joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404160
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x4041ab
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x40419b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x404181
jmp 0x4041a0
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x4041fb
mov edi, edx
lea ecx, [edi + 2]
jmp 0x4041c0
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4041c0
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x4041dc
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00401760
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x40421d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x404290
mov esi, dword [ebx]
cmp esi, ebx
je 0x404290
test esi, esi
je 0x404290
cmp word [esi + 0x24], 2
jbe 0x40428a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x40428a
cmp dword [esi + 0x18], 0
je 0x40428a
test ebp, ebp
je 0x404245
cmp ebp, eax
jne 0x40428a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00401760
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40426a
cmp eax, dword [esi + 0x18]
jne 0x40428a
cmp dword [esp + 0x10], 0
je 0x40429d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00402370
add esp, 8
test eax, eax
je 0x40429d
mov esi, dword [esi]
cmp esi, ebx
jne 0x404223
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret

Function at 0x41c3c2
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x401850
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, eax
push edi
call fcn.00462de2
mov ecx, dword [ebp + 8]
add esp, 4
push 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push edi
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4018a7
mov eax, dword [ebp - 4]
cmp eax, edi
jne 0x4018a7
push 0
lea edx, [ebp - 8]
push edx
push eax
mov eax, dword [ebp + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call fcn.0046299d
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
xor edi, edi
call fcn.0046299d
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401fe0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402015
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
lea ecx, [ebp - 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x402032
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x402048
push 0
lea edx, [ebp - 8]
push edx
add edi, 0xfffffffc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x402057
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea ecx, [ebp - 4]
push ecx
push esi
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
je 0x402049
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419cd0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479a41
mov eax, dword fs:[0]
push eax
sub esp, 0x1ac
mov eax, dword [0x51384c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x130]
call fcn.004080e0
lea ecx, [ebp - 0x1b8]
mov dword [ebp - 4], 0
call fcn.004080e0
push esi
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 1
call fcn.00409340
push edi
lea ecx, [ebp - 0x1b8]
call fcn.00409340
push 0x5c
push 0x2f
lea ecx, [ebp - 0x130]
call fcn.00408f30
push 0x5c
push 0x2f
lea ecx, [ebp - 0x1b8]
call fcn.00408f30
lea ecx, [ebp - 0xa8]
call fcn.00422e00
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 2
call fcn.00422e30
test al, al
je 0x419da2
xor eax, eax
cmp byte [ebp + 0x10], al
lea ecx, [ebp - 0x1b8]
setne al
push eax
call fcn.004088f0
push eax
lea ecx, [ebp - 0x130]
call fcn.004088f0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x419dc9
xor ecx, ecx
cmp byte [ebp + 0x10], cl
setne cl
push ecx
lea ecx, [ebp - 0x1b8]
call fcn.004091a0
push eax
lea ecx, [ebp - 0x130]
call fcn.004091a0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea ecx, [ebp - 0xa8]
setne bl
mov byte [ebp - 4], 1
call fcn.00422e20
lea ecx, [ebp - 0x1b8]
mov byte [ebp - 4], 0
call fcn.00408190
lea ecx, [ebp - 0x130]
mov dword [ebp - 4], 0xffffffff
call fcn.00408190
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462848
mov esp, ebp
pop ebp
ret
Function at 0x419f00
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479a9c
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x51384c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x134]
call fcn.004080e0
push edi
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0
call fcn.00409340
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.00408f30
lea ecx, [ebp - 0xa8]
call fcn.00422e00
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 1
call fcn.00422e30
lea ecx, [ebp - 0x134]
test al, al
je 0x419f98
call fcn.004088f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jmp 0x41a0b0
call fcn.004090f0
cmp eax, 0x104
jle 0x41a050
lea ecx, [ebp - 0x244]
call fcn.004080e0
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x134]
push ecx
mov byte [ebp - 4], 2
call fcn.004199f0
add esp, 8
lea ecx, [ebp - 0x1bc]
call fcn.004080e0
push 0x4b391c
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 3
call fcn.00409270
lea ecx, [ebp - 0x244]
call fcn.00408b70
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00409270
lea ecx, [ebp - 0x1bc]
call fcn.004091a0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x41a02d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x41a02b
mov esi, 1
test esi, esi
lea ecx, [ebp - 0x1bc]
setne bl
mov byte [ebp - 4], 2
call fcn.00408190
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.00408190
jmp 0x41a0b3
lea ecx, [ebp - 0x134]
call fcn.004091a0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0xac], eax
test eax, eax
jne 0x41a0a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
je 0x41a09a
push edi
mov ecx, esi
call fcn.00420890
mov ebx, dword [esi]
lea ecx, [ebp - 0x134]
call fcn.00408b70
mov edx, dword [ebx + 0x28]
push eax
push str.failedToDeleteFilepath
mov ecx, esi
call edx
cmp edi, 2
jne 0x41a0a9
mov dword [ebp - 0xac], 1
cmp dword [ebp - 0xac], 0
setne bl
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0
call fcn.00422e20
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0xffffffff
call fcn.00408190
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462848
mov esp, ebp
pop ebp
ret
Function at 0x41abf0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479c06
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x51384c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xa8]
call fcn.00422e00
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0
call fcn.00422e30
test al, al
je 0x41ac53
mov eax, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne bl
jmp 0x41ac98
lea ecx, [ebp - 0x130]
call fcn.004080e0
push esi
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 1
call fcn.00408380
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x130]
call fcn.004091a0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
lea ecx, [ebp - 0x130]
setne bl
mov byte [ebp - 4], 0
call fcn.00408190
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00422e20
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462848
mov esp, ebp
pop ebp
ret

Function at 0x41acd0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479c46
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x51384c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xa8]
call fcn.00422e00
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0
call fcn.00422e30
test al, al
je 0x41ad2b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
jmp 0x41ad69
lea ecx, [ebp - 0x130]
call fcn.004080e0
push esi
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 1
call fcn.00408380
lea ecx, [ebp - 0x130]
call fcn.004091a0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x130]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.00408190
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00422e20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462848
mov esp, ebp
pop ebp
ret
Function at 0x41ae70
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479ca7
mov eax, dword fs:[0]
push eax
sub esp, 0x2c0
mov eax, dword [0x51384c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x134]
mov dword [ebp - 0xac], eax
call fcn.004080e0
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 4], 0
call fcn.004080e0
push esi
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 1
call fcn.00409340
push edi
lea ecx, [ebp - 0x1bc]
call fcn.00409340
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.00408f30
push 0x5c
push 0x2f
lea ecx, [ebp - 0x1bc]
call fcn.00408f30
lea ecx, [ebp - 0xa8]
call fcn.00422e00
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 2
call fcn.00422e30
test al, al
je 0x41af4a
lea ecx, [ebp - 0x1bc]
call fcn.004088f0
push eax
lea ecx, [ebp - 0x134]
call fcn.004088f0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne bl
jmp 0x41b018
lea ecx, [ebp - 0x134]
call fcn.004090f0
test eax, eax
jg 0x41af90
lea ecx, [ebp - 0x1bc]
call fcn.004090f0
test eax, eax
jg 0x41af90
lea ecx, [ebp - 0x1bc]
call fcn.004091a0
push eax
lea ecx, [ebp - 0x134]
call fcn.004091a0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
jmp 0x41b018
lea ecx, [ebp - 0x244]
call fcn.004080e0
lea ecx, [ebp - 0x2cc]
mov byte [ebp - 4], 3
call fcn.004080e0
lea ecx, [ebp - 0x244]
push ecx
lea edx, [ebp - 0x134]
push edx
mov byte [ebp - 4], 4
call fcn.00419e20
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
call fcn.00419e20
add esp, 0x10
lea ecx, [ebp - 0x2cc]
call fcn.004091a0
push eax
lea ecx, [ebp - 0x244]
call fcn.004091a0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
lea ecx, [ebp - 0x2cc]
setne bl
mov byte [ebp - 4], 3
call fcn.00408190
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 2
call fcn.00408190
test bl, bl
jne 0x41b02b
mov ecx, dword [ebp - 0xac]
test ecx, ecx
je 0x41b02b
call fcn.004207f0
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 1
call fcn.00422e20
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 0
call fcn.00408190
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0xffffffff
call fcn.00408190
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462848
mov esp, ebp
pop ebp
ret

Function at 0x41b080
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00419cd0

Function at 0x41b090
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00419f00
Function at 0x41b0a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479cf1
mov eax, dword fs:[0]
push eax
sub esp, 0x1b0
mov eax, dword [0x51384c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, edi
mov dword [ebp - 0xac], eax
mov dword [esi], 0xffffffff
call fcn.004090f0
test eax, eax
jne 0x41b110
test ebx, ebx
je 0x41b109
mov eax, dword [ebx]
mov edx, dword [eax + 0x10]
push str.GetAttributes:_filename_is_empty
mov ecx, ebx
call edx
xor al, al
jmp 0x41b236
lea ecx, [ebp - 0x134]
call fcn.004080e0
push edi
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0
call fcn.00409340
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.00408f30
lea ecx, [ebp - 0x134]
call fcn.004090f0
lea ecx, [ebp - 0xa8]
mov edi, eax
call fcn.00422e00
mov bl, 1
mov byte [ebp - 4], bl
cmp edi, 0x104
jge 0x41b199
lea ecx, [ebp - 0x134]
call fcn.004086d0
test al, al
jne 0x41b180
lea ecx, [ebp - 0xa8]
call fcn.00422e30
test al, al
je 0x41b199
lea ecx, [ebp - 0x134]
call fcn.004088f0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esi], eax
cmp eax, 0xffffffff
jmp 0x41b1fd
test edi, edi
jle 0x41b1e6
lea ecx, [ebp - 0x1bc]
call fcn.004080e0
lea edx, [ebp - 0x1bc]
push edx
lea eax, [ebp - 0x134]
push eax
mov byte [ebp - 4], 2
call fcn.00419e20
add esp, 8
lea ecx, [ebp - 0x1bc]
call fcn.00408560
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x1bc]
mov dword [esi], eax
mov byte [ebp - 4], bl
call fcn.00408190
jmp 0x41b1fa
lea ecx, [ebp - 0x134]
call fcn.00408560
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x41b20d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0xac]
mov dword [ecx], eax
cmp dword [esi], 0xffffffff
lea ecx, [ebp - 0xa8]
setne bl
mov byte [ebp - 4], 0
call fcn.00422e20
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0xffffffff
call fcn.00408190
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462848
mov esp, ebp
pop ebp
ret
Function at 0x41b260
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479d4c
mov eax, dword fs:[0]
push eax
sub esp, 0x1d4
mov eax, dword [0x51384c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x158]
call fcn.004080e0
push esi
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], 0
call fcn.00409340
push 0x5c
push 0x2f
lea ecx, [ebp - 0x158]
call fcn.00408f30
lea ecx, [ebp - 0xa8]
call fcn.00422e00
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 1
call fcn.00422e30
lea ecx, [ebp - 0x158]
test al, al
je 0x41b2f5
call fcn.004088f0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x41b35e
call fcn.004090f0
test eax, eax
jle 0x41b34a
lea ecx, [ebp - 0x1e0]
call fcn.004080e0
lea eax, [ebp - 0x1e0]
push eax
lea ecx, [ebp - 0x158]
push ecx
mov byte [ebp - 4], 2
call fcn.00419e20
add esp, 8
push 0
lea ecx, [ebp - 0x1e0]
call fcn.004091a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x1e0]
mov esi, eax
mov byte [ebp - 4], 1
call fcn.00408190
jmp 0x41b360
push 0
lea ecx, [ebp - 0x158]
call fcn.004091a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x41b3ad
test edi, edi
je 0x41b3ab
lea ecx, [ebp - 0xd0]
call fcn.004065a0
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 3
call fcn.00407f10
mov ebx, dword [edi]
lea ecx, [ebp - 0xd0]
call fcn.00405cc0
mov edx, dword [ebx + 0x28]
push eax
push str.errorMsg
mov ecx, edi
call edx
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 1
call fcn.004067c0
test esi, esi
lea ecx, [ebp - 0xa8]
setne bl
mov byte [ebp - 4], 0
call fcn.00422e20
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], 0xffffffff
call fcn.00408190
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462848
mov esp, ebp
pop ebp
ret
Function at 0x41bd60
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041ae70

Function at 0x41e880
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable.Md5.0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 0x67452301
mov dword [eax + 8], 0xefcdab89
mov dword [eax + 0xc], 0x98badcfe
mov dword [eax + 0x10], 0x10325476
ret

Function at 0x41ea80
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.004095d0
push eax
mov ecx, edi
call fcn.00405cc0
push eax
mov ecx, esi
call fcn.0041e8c0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, esi
call fcn.0041e9b0
pop edi
pop esi
pop ebp
ret 8

Function at 0x41eae0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.0045f630
push eax
mov ecx, edi
call fcn.00405cc0
push eax
mov ecx, esi
call fcn.0041e8c0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, esi
call fcn.0041e9b0
pop edi
pop esi
pop ebp
ret 8
Function at 0x41efe0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x51384c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x11c], edi
test esi, esi
je 0x41f1d8
test eax, eax
je 0x41f1d8
lea ecx, [esi + esi*4 + 0xa]
mov eax, 0x55555556
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea eax, [ecx + ecx]
cdq
idiv esi
push 0x3f0
lea ecx, [ecx + eax + 3]
push ecx
mov ecx, edi
call fcn.004060c0
mov eax, 0x55555556
imul dword [ebp + 0xc]
mov eax, edx
shr eax, 0x1f
add eax, edx
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x120], eax
test eax, eax
jle 0x41f132
mov dword [ebp - 0x118], eax
mov edi, edi
mov edx, dword [ebp - 0x110]
movzx eax, byte [edx + esi]
movzx edi, byte [edx + esi + 1]
movzx edx, byte [edx + esi + 2]
mov dword [ebp - 0x114], edx
mov edx, eax
sar edx, 2
and edx, 0x3f
movzx edx, byte [edx + ebx]
mov byte [ebp + ecx - 0x10c], dl
mov edx, edi
sar edx, 4
and eax, 3
and edx, 0xf
shl eax, 4
or edx, eax
movzx eax, byte [edx + ebx]
mov byte [ebp + ecx - 0x10b], al
mov eax, dword [ebp - 0x114]
and edi, 0xf
mov edx, eax
sar edx, 6
add edi, edi
and edx, 3
add edi, edi
or edx, edi
movzx edx, byte [edx + ebx]
mov edi, dword [ebp - 0x11c]
and eax, 0x3f
movzx eax, byte [eax + ebx]
mov byte [ebp + ecx - 0x10a], dl
mov byte [ebp + ecx - 0x109], al
add ecx, 4
add esi, 3
cmp ecx, 0x100
jl 0x41f10d
push ecx
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, edi
call fcn.004063a0
xor ecx, ecx
dec dword [ebp - 0x118]
jne 0x41f070
test ecx, ecx
je 0x41f12c
push ecx
lea edx, [ebp - 0x10c]
push edx
mov ecx, edi
call fcn.004063a0
mov eax, dword [ebp - 0x120]
lea ecx, [eax + eax*2]
mov eax, dword [ebp + 0xc]
sub eax, ecx
dec eax
je 0x41f197
dec eax
jne 0x41f1d8
mov ecx, dword [ebp - 0x110]
movzx eax, byte [ecx + esi]
movzx esi, byte [ecx + esi + 1]
mov dword [ebp - 0x114], eax
sar eax, 2
and eax, 0x3f
movzx edx, byte [eax + ebx]
push edx
mov ecx, edi
call fcn.00405ed0
mov eax, dword [ebp - 0x114]
mov ecx, esi
sar ecx, 4
and eax, 3
and ecx, 0xf
shl eax, 4
or ecx, eax
movzx edx, byte [ecx + ebx]
push edx
mov ecx, edi
call fcn.00405ed0
and esi, 0xf
movzx eax, byte [ebx + esi*4]
push eax
jmp 0x41f1c8
mov ecx, dword [ebp - 0x110]
movzx esi, byte [ecx + esi]
mov edx, esi
sar edx, 2
and edx, 0x3f
movzx eax, byte [edx + ebx]
push eax
mov ecx, edi
call fcn.00405ed0
and esi, 3
add esi, esi
movzx ecx, byte [ebx + esi*8]
push ecx
mov ecx, edi
call fcn.00405ed0
push 0x3d
mov ecx, edi
call fcn.00405ed0
push 0x3d
mov ecx, edi
call fcn.00405ed0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00462848
mov esp, ebp
pop ebp
ret
Function at 0x41ff50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov byte [eax], 0
mov ebx, ecx
mov dword [edi], 0
test esi, esi
je 0x420003
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x420003
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x41ffca
push 0
push edi
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41ffb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x41fff4
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x420016
push eax
call fcn.00420890
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0x14
cmp dword [edi], 0
jne 0x41ffc1
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0x14
mov eax, dword [ebx + 8]
test eax, eax
je 0x420016
push eax
push esi
push 1
push ecx
call fcn.00466429
add esp, 0x10
mov dword [edi], eax
cmp eax, esi
je 0x41fffa
mov eax, dword [ebx + 8]
push eax
call fcn.004661b7
add esp, 4
test eax, eax
jne 0x420016
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x420016
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
push str.NULL_buf_or_bufSize
call eax
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0x14