.03cb9124
je 0x3eaef79
test byte [ebp - 0x268], 0x10
je 0x3eaef1e
push dword [ebp - 8]
push 0x3eaf02c
push dword [ebp - 0x264]
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.03cb9074
mov eax, dword [ebp - 0x280]
push eax
push dword [ebp - 4]
push 0x3eaf03c
push dword [ebp - 0x264]
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.03cb9074
mov eax, dword [ebp - 0x284]
pop edx
call fcn.03eaee00
jmp 0x3eaef79
push 0
push dword [ebp - 8]
push 0x3eaf04c
push dword [ebp - 0x264]
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.03cb9074
mov eax, dword [ebp - 0x288]
call fcn.03cb8d98
push eax
push dword [ebp - 4]
push 0x3eaf05c
push dword [ebp - 0x264]
lea eax, [ebp - 0x28c]
mov edx, 3
call fcn.03cb9074
mov eax, dword [ebp - 0x28c]
call fcn.03cb8d98
push eax
call sub.kernel32.dll_CopyFileW
lea eax, [ebp - 0x278]
call fcn.03cd35a0
test eax, eax
je 0x3eaee98
lea eax, [ebp - 0x278]
call fcn.03cd35c4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3eaefdc
lea eax, [ebp - 0x28c]
mov edx, 5
call fcn.03cb7eb0
lea eax, [ebp - 0x278]
mov edx, dword [0x3ccae10]
call fcn.03cb9774
lea eax, [ebp - 8]
mov edx, 2
call fcn.03cb7eb0
ret

Function at 0x3eaf1ec
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
mov eax, dword [ebp - 8]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3eaf260
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.03cb9124
jne 0x3eaf228
xor ebx, ebx
jmp 0x3eaf245
mov eax, dword [ebp - 8]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3eaf267
lea eax, [ebp - 8]
mov edx, 2
call fcn.03cb7eb0
ret