joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4018f4
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov byte [ebp - 4], dl
mov dword [ebp - 8], ecx
cmp byte [0x4c0799], dl
je 0x4019d8
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
xor ebx, ebx
push ebx
push ebx
push 0x418
push ecx
call esi
cmp byte [ebp - 4], bl
je 0x4019a1
mov eax, dword [0x4c60bc]
mov ecx, dword [eax + 0x1c]
cmp ecx, 0xffffffff
je 0x4019d5
push ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x2c], bl
mov byte [ebp - 0x2b], 1
mov byte [ebp - 0x2a], bl
mov byte [ebp - 0x29], bl
xor eax, eax
push 0x44
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x419
push dword [ebp - 8]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0x13
mov byte [ebp - 0x18], 4
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call esi
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
push ebx
mov edi, 0x443
push edi
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x20]
push eax
push ebx
push edi
push dword [ebp - 8]
call esi
mov byte [0x4c0799], 1
jmp 0x4019d5
push ebx
push 0x13
push 0x419
push dword [ebp - 8]
call esi
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x4019cf
push ebx
push eax
mov edi, 0x416
push edi
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 0xc]
push ebx
dec eax
push eax
push edi
push dword [ebp - 8]
call esi
mov byte [0x4c0799], bl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
lea ecx, [ebp - 0xc]
call fcn.00401f8e
mov eax, dword [ebp - 0xc]
xor ebx, ebx
cmp eax, ebx
jne 0x40202e
mov eax, 0x492538
push edi
push str.VirusGuard.exe
push eax
push 0x48df60
call fcn.0043b6af
mov dword [ebp - 4], eax
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop esi
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 0xc]
add esp, 0x18
mov dword [ebp - 0x60], esi
pop edi
cmp dword [ebp - 0xc], ebx
jne 0x40206d
mov eax, 0x492538
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x60]
push ecx
push eax
push ebx
push 8
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x402093
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [ebp - 0x1c]
cmp byte [ebp - 8], bl
je 0x4020a3
mov ecx, dword [ebp - 0xc]
call fcn.004433ab
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x402612
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x14], 0
jne 0x40265a
push esi
push 0x7c
call fcn.00443c1f
pop ecx
test eax, eax
je 0x402637
push dword [esp + 0xc]
mov ecx, eax
call fcn.004020e3
mov esi, eax
jmp 0x402639
xor esi, esi
mov eax, dword [esi + 0x24]
push dword [eax + 4]
mov ecx, esi
push 0x418
call fcn.0044e768
push 0
mov dword [edi + 0x14], esi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop edi
ret 4
Function at 0x4035c6
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
jbe 0x40367c
push ebx
push edi
mov edi, dword [ebp - 4]
mov eax, dword [esi + 0x30]
push dword [ebp + 8]
shl edi, 2
mov ebx, dword [edi + eax]
lea ecx, [ebx + 8]
call fcn.00402f39
test al, al
jne 0x403637
mov ebx, dword [ebx + 0x10]
test ebx, ebx
jne 0x403604
mov ebx, 0x492538
push 0x28
push dword [ebp + 8]
push ebx
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x40366b
mov eax, dword [esi + 0x30]
mov eax, dword [edi + eax]
add eax, 8
mov eax, dword [eax]
test eax, eax
jne 0x40362a
mov eax, 0x492538
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov eax, dword [esi + 0x30]
mov ebx, dword [edi + eax]
dec dword [esi + 0x38]
mov eax, dword [esi + 0x38]
sub eax, dword [ebp - 4]
mov ecx, dword [esi + 0x30]
shl eax, 2
push eax
add ecx, edi
lea eax, [ecx + 4]
push eax
push ecx
call sub.MSVCRT.dll_memmove
add esp, 0xc
test ebx, ebx
je 0x403668
mov ecx, ebx
call fcn.00410b42
push ebx
call fcn.00443478
pop ecx
dec dword [ebp - 4]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x38]
jb 0x4035dd
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x410b76
Capabilities:
Create directory

Disassembly:
push ebx
push esi
call fcn.0041099f
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x410b8a
mov eax, 0x492538
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x410ba3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x410ba5
mov bl, 1
mov ecx, esi
call fcn.004433ab
pop esi
mov al, bl
pop ebx
ret

Function at 0x410c6f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
mov ebx, 0x492538
test eax, eax
jne 0x410c89
mov eax, ebx
mov ecx, dword [0x4c0910]
push eax
call fcn.0040311e
mov dword [ebp - 4], eax
test eax, eax
jne 0x410cbe
mov ecx, dword [0x4c0910]
call fcn.00418e33
mov eax, dword [esi]
test eax, eax
jne 0x410caf
mov eax, ebx
mov ecx, dword [0x4c0910]
push eax
call fcn.0040311e
mov dword [ebp - 4], eax
mov eax, dword [esi]
test eax, eax
jne 0x410cc6
mov eax, ebx
push edi
mov ecx, eax
call fcn.0041366d
mov eax, dword [esi + 8]
mov edi, eax
test eax, eax
jne 0x410cd9
mov edi, ebx
mov ecx, dword [0x4c0910]
push 2
lea eax, [ebp - 8]
push eax
call fcn.0044fb0f
push eax
push edi
lea ecx, [ebp - 0xa8]
call fcn.00451c89
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x84]
test ecx, ecx
je 0x410d2f
push 0x43
call fcn.00439cf8
push eax
lea ecx, [ebp - 0x30]
call fcn.00451b35
lea ecx, [ebp - 0x30]
call fcn.004518a8
lea ecx, [ebp - 0x30]
test eax, eax
je 0x410d2a
call fcn.00451849
jmp 0x410d81
call fcn.00451849
lea ecx, [ebp - 0xa8]
call fcn.00451e58
mov edi, eax
test edi, edi
je 0x410d81
push 0x100
lea edx, [ebp - 0x2a8]
mov ecx, edi
call fcn.00467928
mov eax, dword [esi]
test eax, eax
jne 0x410d5a
mov eax, ebx
push 0
push 0
push edi
lea ecx, [ebp - 0x2a8]
push ecx
push eax
push str.The_install_of__s_failed._n__s__d_.
call fcn.0043b6af
add esp, 0x10
push eax
push dword [0x4c5f4c]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esi + 8]
pop edi
test eax, eax
jne 0x410d8b
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ecx, esi
call fcn.00410b21
push esi
call fcn.00443478
pop ecx
lea ecx, [ebp - 0xa8]
call fcn.00451aaf
xor ecx, ecx
call fcn.004433ab
pop esi
pop ebx
leave
ret
Function at 0x41209e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push esi
push edi
lea eax, [ebp - 0x410]
push eax
mov esi, 0x104
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea eax, [ebp - 0x618]
push eax
push 0
push 0x48f6d4
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
test eax, eax
jne 0x4120fe
call sub.MSVCRT.dll_rand
push eax
call sub.MSVCRT.dll_rand
push eax
push str.c:_u_u.tmp
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.0043b5e6
add esp, 0x14
test edi, edi
je 0x412169
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x412107
sub eax, edx
sar eax, 1
mov ecx, 0x103
sub ecx, eax
push ecx
lea edx, [ebp - 0x618]
lea ecx, [ebp - 0x208]
call fcn.00411960
mov eax, edi
mov edx, edi
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x412132
sub eax, edx
lea edi, [ebp - 0x208]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x412146
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x208]
jmp 0x41216f
lea ecx, [ebp - 0x618]
call fcn.00443bc8
pop edi
pop esi
leave
ret

Function at 0x414294
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov esi, ecx
push esi
call edi
mov ebx, eax
test ebx, ebx
jne 0x4142ca
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x4142ca
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push esi
call edi
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x4160c1
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0x4160c9
xor al, al
jmp 0x4160e4
xor eax, eax
push esi
mov esi, dword [esp + 8]
mov edx, eax
xor edx, 3
mov dl, byte [edx + ecx]
mov byte [eax + esi], dl
inc eax
cmp eax, 0x14
jne 0x4160cc
mov al, 1
pop esi
ret 4

Function at 0x4160e7
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov edx, dword [esp + 8]
mov ecx, eax
xor ecx, 3
mov cl, byte [ecx + edx]
mov edx, dword [esp + 4]
mov byte [eax + edx], cl
inc eax
cmp eax, 0x14
jne 0x4160e9
ret 8
Function at 0x419162
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4191ac
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
test eax, eax
je 0x4191a8
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push 0xffffffffffffff9d
push 0xffffffffffffff9d
push 0x184
call esi
push eax
push str.IO_Error:_d_line:_d_align:_d_pos:_Ld_count:_d_actual:_d
call fcn.004875bd
add esp, 0x20
call esi
jmp 0x4191dc
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jae 0x4191da
push eax
push dword [ebp + 0xc]
mov esi, 0x490
push 0xffffffffffffffff
push 0xffffffffffffff9d
push 0xffffffffffffff9d
push 0x188
push esi
push str.IO_Error:_d_line:_d_align:_d_pos:_Ld_count:_d_actual:_d
call fcn.004875bd
add esp, 0x20
mov eax, esi
jmp 0x4191dc
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x41b596
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [edi + 0x10]
push ebx
xor ebx, ebx
lea eax, [edi + 0x2c]
mov dword [eax], ebx
push esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
mov byte [ebp - 1], bl
mov dword [ebp - 0xc], ebx
cmp dword [ecx + 8], ebx
je 0x41b6a0
mov dword [ebp - 8], ebx
mov esi, dword [ecx]
add esi, dword [ebp - 8]
test byte [esi + 0x21], 4
je 0x41b63c
cmp byte [esi + 0x20], bl
je 0x41b67a
push dword [esi + 4]
mov ecx, dword [edi + 0x10]
push dword [esi]
add ecx, 0x2c
push dword [esi + 0xc]
push dword [esi + 8]
push ebx
call fcn.0041b419
cmp eax, 0xffffffff
jne 0x41b62e
push ebx
push 1
push ebx
push dword [ebp - 0x10]
mov eax, esi
push dword [edi + 0x10]
push 1
call fcn.0041930b
cmp eax, 0xffffffff
je 0x41b6ba
push dword [esi + 4]
mov eax, dword [0x4c280c]
push dword [esi]
mov dword [esi + 0x14], eax
push dword [esi + 0xc]
mov eax, dword [esi + 0x30]
push dword [esi + 8]
mov ecx, dword [edi + 0x10]
add ecx, 0x2c
push eax
call fcn.0041b419
cmp eax, ebx
jne 0x41b6be
and byte [esi + 0x21], 0xfb
jmp 0x41b67a
cmp byte [esi + 0x20], bl
jne 0x41b67a
cmp byte [0x4c0e9a], bl
je 0x41b67a
push ebx
push 1
push 1
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x10]
mov eax, esi
push ebx
call fcn.0041930b
cmp eax, 0xffffffff
jne 0x41b685
mov eax, dword [ebp - 0x14]
cmp eax, 0xdf
je 0x41b676
cmp eax, 2
je 0x41b676
cmp eax, 3
jne 0x41b6be
or byte [esi + 0x21], 4
mov al, byte [esi + 0x21]
shr al, 2
and al, 1
or byte [ebp - 1], al
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], 0x34
cmp eax, dword [ecx + 8]
jne 0x41b5c0
cmp byte [ebp - 1], bl
jne 0x41b6ba
mov ecx, dword [edi + 0x10]
add ecx, 0x2c
call fcn.0044442e
mov ecx, dword [edi + 0x10]
call fcn.0041de3e
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x41b6ba
Function at 0x41bb67
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov edi, ecx
mov esi, str.kernel32
mov edx, str.TryEnterCriticalSection
mov ecx, esi
call fcn.00444ab7
push str.ntdll
mov dword [0x4c0e40], eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
push str.NtSetInformationFile
push eax
mov dword [0x4c0e30], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edx, str.SetFileValidData
mov ecx, esi
mov dword [0x4c3dd0], eax
call fcn.00444ab7
xor esi, esi
mov dword [0x4c0e3c], eax
cmp eax, esi
je 0x41bbd1
push 2
pop edx
mov ecx, str.SeManageVolumePrivilege
call fcn.00444dcc
mov byte [0x4c0e64], al
push esi
push esi
push esi
push esi
mov dword [0x4c0e80], esi
mov dword [0x4c0e84], 0x4c0e80
mov dword [0x4c0e90], esi
mov dword [0x4c0e94], 0x4c0e90
mov dword [0x4c0e88], esi
mov dword [0x4c0e8c], 0x4c0e88
mov dword [0x4c0e78], esi
mov dword [0x4c0e7c], 0x4c0e78
mov dword [0x4c0e60], esi
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov edx, 0x490954
mov ecx, 0x4c0e44
mov dword [0x4c0e5c], eax
call fcn.0041d94b
mov edx, 0x490950
mov ecx, 0x4c2c54
call fcn.0041d94b
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatus]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x8000000
jae 0x41bc5f
mov ecx, 0x800000
jmp 0x41bc6d
shr eax, 4
mov ecx, 0x2000000
cmp eax, ecx
jae 0x41bc6d
mov ecx, eax
lea eax, [ebp - 4]
push eax
push esi
push edi
push 0x41bb4e
push esi
push esi
push str.IOThread
mov dword [0x4c0e68], ecx
mov byte [edi], 1
call fcn.0041d7dd
mov dword [edi + 4], eax
pop edi
pop esi
leave
ret

Function at 0x41bd78
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
and dword [edi], 0
push dword [ebp + 8]
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x41bdf1
cmp word [ebx + 8], 2
jne 0x41bdce
cmp word [ebx + 0xa], 4
jne 0x41bdce
mov esi, dword [ebx + 0xc]
jmp 0x41bdc8
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0041bd11
mov dword [edi], eax
test eax, eax
je 0x41bdec
lea edi, [eax + 0x1c]
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x41bdac
mov esi, dword [ebp + 0x18]
push 0x400
push dword [ebx]
push esi
call sub.MSVCRT.dll_strncpy
add esp, 0xc
mov byte [esi + 0x400], 0
xor eax, eax
jmp 0x41be17
push 8
pop eax
jmp 0x41be17
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x41be17
dec ecx
je 0x41be12
dec ecx
je 0x41be0b
dec ecx
jmp 0x41be17
mov eax, 0x2afb
jmp 0x41be17
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x41c3f1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
cmp dword [0x4c0fdc], 0
mov dword [ebp - 0x18], str.getaddrinfo
mov dword [ebp - 0x14], 0x41bfaf
mov dword [ebp - 0x10], str.getnameinfo
mov dword [ebp - 0xc], 0x41c239
mov dword [ebp - 8], str.freeaddrinfo
mov dword [ebp - 4], fcn.0041bf7a
jne 0x41c54d
push 0x104
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
je 0x41c543
xor eax, eax
mov cl, byte [ebp + eax - 0x22c]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x41c44d
push edi
lea edi, [ebp - 0x124]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41c468
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push esi
mov esi, str.ws2_32
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x124]
push eax
movsd dword es:[edi], dword [esi]
call ebx
mov esi, eax
test esi, esi
je 0x41c4ab
push str.getaddrinfo
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
jne 0x41c4a7
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor esi, esi
test esi, esi
jne 0x41c502
xor eax, eax
mov cl, byte [ebp + eax - 0x22c]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x41c4ad
lea edi, [ebp - 0x124]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41c4c7
mov esi, str.wship6
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x124]
push eax
movsd dword es:[edi], dword [esi]
call ebx
mov esi, eax
test esi, esi
je 0x41c540
push str.getaddrinfo
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
jne 0x41c4fe
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor esi, esi
test esi, esi
je 0x41c540
xor edi, edi
push dword [ebp + edi*8 - 0x18]
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp + edi*8 - 0x14], eax
test eax, eax
je 0x41c51f
inc edi
cmp edi, 3
jl 0x41c504
jmp 0x41c528
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor esi, esi
test esi, esi
je 0x41c540
xor eax, eax
mov ecx, dword [ebp + eax - 0x14]
mov dword [eax + 0x4b3d44], ecx
add eax, 8
cmp eax, 0x18
jl 0x41c52e
pop esi
pop ebx
pop edi
mov dword [0x4c0fdc], 1
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x4b3d44]
leave
ret 4
Function at 0x41d7dd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x20]
push edi
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ebx, dword [esi]
mov dword [ebp + 0x20], eax
mov eax, dword [ebp + 8]
mov edi, 0x4c1240
mov ecx, edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
call fcn.0041d68f
push dword [0x4c2280]
mov ecx, dword [0x4c2278]
push 0
lea edx, [ebp - 8]
call fcn.0041d621
mov esi, eax
mov eax, dword [0x4c2280]
cmp eax, dword [0x4c227c]
jb 0x41d847
mov ecx, 0x4c2278
call fcn.00402559
mov eax, dword [0x4c2280]
mov ecx, dword [0x4c2278]
sub eax, esi
inc dword [0x4c2280]
shl eax, 3
shl esi, 3
add ecx, esi
push eax
push ecx
add ecx, 8
push ecx
call sub.MSVCRT.dll_memmove
mov eax, dword [0x4c2278]
mov ecx, dword [ebp - 4]
mov dword [esi + eax], ebx
mov eax, dword [0x4c2278]
mov dword [esi + eax + 4], ecx
add esp, 0xc
mov ecx, edi
call fcn.0041d70d
mov eax, dword [ebp + 0x20]
pop edi
pop esi
pop ebx
leave
ret 0x1c

Function at 0x41de3e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0x18]
push dword [esi + 0x14]
push str.uTorrentPartFile__LX.dat
call fcn.0043b6af
mov ecx, dword [esi + 0x1c]
add esp, 0xc
mov edx, eax
call fcn.00443dff
mov ecx, eax
pop esi
jmp fcn.0043a2b7

Function at 0x41de86
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
and al, 1
movzx eax, al
push esi
push eax
call fcn.00443ec2
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
shr ebx, 1
mov esi, eax
and bl, 1
movzx eax, bl
push eax
call fcn.00443ec2
and dword [ebp + 8], 0
mov ecx, esi
mov ebx, eax
call fcn.00444795
test al, al
je 0x41defd
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_MoveFileW]
push ebx
push esi
call edi
test eax, eax
jne 0x41defc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp + 8], eax
cmp eax, 3
jne 0x41defc
and dword [ebp + 8], 0
mov ecx, ebx
call fcn.004451ba
test al, al
je 0x41def3
push ebx
push esi
call edi
test eax, eax
jne 0x41defc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp + 8], eax
pop edi
mov ecx, esi
call fcn.004433ab
mov ecx, ebx
call fcn.004433ab
mov eax, dword [ebp + 8]
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41e564
Capabilities:
Delete directory
Delete file

Disassembly:
push ecx
push ebx
push ebp
xor ebp, ebp
mov ebx, ecx
mov dword [esp + 8], ebp
cmp dword [ebx + 8], ebp
je 0x41e63c
push esi
push edi
mov esi, dword [ebx]
mov ecx, dword [ebx + 0x1c]
add esi, ebp
mov edx, dword [esi + 0x18]
push 0
call fcn.00443ec2
mov edi, eax
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x41e590
sub eax, ecx
sar eax, 1
mov ecx, eax
mov eax, dword [esi + 0x18]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x41e5a6
sub eax, edx
sar eax, 1
sub ecx, eax
lea esi, [edi + ecx*2 - 2]
jmp 0x41e611
xor ecx, ecx
push edi
mov word [eax], cx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x41e611
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x91
jne 0x41e611
push 0
mov edx, str.thumbs.db
mov ecx, edi
call fcn.00443ec2
mov ecx, eax
call fcn.0043a2b7
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
je 0x41e61f
push edi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x41e611
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x91
je 0x41e61f
push 0x5c
push edi
call sub.MSVCRT.dll_wcsrchr
pop ecx
pop ecx
cmp eax, esi
jae 0x41e5bc
mov ecx, edi
call fcn.004433ab
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
add ebp, 0x34
cmp eax, dword [ebx + 8]
jne 0x41e57a
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x41ee2d
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
mov esi, ecx
call fcn.0041e3d7
cmp byte [esi + 0x24], 0
mov ebx, dword [ebp + 8]
lea edi, [esi + 0x1c]
push ebx
jne 0x41eead
mov edx, dword [esi]
mov al, byte [edx + 0x21]
push dword [ebp + 0xc]
mov ecx, dword [edi]
mov edx, dword [edx + 0x18]
and al, 8
movzx eax, al
neg eax
sbb eax, eax
and eax, 3
call fcn.0041de86
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
mov dword [ebp + 8], eax
call fcn.00443bc8
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.0041ed9f
mov eax, dword [ebp - 4]
test eax, eax
jne 0x41eea6
call fcn.00428703
mov edx, ebx
mov ecx, edi
call fcn.00439b86
mov ecx, esi
call fcn.0041ed57
call fcn.00428714
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
push dword [edi]
push str.Moving_files_from__s_to__s
call fcn.004875bd
add esp, 0xc
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x41ee8a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
je 0x41eee8
mov ecx, ebx
call fcn.004451ba
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x41ee8a
push ebx
mov ecx, esi
call fcn.0041e6e8
jmp 0x41ee86