joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4416b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
xor ecx, ecx
test esi, esi
sete cl
jmp dword [ecx*4 + 0x44f6d0]

Function at 0x442bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
mov edx, edi
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x442c22
mov ecx, ebx
shr ecx, 2
mov eax, ebp
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0x442d5e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x442d5e
mov dword [esp], 0xcccdcacb
mov word [esp + 4], 0
mov cl, 0x4d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
xor dl, cl
mov ch, 0x85
sub ch, dl
mov byte [esp + eax], ch
inc eax
dec cl
cmp eax, 6
jne 0x442c40
mov eax, dword [esp]
mov ecx, dword [0x451440]
test ecx, ecx
je 0x442cb2
xor edx, edx
mov edi, dword [0x451444]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x442c84
inc edx
cmp ecx, edx
jne 0x442c70
mov edi, dword [esp + 0x24]
jmp 0x442cb2
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
mov edi, dword [esp + 0x24]
je 0x442cb2
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push ecx
push dword [0x451448]
call fcn.004417a0
add esp, 0x28
test eax, eax
js 0x442d5e
push 0x732f71fd
push dword [0x45945c]
call fcn.004442e0
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ebp, dword [esp + 8]
mov dword [esp], 0xcccdcacb
mov word [esp + 4], 0
xor edx, edx
mov bl, 0x4d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov bh, byte [esp + edx]
xor bh, bl
mov cl, 0x85
sub cl, bh
mov byte [esp + edx], cl
inc edx
dec bl
cmp edx, 6
jne 0x442d00
mov edx, dword [0x451440]
test edx, edx
je 0x442d5e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x451444]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x442d40
inc edi
cmp edx, edi
jne 0x442d30
jmp 0x442d5e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x442d5e
push ebp
push 1
push edx
push dword [0x451448]
mov esi, eax
call fcn.004417a0
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44411a
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0xf7f6f988
mov dword [esp + 4], 0
xor eax, eax
xor edx, edx
nop
nop
nop
mov esi, eax
and esi, 0xc
mov ebx, edx
xor ebx, 0x56
add ebx, esi
xor bl, byte [esp + edx]
add bl, 0x52
mov byte [esp + edx], bl
inc edx
add eax, 2
cmp edx, 8
jne case.default.0x44415b
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44ff54]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [case.0x44415b.5]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x44ff5c]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [case.0x44415b.5]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x44ff5c]
jmp esi
xor ebx, ebx
cmp dword [edi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x44ff74]
mov ebx, 1
jmp dword [ebx*4 + 0x44ff7c]
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x4441f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 4], 0x61666754
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
mov ecx, eax
add cl, 0x69
xor cl, byte [esp + eax + 4]
add cl, 0xf3
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 7
jne case.default.0x444237
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x20], 0
sete cl
jmp dword [ecx*4 + 0x44ff84]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
add eax, 0xc
mov edi, dword [0x44ffa4]
mov ebx, dword [case.0x444237.3]
mov dword [esp], 0
mov ebp, dword [0x44ffd0]
xor ecx, ecx
cmp esi, eax
setne cl
jmp dword [ecx*4 + 0x44ff8c]
xor edx, edx
mov ecx, dword [esp + 0x20]
cmp dword [esi + 0x18], ecx
sete dl
mov ecx, 1
jmp dword [edx*4 + 0x44ff94]
jmp edi
jmp dword [ecx*4 + 0x44ffbc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4442e0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov esi, dword [esp + 0x44]
movzx eax, word [esi]
mov dword [esp], 0xf3f2aba5
mov byte [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
add dl, 0xd4
xor dl, byte [esp + ecx]
add dl, 0xdc
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 5
jne case.default.0x44431e
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44ffd4]
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + ecx]
mov dword [esp], 0x7372bca0
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov esi, 0x62b1e194
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi - 0x62b1e194]
xor edi, esi
lea ebx, [edi + 0x1b]
mov ebp, 0xe4
sub ebp, edi
or ebp, 1
add ebp, edi
or ebx, 1
add ebx, ebp
add bl, 0x1c
mov byte [esp + esi - 0x62b1e194], bl
inc esi
cmp esi, 0x62b1e19b
jne 0x444350
xor ebx, ebx
cmp edx, dword [esp]
setne bl
mov ebp, dword [esp + 0x44]
jmp dword [ebx*4 + 0x44ffdc]
mov edi, dword [ebp + ecx + 0x78]
mov esi, dword [ebp + ecx + 0x7c]
test esi, esi
sete cl
test edi, edi
sete dl
or dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x44ffe4]
mov eax, dword [ebp + edi + 0x20]
add eax, ebp
mov dword [esp + 0x28], eax
mov eax, dword [ebp + edi + 0x24]
add eax, ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], esi
mov eax, dword [ebp + edi + 0x1c]
add eax, ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
mov edx, dword [ebp + edi + 0x18]
xor ecx, ecx
xor eax, eax
cmp ecx, edx
setb al
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], edx
jmp dword [eax*4 + 0x44ffec]
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x444c50
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x444c6b
mov eax, 0xffffffff
jmp 0x444c6e
add eax, 0xa
push eax
call fcn.0040cdd0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x444cb1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x444ca0
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xf00f0e0d
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, esp
mov edx, 0xfb1e3902
nop
nop
nop
nop
movzx esi, byte [ecx]
mov ebx, edx
or ebx, esi
not ebx
lea ebp, [edx + 0x4e1c700]
and ebp, esi
or ebp, ebx
mov esi, ebp
and esi, 0xe
xor ebp, 0xe
lea ebx, [esi*2]
add ebx, ebp
inc bl
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0xfb1e38fb
jne 0x444d20
mov esi, dword [esp]
mov ecx, dword [0x451440]
test ecx, ecx
je 0x444db4
xor edx, edx
mov ebx, dword [0x451444]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x444d80
inc edx
cmp ecx, edx
jne 0x444d70
jmp 0x444db4
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x444db4
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push ecx
push dword [0x451448]
mov edi, eax
call fcn.004417a0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040cde0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444dd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x444df0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x444e0b
mov eax, 0xffffffff
jmp 0x444e0e
add eax, 0xa
push eax
call fcn.0040cdd0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x444e51
add ebx, 2
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x444e40
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp], dx
add ecx, edi
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xf00f0e0d
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
lea ecx, [esp + 0x20]
mov edx, 0xfb1e3902
nop
movzx esi, byte [ecx]
mov edi, edx
or edi, esi
not edi
lea ebx, [edx + 0x4e1c700]
and ebx, esi
or ebx, edi
mov esi, ebx
and esi, 0xe
xor ebx, 0xe
lea ebx, [ebx + esi*2]
inc bl
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0xfb1e38fb
jne 0x444ed0
mov esi, dword [esp + 0x20]
mov ecx, dword [0x451440]
test ecx, ecx
je 0x444f59
xor edx, edx
mov edi, dword [0x451444]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x50dc24c7
je 0x444f30
inc edx
cmp ecx, edx
jne 0x444f20
jmp 0x444f59
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x444f59
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push ecx
push dword [0x451448]
mov edi, eax
call fcn.004417a0
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.0040cde0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x444f6f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xf00f0e0d
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, esp
mov edx, 0xfb1e3902
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [eax]
mov ebx, edx
or ebx, ecx
not ebx
lea esi, [edx + 0x4e1c700]
and esi, ecx
or esi, ebx
mov ecx, esi
and ecx, 0xe
xor esi, 0xe
lea ecx, [esi + ecx*2]
inc cl
mov byte [eax], cl
inc eax
dec edx
cmp edx, 0xfb1e38fb
jne 0x444fb0
mov eax, dword [esp]
mov edx, dword [0x451440]
test edx, edx
je 0x445038
xor ebx, ebx
mov ecx, dword [0x451444]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x7cde1e50
je 0x445010
inc ebx
cmp edx, ebx
jne 0x445000
jmp 0x445038
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x445038
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 5
push edx
push dword [0x451448]
call fcn.004417a0
add esp, 0x20
test edi, edi
je 0x445042
mov ecx, dword [esp + 8]
mov dword [edi], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x445051
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x445060
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov dword [esp], 0xf00f0e0d
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, esp
mov ebx, 0xfb1e3902
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [eax]
mov ebp, ebx
or ebp, edi
not ebp
lea esi, [ebx + 0x4e1c700]
and esi, edi
or esi, ebp
mov edi, esi
and edi, 0xe
xor esi, 0xe
lea ecx, [esi + edi*2]
inc cl
mov byte [eax], cl
inc eax
dec ebx
cmp ebx, 0xfb1e38fb
jne 0x445090
mov eax, dword [esp]
mov ebx, dword [0x451440]
test ebx, ebx
je 0x445121
xor ebp, ebp
mov edi, dword [0x451444]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xc81e0bf6
je 0x4450f0
inc ebp
cmp ebx, ebp
jne 0x4450e0
jmp 0x445121
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x445121
lea eax, [esp + 8]
push 0
push 0
push edx
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push ebx
push dword [0x451448]
call fcn.004417a0
add esp, 0x30
cmp eax, 0x103
jne 0x4451d9
mov dword [esp], 0xf00f0e0d
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, esp
mov ecx, 0xfb1e3902
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
mov esi, ecx
or esi, edx
not esi
lea edi, [ecx + 0x4e1c700]
and edi, edx
or edi, esi
mov edx, edi
and edx, 0xe
xor edi, 0xe
lea edx, [edi + edx*2]
inc dl
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0xfb1e38fb
jne 0x445150
mov eax, dword [esp]
mov ecx, dword [0x451440]
test ecx, ecx
je 0x4451d1
xor edx, edx
mov edi, dword [0x451444]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x4451b0
inc edx
cmp ecx, edx
jne 0x4451a0
jmp 0x4451d1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x4451d1
push 0
push 0
push dword [esp + 0x2c]
push 3
push ecx
push dword [0x451448]
call fcn.004417a0
add esp, 0x18
test eax, eax
js 0x4451d9
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x4451f0
xor ecx, ecx
cmp eax, 0xc0000011
je 0x4451ee
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x445390
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x4453b0
sar ebx, 1
mov ebp, ebx
and ebp, 2
mov ecx, ebx
or ebx, 2
imul ebx, ebp
xor ebp, 2
and ecx, 0xfffd
imul ecx, ebp
add ebx, ecx
mov word [esp + 8], bx
mov ecx, ebx
and ecx, 2
xor ebx, 2
lea ecx, [ebx + ecx*2]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xf00f0e0d
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, esp
mov edi, 0xfb1e3902
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [eax]
mov ebx, edi
or ebx, ecx
not ebx
lea ebp, [edi + 0x4e1c700]
and ebp, ecx
or ebp, ebx
mov ecx, ebp
and ecx, 0xe
xor ebp, 0xe
lea ecx, [ecx*2]
add ecx, ebp
inc cl
mov byte [eax], cl
inc eax
dec edi
cmp edi, 0xfb1e38fb
jne 0x445440
mov eax, dword [esp]
mov edi, dword [0x451440]
test edi, edi
je 0x4454c5
xor ebx, ebx
mov ebp, dword [0x451444]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x2df48de6
je 0x4454a1
inc ebx
cmp edi, ebx
jne 0x445490
jmp 0x4454c5
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x4454c5
lea eax, [esp + 0x10]
push esi
push eax
push edx
push dword [esp + 0x4c]
push 4
push edi
push dword [0x451448]
call fcn.004417a0
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4031fd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x403228
mov ecx, dword [0x447798]
push esi
add eax, ecx
push esi
push eax
mov dword [0x4284fc], eax
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.00403305
cmp eax, esi
jl 0x4032ff
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00405f93
test eax, eax
je 0x4032ef
push dword [ebp + 8]
add dword [0x4284fc], 4
call fcn.00403305
mov ebx, eax
cmp ebx, esi
jl 0x4032fd
cmp dword [ebp + 0x10], esi
jne 0x4032cb
cmp dword [ebp + 8], esi
jle 0x4032fd
mov esi, 0x41c4f8
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40328d
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00405f93
test eax, eax
je 0x4032ef
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00405fc2
test eax, eax
je 0x4032c7
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x4284fc], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x40327c
jmp 0x4032fd
push 0xfffffffffffffffe
jmp 0x4032f1
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x4032d6
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4032f4
push 0xfffffffffffffffd
pop eax
jmp 0x4032ff
mov ebx, dword [ebp - 4]
add dword [0x4284fc], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x40596f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x408384
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x408374
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4059c0
xor eax, eax
jmp 0x4059e7
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x4059e7
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
jne 0x4059bc
call esi
pop esi
leave
ret 4

Function at 0x405a21
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x43e558], 0x44
push eax
xor eax, eax
push 0x43e558
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405a60
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405a64
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
ret 4

Function at 0x405b02
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405ef6
mov edi, eax
cmp edi, 0xffffffff
je 0x405b43
test byte [esp + 0x10], 1
push esi
je 0x405b25
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x405b2b
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x405b34
xor eax, eax
inc eax
jmp 0x405b45
test byte [esp + 0x10], 4
jne 0x405b43
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x405b4a
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405e08
test bl, 8
mov dword [ebp - 0xc], eax
je 0x405b89
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4477c8], eax
jmp 0x405d13
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405ba3
test eax, eax
je 0x405cc1
test bl, 2
je 0x405cc1
mov esi, 0x43a558
push edi
push esi
call fcn.00406388
cmp dword [ebp + 8], 0
je 0x405bc2
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405bc8
push edi
call fcn.00405d61
cmp byte [edi], 0
jne 0x405bd6
cmp byte [0x43a558], 0x5c
jne 0x405be1
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405cb7
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405d45
cmp byte [eax], 0
je 0x405c27
cmp byte [ebp - 0x1c], 0
je 0x405c27
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x405c3d
mov al, byte [esi + 1]
test al, al
je 0x405c96
cmp al, 0x2e
jne 0x405c3d
cmp byte [esi + 2], 0
je 0x405c96
push esi
push ebx
call fcn.00406388
test byte [ebp - 0x14c], 0x10
je 0x405c62
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405c96
push dword [ebp + 0xc]
push edi
call fcn.00405b4a
jmp 0x405c96
push dword [ebp - 4]
push edi
call fcn.00405b02
test eax, eax
jne 0x405c8e
cmp dword [ebp - 4], eax
je 0x405c86
push edi
push 0xfffffffffffffff1
call fcn.004054a9
push 0
push edi
call fcn.00406161
jmp 0x405c96
inc dword [0x4477c8]
jmp 0x405c96
push edi
push 0xfffffffffffffff2
call fcn.004054a9
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405c05
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405cc1
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405d13
cmp dword [ebp - 0xc], esi
jne 0x405cd5
inc dword [0x4477c8]
jmp 0x405d13
push edi
call fcn.004066ff
test eax, eax
je 0x405d13
push edi
call fcn.00405d1a
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405b02
test eax, eax
jne 0x405d0b
cmp dword [ebp - 4], esi
je 0x405ccd
push edi
push 0xfffffffffffffff1
call fcn.004054a9
push esi
push edi
call fcn.00406161
jmp 0x405d13
push edi
push 0xffffffffffffffe5
call fcn.004054a9
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x405e08
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x43c558
push esi
call fcn.00406388
push esi
call fcn.00405db3
mov edi, eax
test edi, edi
jne 0x405e29
xor eax, eax
jmp 0x405e7b
push edi
call fcn.00406666
test byte [0x447758], 0x80
je 0x405e42
mov al, byte [edi]
test al, al
je 0x405e25
cmp al, 0x5c
je 0x405e25
sub edi, esi
jmp 0x405e5a
call fcn.004066ff
test eax, eax
je 0x405e54
test byte [eax], 0x10
je 0x405e25
push esi
call fcn.00405d61
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405e46
call fcn.00405d1a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ef6
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f15
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x405f1b
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405f4a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40a3ec]
dec edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405f8f
test edi, edi
jne 0x405f55
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405f89