joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000253d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x10027ac8], 0x1c22
mov esi, dword [0x10027ac4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov cl, byte [eax + 0x10005535]
mov dl, byte [eax + 0x10005506]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x34], eax
jne 0x10002568
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
add ecx, 0x38a
mov dword [0x10027ac8], ecx
mov dword [0x10027ac4], 0x2676
mov dword [ebp - 0x38], eax
call fcn.10002d99
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.10001eb0
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x10002680
mov eax, dword [ebp - 0x3c]
mov dword [0x10027ac8], 0xdf2
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x10027ac8], 0x23a4
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.100030cf
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x3c], ecx
mov dword [0x10027ac4], 0x2677
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x50], ecx
mov dword [0x10027ac8], 0x680
cmp ecx, 0
mov dword [ebp - 0x40], eax
je 0x10002680
mov eax, dword [ebp - 0x44]
add eax, 0x262c
mov dword [0x10027ac4], 0x1906
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x100029c4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
call fcn.1000109a
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x10002a15
jmp 0x10002a0b
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
mov edx, dword [eax + ecx]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
cmp eax, 0x4550
je 0x10002ad7
jmp 0x10002ab9
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
lea eax, [esp + 0x38]
mov dword [0x10027ac4], 0x142d
mov dword [esp + 0x14], eax
call fcn.1000228e
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
jne 0x10002b33
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.10002689
lea ecx, [0x100024dc]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x6c], edx
mov dword [esp + 0x54], 0x133800
mov edx, dword [0x10027ab0]
mov dword [esp + 0x38], edx
mov edx, dword [0x10027ab4]
mov dword [esp + 0x68], edx
mov edx, dword [0x10027ab8]
mov dword [esp + 0x80], edx
mov edx, dword [0x10027abc]
mov dword [esp + 0x5c], edx
mov edx, dword [0x10027ac0]
mov dword [esp + 0x70], edx
mov dword [0x10027ac4], 0xca7
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov eax, dword [esp + 8]
cmp word [eax], 0x5a4d
mov dword [esp + 0x20], eax
je 0x100029e5
mov eax, dword [esp + 0x20]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [0x10027ac8], 0xfffff8b4
mov dword [esp + 8], eax
jmp 0x10002aa6
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x4c], ecx
mov edx, dword [esp + 0x1c]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x3c], esi
mov dword [0x10027ac4], 0x2489
mov dword [0x10027ac8], 0xae5
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.1000253d
mov dword [0x10027ac8], 0x74c
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
jmp 0x10002a0b
Function at 0x10002b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x10027acc], 0
mov dword [0x10027ad0], 0
mov dword [0x10027adc], 0
mov ebx, dword [0x10027ac8]
add ebx, 0xffffeb05
mov dword [0x10027ac4], ebx
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x10002cce
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x10027ac4], 0x1641
mov dword [0x10027ac8], 0xf08
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x10027acc], edx
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10027ad0], edx
mov dword [0x10027ac4], 0x160e
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x10027ad4], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x10027ad4]
mov edx, dword [0x10027ad0]
mov byte [edi + edx], cl
mov edx, dword [0x10027acc]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10027ad0]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x10027adc], ebx
mov dword [0x10027ac4], 0x2a72
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov edx, dword [0x10027ac8]
add edx, 0xfffff0cb
mov dword [0x10027ac8], edx
mov dl, cl
add dl, byte [0x10027ae1]
mov byte [0x10027ae0], dl
mov byte [0x10027ae1], ch
mov byte [0x10027ae2], cl
xor ch, cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + ebx], ch
mov dword [0x10027ac4], 0x138b
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x10002cce
mov eax, dword [0x10027acc]
mov ecx, dword [0x10027ad0]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
jmp 0x10002bab
mov dword [0x10027ac8], 0x232
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002edc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x10027ac8], 0x2446
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [0x10027ad0], 0
mov byte [0x10027ad4], 0
mov dword [0x10027acc], 0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10027ac4]
add eax, 0xcff
mov dword [0x10027ac8], eax
mov eax, dword [0x10027acc]
add eax, 1
mov dword [0x10027acc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10002f21
xor eax, eax
mov dword [0x10027ac4], 0x1e5b
mov dword [0x10027acc], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x10027ad8], 0
mov dword [0x10027ac8], 0x1a8e
mov edx, dword [0x10027ad0]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x10027ad8], edi
mov dword [0x10027ac4], 0x1721
mov eax, edi
cdq
idiv ecx
mov dword [0x10027ad0], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x10027ad4], cl
mov dword [0x10027ac4], 0x1c4e
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x10027ad4]
mov edx, dword [0x10027ad0]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x10027ac8], 0x257f
mov edx, dword [0x10027acc]
add edx, 1
mov dword [0x10027acc], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x10002f6f
mov dword [0x10027ac4], 0x1a3f
mov dword [0x10027ac8], 0x213
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1121a
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, dword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
push esi
push edi
mov edi, dword [esp + 0x14]
xor eax, eax
xor esi, esi
cmp byte [esi + edi], 0xe8
jne 0x1124b
push 0x11212
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
sub eax, esi
sub eax, edi
sub eax, 5
cmp eax, dword [esi + edi + 1]
pop ecx
je 0x11256
inc esi
cmp esi, 0x23e
jl 0x1122b
jmp 0x11259
lea eax, [esi + edi]
test eax, eax
je 0x11291
mov ecx, dword [esp + 0x10]
lea esi, [eax - 6]
mov edi, ecx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea esi, [eax - 6]
push 6
mov eax, esi
sub ebx, ecx
sub eax, ecx
push esi
sub ebx, 0xb
sub eax, 5
push ecx
mov byte [ecx + 6], 0xe8
mov dword [ecx + 7], ebx
mov byte [ecx + 0xb], 0xe9
mov dword [ecx + 0xc], eax
call fcn.0001035a
mov eax, esi
pop edi
pop esi
pop ebx
ret 8

Function at 0x113c6
Capabilities:
Create device object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push section.INIT
lea eax, [ebp - 0xc]
push eax
call edi
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x22
lea eax, [ebp - 0xc]
push eax
push 0x30
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jl 0x11452
mov eax, dword [ebp - 4]
or dword [eax + 0x1c], 0x10
mov eax, dword [ebp - 4]
push esi
mov esi, dword [eax + 0x28]
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
push 0x113a0
lea eax, [ebp - 0x14]
push eax
call edi
mov eax, dword [ebp - 0x14]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov esi, eax
test esi, esi
jge 0x1144f
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, esi
jmp 0x11451
xor eax, eax
pop esi
pop edi
leave
ret 4
Function at 0x411590
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
push eax
mov ebx, edx
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
and edi, 0xf
lea eax, [edi - 1]
cmp eax, 9
ja case.default.0x4115b8
jmp dword [eax*4 + 0x411798]
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x41177f
jmp 0x4116c3
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4116c3
jmp 0x41177f
mov eax, dword [0x43ad0c]
xor ecx, ecx
push 0x104
cmp edi, 4
push esi
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x41177f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411620
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x41163c
cmp word [esi + ecx*2 - 2], 0x5c
jne 0x41163c
dec ecx
cmp ecx, 2
jl 0x411656
cmp word [esi + ecx*2], 0x5c
je 0x411650
dec ecx
cmp ecx, 2
jge 0x411641
jmp 0x411656
xor eax, eax
mov word [esi + ecx*2], ax
cmp edi, 3
jne 0x4116c3
mov edx, str.lang
mov ecx, esi
call fcn.004117c0
test eax, eax
je 0x41178c
jmp 0x4116c3
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41177f
jmp 0x4116c3
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x41177f
jmp 0x4116c3
push 0x102
push esi
push dword [edi*4 + 0x436440]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x41177f
cmp eax, 0x102
jae 0x41177f
mov edx, ebx
mov ecx, esi
call fcn.004117c0
test eax, eax
je 0x41178c
test ebx, ebx
jne 0x41175a
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4116e1
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x4116fd
cmp word [esi + ecx*2 - 2], 0x5c
jne 0x4116fd
dec ecx
xor eax, eax
pop edi
mov word [esi + ecx*2], ax
mov eax, 1
pop esi
pop ebx
pop ebp
ret 4
mov ecx, ebx
call fcn.004190e0
test eax, eax
je 0x41177f
test ebx, ebx
jne 0x411722
xor edi, edi
jmp 0x411750
mov edi, ebx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x411727
sub edi, ecx
sar edi, 1
cmp edi, 0x104
jge 0x411766
test edi, edi
jle 0x411750
lea eax, [edi + edi]
push eax
push ebx
push esi
call fcn.0041c640
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
test edi, edi
js 0x411775
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x2001001f
call edi
jmp 0x41177b
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x7b
call edi
push 0xe0010018
call fcn.00413190
add esp, 4
xor eax, eax
pop edi
mov word [esi], ax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x411a30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov esi, edx
mov dword [edi], 0xffffffff
test ebx, ebx
jne 0x411a5c
push 0x20010020
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 4
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x411a76
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [edi], eax
mov eax, dword [esi]
jmp 0x411aed
push 0x250
call fcn.0041d6de
mov esi, eax
add esp, 4
test esi, esi
jne 0x411ad2
movzx eax, word [0x43ad06]
sub eax, 7
je 0x411aad
sub eax, 2
je 0x411aa6
sub eax, 1
jne 0x411aa6
mov eax, dword [str.El_sistema_no_puede_asignar_suficiente_memoria]
jmp 0x411ab2
mov eax, dword [str.The_system_cannot_allocate_enough_memory]
jmp 0x411ab2
mov eax, dword [str.Der_Speicher_reicht_nicht]
push eax
push 0xa8010f00
call fcn.00413190
add esp, 8
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [edi], eax
mov eax, dword [esi]
push esi
mov dword [ebp + 8], eax
call fcn.0041d6c3
mov eax, dword [ebp + 8]
add esp, 4
cmp dword [edi], 0xffffffff
je 0x411b04
test al, 0x10
mov eax, 0
pop edi
setne al
pop esi
inc eax
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x411bb2
cmp eax, 3
je 0x411bb2
mov ecx, ebx
call fcn.004190e0
test eax, eax
jne 0x411b8a
xor edi, edi
nop dword [eax]
mov edx, dword [edi*4 + 0x4365d8]
test edx, edx
je 0x411b60
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411b40
sub ecx, esi
sar ecx, 1
je 0x411b60
push ecx
push edx
push ebx
call fcn.0041e43c
add esp, 0xc
test eax, eax
je 0x411ba2
mov esi, dword [edi*4 + 0x4365c4]
mov ecx, ebx
push 1
mov edx, esi
call fcn.00416c20
mov dl, byte [eax + esi]
test dl, dl
je 0x411ba2
movzx ecx, byte [eax + ebx]
movzx eax, dl
sub ecx, eax
je 0x411ba2
inc edi
cmp edi, 4
jb 0x411b30
push ebx
push 0xe0010009
call fcn.00413190
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 4
test edi, edi
js 0x411b8a
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
Function at 0x411d20
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x43bd20], 0
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], eax
je 0x411d5b
call esi
cmp dword [0x43bd20], eax
mov eax, dword [0x43acbc]
je 0x411d60
mov eax, dword [0x43ac6c]
test eax, 0x70000000
setne cl
bt eax, 0x1f
setb al
test al, cl
jne 0x411f26
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [0x43bd20]
test ecx, ecx
je 0x411d9b
call esi
mov ecx, dword [0x43bd20]
mov edi, dword [0x43acbc]
cmp ecx, eax
je 0x411da1
mov edi, dword [0x43ac6c]
test ecx, ecx
je 0x411db4
call esi
cmp dword [0x43bd20], eax
mov eax, 0x43acbc
je 0x411db9
mov eax, 0x43ac6c
or dword [eax], 0x200000
xor edx, edx
lea eax, [ebp - 0xc]
mov ecx, ebx
push eax
call fcn.00411a30
mov esi, eax
cmp esi, 1
jb 0x411ddc
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [0x43bd20], 0
je 0x411df8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x43bd20], eax
mov eax, 0x43acbc
je 0x411dfd
mov eax, 0x43ac6c
mov dword [eax], edi
lea eax, [esi + 1]
cmp eax, 3
ja case.default.0x411e07
jmp dword [eax*4 + 0x411f34]
mov esi, dword [ebp - 4]
cmp esi, 3
je 0x411e73
cmp esi, 5
je 0x411e73
mov edx, 0x12
mov ecx, ebx
call fcn.00415970
test eax, eax
je 0x411e93
jmp 0x411e73
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x411e93
cmp dword [ebp + 0x14], 0
je 0x411e56
push ebx
push 0x21010012
call fcn.00413190
add esp, 8
sub eax, 6
jne 0x411efb
mov esi, dword [ebp - 4]
cmp esi, 1
je 0x411e73
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x411e93
jmp 0x411e73
mov esi, dword [ebp - 4]
push 0
push dword [ebp - 0x10]
push esi
push 0
push dword [ebp - 0x14]
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x411f29
mov edi, 0xe0010015
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov ecx, 0x13
cmp ecx, eax
je 0x411eb9
mov ecx, dword [esi*4 + 0x4364c8]
add esi, 2
test ecx, ecx
jne 0x411ea5
jmp 0x411ec9
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call eax
mov edi, dword [esi*4 + 0x4364c4]
cmp dword [ebp - 8], 0
jne 0x411ede
test edi, edi
mov eax, 0xa0010007
mov ebx, 0x4370b4
cmove edi, eax
push ebx
push edi
call fcn.00413190
add esp, 8
cmp eax, 4
jne 0x411f26
mov ebx, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
jmp 0x411d77
sub eax, 1
jne 0x411f26
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x20010006
call eax
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push ebx
push 0xa0010011
call fcn.00413190
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x412150
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x43a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x412182
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004194d8
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
push esi
test edx, edx
je 0x41223e
cmp dword [0x43bd20], 0
je 0x4121ab
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x43bd20], eax
mov eax, dword [0x43acbc]
je 0x4121b0
mov eax, dword [0x43ac6c]
test eax, 0x70000000
setne cl
bt eax, 0x1f
setb al
test al, cl
jne 0x41223e
test edi, edi
lea esi, [ebp - 8]
cmovne esi, edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x4121e8
mov dword [esi], edi
lea eax, [edi + 1]
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004194d8
mov esp, ebp
pop ebp
ret
push 0
push esi
push edi
push dword [ebp - 0x10]
push dword [ebp - 0xc]
cmp ebx, 0x20010010
jne 0x41221a
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x412246
pop esi
pop ebx
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004194d8
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x412246
cmp dword [esi], edi
jne 0x412246
pop esi
pop ebx
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004194d8
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0xc]
or ebx, 0xc0000000
xor edx, edx
mov ecx, ebx
call fcn.00411f50
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop esi
pop ebx
pop edi
call fcn.004194d8
mov esp, ebp
pop ebp
ret
Function at 0x4122c0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x14], ebx
push 0
mov dword [ebp - 8], esi
call edi
test esi, esi
je 0x4124aa
test ebx, ebx
je 0x4124aa
mov ecx, dword [0x43bd20]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
test ecx, ecx
je 0x41230e
call edi
mov ecx, dword [0x43bd20]
cmp ecx, eax
mov eax, dword [0x43acbc]
je 0x412313
mov eax, dword [0x43ac6c]
mov dword [ebp - 4], eax
test ecx, ecx
je 0x412329
call edi
cmp dword [0x43bd20], eax
mov eax, 0x43acbc
je 0x41232e
mov eax, 0x43ac6c
or dword [eax], 0x200000
xor edx, edx
lea eax, [ebp - 0xc]
mov ecx, ebx
push eax
call fcn.00411a30
mov dword [ebp - 0x10], eax
cmp eax, 1
jb 0x412352
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [0x43bd20], 0
je 0x41236a
call edi
cmp dword [0x43bd20], eax
mov eax, 0x43acbc
je 0x41236f
mov eax, 0x43ac6c
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
je 0x4124b1
test eax, eax
je 0x412493
cmp eax, 2
je 0x412493
mov edx, 0x12
mov ecx, esi
call fcn.00415970
test eax, eax
je 0x4124b1
mov ecx, dword [0x43bd20]
test ecx, ecx
je 0x4123c1
call edi
mov ecx, dword [0x43bd20]
mov ebx, dword [0x43acbc]
cmp ecx, eax
je 0x4123c7
mov ebx, dword [0x43ac6c]
test ecx, ecx
je 0x4123da
call edi
cmp dword [0x43bd20], eax
mov eax, 0x43acbc
je 0x4123df
mov eax, 0x43ac6c
or dword [eax], 0x200000
xor edx, edx
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00411a30
mov esi, eax
cmp esi, 1
jb 0x412402
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [0x43bd20], 0
je 0x41241a
call edi
cmp dword [0x43bd20], eax
mov eax, 0x43acbc
je 0x41241f
mov eax, 0x43ac6c
mov dword [eax], ebx
cmp esi, 0xffffffff
je 0x4124b1
cmp esi, 1
jne 0x412452
mov esi, dword [ebp - 8]
push esi
push 0xa0010006
call fcn.00413190
add esp, 8
cmp eax, 4
je 0x4123a5
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 2
je 0x4124b1
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0x14]
push esi
push ebx
call edi
test eax, eax
jne 0x412487
push ebx
push 0xe001000b
call fcn.00413190
add esp, 8
cmp eax, 4
je 0x412463
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0xa0010007
call fcn.00413190
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x20010020
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4124c0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0
mov dword [ebp - 0xc], edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, 0x12
mov ecx, esi
call fcn.00415970
test eax, eax
je 0x4125d5
mov edi, dword [ebp + 8]
cmp edi, 1
je 0x4125ae
mov ecx, dword [0x43bd20]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
test ecx, ecx
je 0x412517
call ebx
mov ecx, dword [0x43bd20]
cmp ecx, eax
mov eax, dword [0x43acbc]
je 0x41251c
mov eax, dword [0x43ac6c]
mov dword [ebp + 8], eax
test ecx, ecx
je 0x412532
call ebx
cmp dword [0x43bd20], eax
mov eax, 0x43acbc
je 0x412537
mov eax, 0x43ac6c
or dword [eax], 0x200000
xor edx, edx
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00411a30
mov dword [ebp - 8], eax
cmp eax, 1
jb 0x41255b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [0x43bd20], 0
je 0x412573
call ebx
cmp dword [0x43bd20], eax
mov eax, 0x43acbc
je 0x412578
mov eax, 0x43ac6c
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
pop ebx
cmp eax, 1
jne 0x4125aa
push esi
push 0x21010012
call fcn.00413190
add esp, 8
cmp eax, 6
je 0x4125a3
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
mov edi, 1
jmp 0x4125ae
test eax, eax
jne 0x4125d5
xor eax, eax
cmp edi, 1
mov edi, dword [ebp - 0xc]
setne al
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4125e0
push esi
push edi
push 0x6001000e
call fcn.00413190
add esp, 0xc
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4