joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
push ebx
push esi
push edi
nop
nop
nop
nop
nop
nop
nop
mov ecx, 0xd
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvcHost
lea edi, [ebp - 0x48]
lea eax, [ebp - 4]
rep movsd dword es:[edi], dword [esi]
push eax
push 0xf003f
lea ecx, [ebp - 0x48]
push 0
push ecx
push reloc.WS2_32.dll_bind
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001016d
mov ecx, 0x1f3
lea edi, [ebp - 0x817]
mov byte [ebp - 0x818], al
lea edx, [ebp - 0xc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1f4
xor eax, eax
lea edi, [ebp - 0x818]
push edx
mov edx, dword [ebp - 4]
mov dword [ebp - 8], 7
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x818]
lea ecx, [ebp - 8]
push eax
push ecx
push 0
push str.imgsvc
push edx
mov dword [ebp - 0xc], 0x7d0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 4]
push eax
jne 0x10010167
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [ebp - 0x818]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x818]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x10], 0
mov esi, ecx
test si, si
je 0x1001016d
cmp si, 1
je 0x1001016d
push str.Meoqtf_RanpnswsDgh
push ebx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x1001015b
mov ecx, dword [ebp - 0x10]
mov eax, esi
and eax, 0xffff
test si, si
lea edx, [ecx + eax + 1]
lea ebx, [ebx + eax + 1]
mov dword [ebp - 0x10], edx
je 0x1001016d
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
test si, si
jne 0x1001010e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10010180
Capabilities:
Delete file
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
call fcn.1000fee0
test eax, eax
jne 0x1001018e
call fcn.1000fa00
call fcn.10010040
test eax, eax
jne 0x1001019c
jmp fcn.1000fc00
ret
Function at 0x100101a0
Capabilities:
Contain obfuscated stackstrings
Set file attributes

Disassembly:
sub esp, 0x440
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x18]
push edi
lea ecx, [esp + 0x28]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x33], 0x6e
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 0x6c
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3a], 0x6c
mov byte [esp + 0x3b], 0x6c
mov byte [esp + 0x3c], 0
mov byte [esp + 0x24], 0x43
mov byte [esp + 0x25], 0x72
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], 0x61
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x46
mov byte [esp + 0x2b], 0x69
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x41
mov byte [esp + 0x2f], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebp, eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x38]
push edx
push eax
mov byte [esp + 0x40], 0x6b
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], 0x72
mov byte [esp + 0x43], 0x6e
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], 0x6c
mov byte [esp + 0x46], 0x33
mov byte [esp + 0x47], 0x32
mov byte [esp + 0x48], 0x2e
mov byte [esp + 0x49], 0x64
mov byte [esp + 0x4a], 0x6c
mov byte [esp + 0x4b], 0x6c
mov byte [esp + 0x4c], 0
mov byte [esp + 0x18], 0x57
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x74
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 0x46
mov byte [esp + 0x1e], 0x69
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], 0
call esi
push eax
call edi
mov ecx, dword [esp + 0x454]
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push ecx
mov dword [esp + 0x64], eax
call ebp
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1001039a
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x51]
mov byte [esp + 0x50], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x4c], 0
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x5005
xor edi, edi
idiv ecx
mov ebp, edx
test ebp, ebp
jle 0x10010378
mov edx, edi
and edx, 0x800003ff
jns 0x1001033c
dec edx
or edx, 0xfffffc00
inc edx
jne 0x1001035d
xor esi, esi
call dword [sym.imp.MSVCRT.dll_rand]
add eax, esi
mov ecx, 0xff
cdq
idiv ecx
inc esi
cmp esi, 0x400
mov byte [esp + esi + 0x4f], dl
jl 0x10010340
lea edx, [esp + 0x4c]
push 0
push edx
lea eax, [esp + 0x58]
push 0x400
push eax
push ebx
call dword [esp + 0x5c]
inc edi
cmp edi, ebp
jl 0x1001032a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1001c210]
mov edx, dword [esp + 0x454]
and ecx, 0xffff
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x440
ret
Function at 0x22d4a60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1d26000]
push edi
or ebp, 0xffffffff
jmp 0x22d4a82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x22d4a89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x22d4a78
mov eax, 1
add ebx, ebx
jne 0x22d4a9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x22d4aac
jne 0x22d4acb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x22d4acb
dec eax
add ebx, ebx
jne 0x22d4ab8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x22d4a90
add ebx, ebx
jne 0x22d4ac7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x22d4b1d
xor ecx, ecx
sub eax, 3
jb 0x22d4ae3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x22d4b52
sar eax, 1
mov ebp, eax
jmp 0x22d4aee
add ebx, ebx
jne 0x22d4aee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x22d4abc
inc ecx
add ebx, ebx
jne 0x22d4afc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x22d4abc
add ebx, ebx
jne 0x22d4b09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x22d4afe
jne 0x22d4b1a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x22d4afe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x22d4b3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x22d4b2e
jmp 0x22d4a7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x22d4b3c
add edi, ecx
jmp 0x22d4a7e
pop esi
mov edi, esi
mov ecx, 0x1ae13
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x22d4b5a
cmp byte [edi], 0xb5
jne 0x22d4b5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x22d4b5f
lea edi, [esi + 0x1e97000]
mov eax, dword [edi]
or eax, eax
je 0x22d4bce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x36fbd38]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x36fbe7c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x22d4b8c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x36fbe84]
or eax, eax
je 0x22d4bc8
mov dword [ebx], eax
add ebx, 4
jmp 0x22d4ba9
call dword [esi + 0x36fbe80]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x22d4bff
cmp al, 0xef
ja 0x22d4bf2
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x22d4bd4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x22d4be1
mov ebp, dword [esi + 0x36fbe88]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x22d4c33
sub esp, 0xffffff80
jmp 0x93215c
Function at 0x40161b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x405b08
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x401631
Capabilities:
Delete file
Move file

Disassembly:
push 4
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
ret

Function at 0x4019e3
Capabilities:
Delete directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c0
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_wcscpy]
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_wcscat]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 1
lea eax, [ebp - 0x268]
xor esi, esi
push eax
mov eax, dword [ebp - 8]
dec eax
push esi
neg eax
sbb eax, eax
push esi
and al, 0xeb
mov word [ebp - 0x268], si
add eax, 0x17
push eax
push dword [ebp - 0x10]
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x401af6
lea ecx, [ebp - 0x268]
call fcn.004015b0
lea eax, [ebp - 0x268]
push str.7_Zip_
push eax
call edi
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
add esp, 0xc
lea esi, [ebp + eax*2 - 0x268]
cmp dword [ebp - 4], 0
mov eax, str.7_Zip_File_Manager.lnk
je 0x401a7c
mov eax, str.7_Zip_Help.lnk
push eax
push esi
call ebx
lea eax, [ebp - 0x4c0]
push 0x405b08
push eax
call ebx
add esp, 0x10
cmp dword [ebp - 4], 0
mov eax, str.7zFM.exe
je 0x401aa1
mov eax, str.7_zip.chm
push eax
lea eax, [ebp - 0x4c0]
push eax
call edi
pop ecx
lea edx, [ebp - 0x4c0]
pop ecx
lea ecx, [ebp - 0x268]
call fcn.00401b08
test eax, eax
jne 0x401ad6
lea eax, [ebp - 0x268]
mov dword [ebp - 0xc], 1
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jb 0x401a6c
cmp dword [ebp - 0xc], 0
je 0x401af6
and word [esi], 0
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jb 0x401a05
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4028c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x11
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jne 0x4028d8
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x4028e6
xor eax, eax
jmp 0x4028ff
call fcn.004027c0
test eax, eax
je 0x4028e2
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.004027e0
mov eax, dword [ebp - 8]
mov ecx, eax
shr ecx, 1
and ecx, eax
test ecx, 0x8000000
je 0x4028d2
xor ecx, ecx
xgetbv
mov eax, ecx
shr eax, 2
shr ecx, 1
and eax, ecx
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x402a30
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x402a6f
push str.SetDefaultDllDirectories
push 0x9c66b8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402a6f
push 0xc00
call eax
test eax, eax
jne 0x402b07
push 0x106
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402b07
cmp eax, 0x104
ja 0x402b07
cmp word [ebp + eax*2 - 0x2d2], 0x5c
je 0x402aa9
mov ecx, 0x5c
mov word [ebp + eax*2 - 0x2d0], cx
inc eax
cmp byte [str.userenv], 0
push esi
mov esi, str.userenv
je 0x402b06
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea ebx, [ebp + eax*2 - 0x2d0]
mov cl, byte [esi]
inc esi
mov eax, ebx
test cl, cl
je 0x402ae0
movzx edx, cl
mov cl, byte [esi]
mov word [eax], dx
add eax, 2
inc esi
test cl, cl
jne 0x402ad0
xor ecx, ecx
push 8
push ecx
lea edx, [ebp - 0x2d0]
push edx
mov dword [eax], 0x64002e
mov dword [eax + 4], 0x6c006c
mov word [eax + 8], cx
call edi
cmp byte [esi], 0
jne 0x402ac7
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407410
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0x98
xor ebx, ebx
lea eax, [esi + 0x110]
push ebx
push eax
call fcn.0095d660
mov eax, dword [esi + 0x34]
add eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x28]
lea edi, [ecx + eax]
mov dword [esi + 0x40], eax
shr ecx, 3
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [esi + 0x18]
shr edx, 3
imul edx, edx, 0x54
mov ecx, edi
sub ecx, edx
add esp, 0xc
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0xc], eax
mov edx, eax
cmp eax, 0xc
jb 0x407470
mov edx, 0xc
or eax, 0xffffffff
sub eax, edx
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
lea eax, [edi - 0xc]
lea edx, [ecx + 0x600]
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 8], ecx
mov edx, 0x100
mov word [eax], dx
mov edx, 0x101
mov word [eax + 2], dx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
xor edx, edx
lea eax, [ecx + 2]
xor ecx, ecx
mov byte [eax - 2], dl
mov byte [eax - 1], 1
mov word [eax], cx
mov word [eax + 2], cx
inc edx
add eax, 6
cmp edx, 0x100
jb 0x4074b1
lea edx, [esi + 0x9fc]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edx
jmp 0x4074e2
xor ebx, ebx
mov edi, dword [ebp - 8]
jmp 0x4074f0
movzx eax, word [ebx + 0x9c6700]
mov ecx, dword [ebp - 4]
xor edx, edx
add ecx, 2
div ecx
mov edx, 0x4000
sub edx, eax
movzx ecx, dx
xor eax, eax
lea ecx, [ecx]
mov word [edi + eax*2], cx
add eax, 8
cmp eax, 0x40
jb 0x407510
add ebx, 2
add edi, 2
cmp ebx, 0x10
jb 0x4074f0
mov eax, dword [ebp - 4]
sub dword [ebp - 8], 0xffffff80
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x80
jb 0x4074e0
mov ecx, 0x50
lea edi, [esi + 0x3bc]
lea ebx, [ecx - 0x4c]
jmp 0x407550
mov eax, edi
mov edx, 0x10
jmp 0x407560
mov word [eax], cx
mov word [eax + 2], 0x403
add eax, ebx
dec edx
jne 0x407560
add ecx, 0x28
add edi, 0x40
cmp ecx, 0x438
jb 0x407550
pop edi
mov dword [esi + 0x3b8], 0x40070000
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408450
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [section..data]
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x20], 0x6a09e667
mov dword [eax + 0x24], 0xbb67ae85
mov dword [eax + 0x28], 0x3c6ef372
mov dword [eax + 0x2c], 0xa54ff53a
mov dword [eax + 0x30], 0x510e527f
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x38], 0x1f83d9ab
mov dword [eax + 0x3c], 0x5be0cd19
pop ebp
ret 4
Function at 0x408a40
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
and eax, 0x3f
mov byte [eax + esi + 0x40], 0x80
inc eax
push edi
cmp eax, 0x38
jbe 0x408a84
cmp eax, 0x40
je 0x408a76
mov edx, 0x40
sub edx, eax
push edx
lea ecx, [eax + esi + 0x40]
push 0
push ecx
call fcn.0095d660
add esp, 0xc
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
xor eax, eax
mov ecx, 0x38
sub ecx, eax
push ecx
lea edx, [eax + esi + 0x40]
push 0
push edx
call fcn.0095d660
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
add esp, 0xc
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], eax
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
mov edx, dword [ebp + 0xc]
lea ecx, [esi + 0x20]
mov dword [ebp + 8], 4
mov edi, edi
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
bswap ebx
bswap eax
mov dword [edx], ebx
mov dword [edx + 4], eax
add edx, 8
add ecx, 8
dec dword [ebp + 8]
jne 0x408ad0
xor eax, eax
pop edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebx
pop ebp
ret 8

Function at 0x408c60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.0095d7d1
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x408c8c
xor eax, eax
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x408c9b
mov eax, 1
pop ebp
ret 0xc

Function at 0x40ba10
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0x2002
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.0040eaf0
test al, al
jne 0x40ba3d
lea ecx, [ebp - 4]
call fcn.0040eb20
xor al, al
mov esp, ebp
pop ebp
ret 8
push esi
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x40ba5d
lea ecx, [ebp - 4]
call fcn.0040eb20
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push edi
push ecx
push eax
call fcn.0095d180
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push edx
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
lea ecx, [ebp - 4]
test eax, eax
je 0x40ba4f
mov dword [ebp - 4], 0
call fcn.0040eb20
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x40c5e0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret 8
Function at 0x40c600
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, 0xf0000000
je 0x40c612
and eax, 0x3fff
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret 8

Function at 0x40c6a0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040d020
cmp eax, 0xffffffff
je 0x40c6d0
test al, 0x10
jne 0x40c6d0
test al, 1
je 0x40c6d0
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x40c6d0
xor al, al
pop esi
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop esi
pop ebp
ret 4

Function at 0x40c710
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9c4538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [eax]
push esi
xor ecx, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov word [eax], cx
lea eax, [ebp - 0x244]
push eax
xor edx, edx
push 0x114
mov word [ebp - 0x244], dx
call edi
mov esi, eax
test esi, esi
je 0x40c81c
cmp esi, 0x114
jae 0x40c799
xor ecx, ecx
lea edx, [ebp - 0x244]
mov word [ebp - 0x1c], cx
mov ecx, dword [ebp + 8]
push edx
call fcn.00409ed0
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x18]
call fcn.00409cd0
mov dword [ebp - 4], 0
cmp esi, dword [ebp - 0x10]
jbe 0x40c7b6
push esi
lea ecx, [ebp - 0x18]
call fcn.00409a70
mov eax, dword [ebp - 0x18]
push eax
push esi
call edi
test eax, eax
je 0x40c810
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov word [edx + esi*2], cx
cmp word [edx], cx
je 0x40c7d8
nop
inc ecx
cmp word [edx + ecx*2], 0
jne 0x40c7d0
mov dword [ebp - 0x14], ecx
cmp ecx, eax
jne 0x40c810
dec esi
cmp esi, eax
jne 0x40c810
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x18]
push edx
call fcn.00409f40
mov eax, dword [ebp - 0x18]
push eax
call fcn.0095d9a1
add esp, 4
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0095d9a1
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
xor al, al
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40c930
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x9c30f8
push eax
mov dword fs:[0], esp
sub esp, 0x38
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40c968
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40c9a7
lea ecx, [ebp - 0x44]
call fcn.0040cce0
lea ecx, [ebp - 0x1c]
call fcn.00409cd0
push 0
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call fcn.0040d230
test al, al
jne 0x40c9b7
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0095d9a1
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x1c]
push ebx
mov ebx, dword [ebp - 0x24]
shr ebx, 4
push ecx
and bl, 1
call fcn.0095d9a1
mov ecx, dword [ebp - 0xc]
add esp, 4
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x40d020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40d034
or eax, eax
pop ebp
ret 4
Function at 0x40d980
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push 0x9c3120
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
call fcn.00409030
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov esi, eax
test esi, esi
jne 0x40d9cb
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
mov edx, 2
mul edx
seto cl
push ebx
neg ecx
or ecx, eax
push ecx
call fcn.0095d9b7
mov ebx, eax
add esp, 4
mov dword [ebp - 0x1c], ebx
push ebx
push esi
mov dword [ebp - 4], 0
call edi
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x40da83
cmp edi, esi
ja 0x40da83
lea ecx, [ebp - 0x28]
call fcn.00409cd0
xor eax, eax
xor esi, esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
cmp edi, eax
jbe 0x40da58
mov edi, 2
cmp word [ebx + edi - 2], 0
jne 0x40da4c
add eax, ebx
push eax
lea ecx, [ebp - 0x28]
call fcn.00409ed0
lea ecx, [ebp - 0x28]
lea eax, [esi + 1]
push ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
call fcn.004090d0
mov eax, edi
inc esi
add edi, 2
cmp esi, dword [ebp - 0x10]
jb 0x40da22
mov edi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x28]
push edx
call fcn.0095d9a1
push ebx
call fcn.0095d9a1
add esp, 8
cmp dword [ebp - 0x14], edi
pop ebx
pop edi
sete al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push ebx
call fcn.0095d9a1
mov ecx, dword [ebp - 0xc]
add esp, 4
pop ebx
pop edi
xor al, al
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x40db00
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ecx]
push esi
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40db33
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40db33
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor edx, edx
add edx, esi
adc ecx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40dcf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [esi], 0
mov eax, dword [ebp + 0xc]
cmp eax, 0x400000
jbe 0x40dd13
mov eax, 0x400000
mov edx, dword [ebx]
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
push edi
push edx
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
add dword [esi], ecx
test eax, eax
je 0x40dd48
test ecx, ecx
je 0x40dd3f
add edi, ecx
sub dword [ebp + 0xc], ecx
jne 0x40dd04
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0xc