joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406944
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x800
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004062a5
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x4069b6
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x7fe], ax
pop esi
jne 0x4069b6
cmp dword [ebp + 0x18], 1
je 0x4069bb
cmp dword [ebp + 0x18], 2
je 0x4069bb
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x4069c0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406a23
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 8], 0x73006e
mov dword [ebp - 4], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406a6d
test edi, edi
jne 0x406a30
mov word [esi], ax
jmp 0x406a6f
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x406b6a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406b8c
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x406e09
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x430c2c], 0
push esi
jne 0x406e43
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x406e1a
mov dword [ecx*4 + 0x430c28], edx
inc ecx
cmp ecx, 0x100
jl 0x406e15
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x406e6d
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x430c28]
inc esi
sub edx, 1
jne 0x406e55
not ecx
mov eax, ecx
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40ceda
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x23426913
xor eax, 0xb5a278a3
adc ebp, dword [ecx + 0x42]
and esi, dword [0xb5a278a3]
and dword [ecx - 0xd], edx
call 0xb47ce175
adc dl, byte [ebx + edi + 0x2f84c9b1]
mov cl, 0xc9
test byte [edi], ch
mov cl, 0xc9
test byte [edi], ch
xor eax, 0xe82684db
les ebx, [eax + edx]
mov ah, pe_nt_image_headers32
aad 0x3b
cwde
xchg dword [esi + 0x3bd5db35], edx
cmp al, 0xda
mov ah, 0x30
dec ecx
inc esi
or esi, esp
mov dh, 0xc4
adc al, 0x72
je 0x40cec6
enter 0xffffffffffffe818, 0xffffffffffffffac
or edi, dword [edx]
in al, 0x46
enter 0xffffffffffffe8e3, 0xffffffffffffffdf
enter 0xffffffffffff8837, 0xffffffffffffffc6
sub bl, bl
cmc
sbb edx, dword [edi]
jno 0x40cf8c
sti
dec eax
xor eax, 0x897d09b
mov ebx, 0x97d5ec84
xlatb
out 0x78, al
mov dword [0xc5b6f715], eax
pushfd
push ss
jo 0x40cec5
div bh
out dx, eax
pop ds
or ch, dh
pop ebx
pop ecx
cmp word [edi - 0x20], si
dec ecx
js 0x40cf81
adc ecx, dword [eax + 0x37041a09]
inc esp
push edi
mov edx, 0xc4154337
loopne 0x40cf86
xlatb
enter 0xffffffffffff84fd, 0xffffffffffffffd4
clc
cmp edx, esp
mov esp, esp
and al, 0x29
invalid
movsd dword es:[edi], dword [esi]
adc al, 0xd4
call 0x6f4594c3
lds eax, [edi + ebp*2]
lds ebp, [edi]
daa
invalid
Function at 0x4ba905
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33a8
cmp edx, dword [eax]
je 0x4ba927
add eax, 8
inc ecx
cmp eax, 0x4c3438
jl 0x4ba918
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33a8]
jne 0x4baa55
mov eax, dword [0x4c7d2c]
cmp eax, 1
je 0x4baa2f
test eax, eax
jne 0x4ba958
cmp dword [0x4c32d4], 1
je 0x4baa2f
cmp edx, 0xfc
je 0x4baa55
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba98f
lea eax, [ebp - 0x1a4]
push 0x4bfb78
push eax
call fcn.004bb2f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb780
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba9d2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb780
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfb74
push edi
call fcn.004bd650
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bfb58
push eax
call fcn.004bb2f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb300
lea eax, [ebp - 0xa0]
push 0x4bfb54
push eax
call fcn.004bb300
push dword [esi + 0x4c33ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb300
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bfb2c
push eax
call fcn.004bd5c4
add esp, 0x2c
pop edi
jmp 0x4baa55
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33ac]
push 0
push eax
push dword [esi]
call fcn.004bb780
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401497
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x424cb0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40152c
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x4014e9
cmp dword [ebp + 0x10], ebx
jne 0x401520
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00401497
test eax, eax
jne 0x4014fb
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014d0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405a30
cmp eax, ebx
je 0x401533
push ebx
push dword [0x424cb0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x40152c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x424cb0], ebx
jne 0x401529
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x401529
jmp 0x40152c
Function at 0x402d25
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x41bd7c]
sub esi, dword [0x41fd88]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x1f4
xor ebx, ebx
mov dword [0x424c20], eax
cmp esi, ebx
jle 0x402e83
push dword [0x41fd84]
call fcn.00402d0e
push ebx
push ebx
push dword [0x41fd88]
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41bd78], esi
mov dword [0x40bcec], ebx
mov ebp, 0x413d78
mov eax, dword [0x41fd80]
sub eax, dword [0x41fd84]
mov edi, 0x4000
cmp eax, edi
jg 0x402d9a
mov edi, eax
push edi
mov esi, 0x41bd80
push esi
call fcn.00402cdc
test eax, eax
je 0x402e95
add dword [0x41fd84], edi
mov dword [0x413d08], esi
mov dword [0x413d0c], edi
cmp dword [0x424bcc], ebx
je 0x402df1
cmp dword [0x424ca0], ebx
jne 0x402df1
mov eax, dword [0x41bd78]
sub eax, dword [0x41bd7c]
push ebx
sub eax, dword [esp + 0x1c]
add eax, dword [0x41fd88]
mov dword [0x40bcec], eax
call fcn.00402c3d
pop ecx
mov ecx, 0x413cf0
mov dword [0x413d10], ebp
mov dword [0x413d14], 0x8000
call fcn.004066fd
test eax, eax
js 0x402e9a
mov esi, dword [0x413d10]
sub esi, ebp
je 0x402e4f
push ebx
lea eax, [esp + 0x14]
push eax
push esi
push ebp
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402e9f
cmp esi, dword [esp + 0x10]
jne 0x402e9f
add dword [0x41fd88], esi
cmp dword [0x413d0c], ebx
jne 0x402dc0
jmp 0x402e5b
cmp dword [0x413d0c], ebx
jne 0x402e9a
cmp edi, ebx
je 0x402e9a
mov eax, dword [0x41bd7c]
mov ecx, eax
sub ecx, dword [0x41fd88]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x402d84
push ebx
push ebx
push eax
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
call fcn.00402c3d
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
or eax, 0xffffffff
jmp 0x402e8d
push 0xfffffffffffffffd
pop eax
jmp 0x402e8d
push 0xfffffffffffffffe
jmp 0x402e9c
Function at 0x402ea3
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402ecd
add eax, dword [0x424c18]
push edi
push edi
push eax
push dword [0x40a014]
mov dword [0x41bd7c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00402d25
cmp eax, edi
jl 0x402fc6
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push dword [0x40a014]
call ebx
test eax, eax
je 0x402fc2
cmp dword [ebp - 4], esi
jne 0x402fc2
push dword [ebp + 8]
add dword [0x41bd7c], esi
call fcn.00402d25
mov dword [ebp - 8], eax
cmp eax, edi
jl 0x402fc5
cmp dword [ebp + 0x10], edi
jne 0x402f91
cmp dword [ebp + 8], edi
jle 0x402fbd
mov esi, 0x41bd80
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x402f41
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x40a014]
call ebx
test eax, eax
je 0x402fc2
cmp edi, dword [ebp - 4]
jne 0x402fc2
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402f8d
cmp dword [ebp + 0x14], edi
jne 0x402f8d
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x41bd7c], eax
cmp dword [ebp + 8], 0
jg 0x402f34
jmp 0x402fbd
push 0xfffffffffffffffe
jmp 0x402fc4
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x402f9c
mov eax, dword [ebp + 0x14]
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a014]
call ebx
test eax, eax
je 0x402fc2
mov eax, dword [ebp - 4]
add dword [0x41bd7c], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x402fc5
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x402fcc
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0xc], ebx
cmp eax, ebx
jl 0x402ffb
add eax, dword [0x424c18]
push ebx
push ebx
push eax
push dword [0x40a014]
mov dword [0x41bd7c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00402d25
cmp eax, ebx
jl 0x4030c5
push ebx
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4030c2
cmp dword [ebp - 4], esi
jne 0x4030c2
push dword [ebp + 8]
add dword [0x41bd7c], esi
call fcn.00402d25
mov dword [ebp - 8], eax
cmp eax, ebx
jl 0x4030c5
cmp dword [ebp + 8], ebx
jle 0x4030b9
mov esi, 0x41bd80
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x40305f
mov edi, dword [ebp + 8]
push ebx
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4030c2
cmp edi, dword [ebp - 4]
jne 0x4030c2
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push esi
call fcn.00406681
add esp, 0x10
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4030be
cmp dword [ebp - 0x10], edi
jne 0x4030be
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x41bd7c], eax
cmp dword [ebp + 8], ebx
jg 0x403052
mov eax, dword [ebp - 8]
jmp 0x4030c5
push 0xfffffffffffffffe
jmp 0x4030c4
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4055bc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x4221d0
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x4221d0], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4055f7
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x40576a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405787
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x40578a
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [eax + 1]
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4057b9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4057fd
test edi, edi
jne 0x4057c4
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4057f7

Function at 0x405801
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405872
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x400
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405861
cmp dword [ebp + 0x14], 1
je 0x405863
cmp dword [ebp + 0x14], 2
je 0x405863
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405aed
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x422218
push esi
call fcn.00405918
push esi
call fcn.004056c7
mov edi, eax
test edi, edi
jne 0x405b0e
xor eax, eax
jmp 0x405b66
push edi
call fcn.0040596e
test byte [0x424c28], 0x80
je 0x405b27
mov al, byte [edi]
test al, al
je 0x405b0a
cmp al, 0x5c
je 0x405b0a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x405b47
push esi
call fcn.00405a09
test eax, eax
je 0x405b41
test byte [eax], 0x10
je 0x405b6b
push esi
call fcn.00405ac6
push esi
call ebx
cmp eax, edi
jg 0x405b32
push esi
call fcn.00405a99
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x405b65
Function at 0x405e12
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405a30
mov esi, dword [esp + 0x18]
test eax, eax
je 0x405e36
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405f6f
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x422618], 0x4c554e
mov edi, 0x400
mov ebp, 0x422618
test esi, esi
je 0x405e7a
push 1
push 0
push esi
call fcn.0040578a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405f75
cmp eax, edi
jg 0x405f75
push edi
mov esi, 0x422f58
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405f75
cmp eax, edi
jg 0x405f75
push esi
push ebp
push str._s_s_r_n
push 0x422a18
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x424bcc]
push dword [eax + 0x128]
push esi
call fcn.00405bc5
push 4
push 0xc0000000
push esi
call fcn.0040578a
mov ebp, eax
mov dword [esp + 0x14], ebp
cmp ebp, 0xffffffff
je 0x405f6f
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405f68
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405f68
cmp edi, dword [esp + 0x18]
jne 0x405f68
push str._Rename__r_n
push esi
call fcn.00405b6f
test eax, eax
jne 0x405f7c
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call fcn.00405918
add edi, 0xa
mov eax, edi
push ebx
push 0x422a18
add eax, esi
push eax
call fcn.0040571a
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x424c90]
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x408674
add eax, 0xa
push eax
call fcn.00405b6f
test eax, eax
je 0x405f33
inc eax
lea ecx, [esi + edi]
mov ebp, eax
cmp eax, ecx
jae 0x405fa3
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405f98
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405f35
Function at 0x405fad
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00405aed
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x405fe2
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x424c88], eax
jmp 0x406173
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x405ffd
test eax, eax
je 0x40611e
test cl, 2
je 0x40611e
push edi
push ebx
mov esi, 0x423358
push esi
call fcn.00405918
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x406020
push str..
push esi
call edi
jmp 0x406026
push ebx
call fcn.00405ac6
cmp byte [ebx], 0
jne 0x406034
cmp byte [0x423358], 0x5c
jne 0x40603c
push 0x4082d0
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebx + eax]
lea eax, [ebp - 0x148]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x406113
lea esi, [ebp - 0x11c]
push 0x3f
mov eax, esi
push eax
call fcn.00405683
cmp byte [eax], 0
je 0x40607e
cmp byte [ebp - 0x18], 0
je 0x40607e
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x406094
mov al, byte [esi + 1]
test al, al
je 0x4060f2
cmp al, 0x2e
jne 0x406094
cmp byte [esi + 2], 0
je 0x4060f2
push esi
push edi
call fcn.00405918
test byte [ebp - 0x148], 0x10
je 0x4060b9
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4060f2
push dword [ebp + 0xc]
push ebx
call fcn.00405fad
jmp 0x4060f2
push ebx
call fcn.0040576a
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4060ea
test byte [ebp + 0xc], 4
je 0x4060e2
push ebx
push 0xfffffffffffffff1
call fcn.00404979
push 0
push ebx
call fcn.00405e12
jmp 0x4060f2
inc dword [0x424c88]
jmp 0x4060f2
push ebx
push 0xfffffffffffffff2
call fcn.00404979
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406060
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40611d
mov byte [edi - 1], 0
pop edi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x406172
cmp dword [ebp - 8], esi
je 0x406162
push ebx
call fcn.00405a09
test eax, eax
je 0x406172
push ebx
call fcn.00405a99
push ebx
call fcn.0040576a
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40616a
test byte [ebp + 0xc], 4
je 0x406162
push ebx
push 0xfffffffffffffff1
call fcn.00404979
push esi
push ebx
call fcn.00405e12
jmp 0x406172
inc dword [0x424c88]
jmp 0x406172
push ebx
push 0xffffffffffffffe5
call fcn.00404979
pop esi
pop ebx
leave
ret 8
Function at 0x40624d
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x124
mov esi, eax
lea eax, [ebp - 0x124]
push 0
push eax
mov dword [ebp - 0x128], 0x128
call fcn.00407159
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
push esi
or edi, 0xffffffff
call sub.KERNEL32.dll_Process32First
jmp 0x4062ad
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp + 8]
je 0x4062b3
lea eax, [ebp - 0x128]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x406295
jmp 0x4062b9
mov edi, dword [ebp - 0x110]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x4062c6
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push esi
push edi
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x124
mov esi, eax
lea eax, [ebp - 0x124]
push edi
push eax
mov dword [ebp - 0x128], 0x128
call fcn.00407159
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
push esi
call sub.KERNEL32.dll_Process32First
jmp 0x406323
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp + 8]
je 0x406329
lea eax, [ebp - 0x128]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40630b
jmp 0x40633c
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edi, edi
inc edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret