joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9e5f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9e5f8c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9e5f52
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9e5ff0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9e6042
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9e6048
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9fe535
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009fe1f5

Function at 0xa03331
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a031b0

Function at 0xa088e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa0890d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa0890d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40b59a
Capabilities:
Encode data using xor

Disassembly:
pop ss
stc
adc esp, eax
rcl byte [0x9af7c057], cl
mov eax, 0xb0ec49dd
rcl byte [edx + ebp - 0x5e], cl
mov dl, byte [esi + 0x73]
adc eax, 0x96ae6ba0
imul ebp, dword [esi - 0x5c2e5e6a], 0xffffffb0
adc byte [eax], dh
wait
adc byte [edi + 0x14], bl
ja 0x40b579
cdq
inc edx
xor al, 0xd2
Function at 0x40d0f2
Capabilities:
Encode data using xor

Disassembly:
sub dl, byte [esi - 0x47]
jp 0x40d0e9
pop edx
loopne 0x40d0c8
add ch, dh
out dx, al
lcall 0x762a, 0x562623a6
sub bl, byte [ecx - 0x7f]
cmpsb byte [esi], byte es:[edi]
and esp, dword [esi]
push esi
sub dh, byte [esi + 0x2a]
pop ecx
xor esi, 0x7a265a26
ljmp 0xdb90
mul byte [esi]
pop edx
jp 0x40d0c1
pop ebx
jbe 0x40d0c5
nop
fstp xword [edx + 3]
jne 0x40d0f7
dec eax
add byte [eax + 0x61], 0xd6
xor byte [ecx], dh
mov word [eax + 0x56], es
inc eax
push esi
xor al, 0x5c
and al, 0x33
lodsb al, byte [esi]
jb 0x40d0e8
push 0x605ea66f
adc al, 0xe4
cmpsb byte [esi], byte es:[edi]
sub al, byte [ecx - 0x68d90eff]
sub eax, 0x5acf01b0
insb byte es:[edi], dx
push ebx
mov esi, esi
jne 0x40d131
pop ss
sub al, 0x27
mov esi, 0x46c02496
add dl, byte [ebp + 0x35d3f76f]
sbb edi, edx
pop es
sub edx, ebx
shr dword [ebx + 0x6e], 0x9f
salc
mov eax, dword [edx]
jle 0x40d136
xor ah, al
jbe 0x40d0be
leave
jo 0x40d145
xlatb
rcl byte [edx + 1], 0x35
in eax, dx
stosb byte es:[edi], al
push edx
add dword [0x3aa64ed], esi
and cl, byte [ecx]
add dword [esi + 0x4d], eax
stosb byte es:[edi], al
add esp, dword [edx]
or dword [ecx], eax
inc esi
dec ebp
jbe 0x40d0d1
jecxz 0x40d159
push edx
mov eax, 0xd113f544
adc edx, ecx
adc al, 0xb5
ja 0x40d181
or bh, byte [eax + 0xba22d3c]
pop ecx
adc eax, 0x265544b6
inc esi
inc esi
sub ebx, dword [edx]
adc byte [ecx + 0x10], bl
xchg esi, eax
daa
inc edx
xor eax, dword [ecx]
xor eax, 0x88251746
and dword [0x8d2444e0], edx
or dword [esi + 0x1e], 0x45
adc byte [esp], al
push es
sub dword [edx + 0x37], ebx
add eax, 0x967475e0
push es
and al, 0xb7
adc esp, dword [edi + edx]
and dword [edi + 0x60], ebp
inc esp
xchg ecx, eax
xor eax, edx
jo 0x40d1d1
add dword [edx], esp
sub al, 0x48
jp 0x40d160
jle 0x40d1c5
retf
jno 0x40d170
jb 0x40d224
mov ecx, 0x14a65de
inc edi
scasb al, byte es:[edi]
loop 0x40d231
pop edi
adc eax, 0x185e568c
mov fs, word [ebp + 0x10ae764a]
insd dword es:[edi], dx
xor dword [edx + 0x5e48c2c2], eax
xlatb
and ebx, esi
pop esi
or dl, byte [edx + 0x50ca5fd8]
fldcw word [ecx + 4]
pop esi
add al, 0x2d
sbb dh, byte [ecx]
bound ecx, qword [edi]
pop edx
in al, dx
pop ds
and cl, byte [eax + 0x5e]
mov dword [esi - 0x62f3bcc4], edi
test byte [edi + 0x5d], bl
pop ebp
sub al, 2
ror dword [esi + 0x71d95288], cl
sbb byte [ebp + 0x1a], cl
xchg edi, eax
call 0x909e5f73
les ebx, [ecx + 0x18577432]
xor dh, byte [edi + edx*2 + 0x18]
push edi
inc eax
jae 0x40d247
pop edx
inc eax
mov dl, 0x1a
dec edi
imul edi, dword [edx], 0xf38fca1d
sbb al, 0x25
fcomp dword [esi + 0x19]
pop ebp
retf 0xa85e
pop esi
sbb dword [ebp - 0x36], ebx
pop esi
test al, 0xef
inc eax
sub al, 0x63
push edi
test al, 0x48
into
sbb byte [edi - 0x3d], dh
hlt
add eax, 0x36161148
clc
pop edx
sbb al, 0xf6
sbb byte [ebx - 0x74e68dfb], dl
xchg ebp, eax
sub bl, byte [0x8a5e2d81]
mov ch, 0xb5
inc edx
sbb eax, 0xf403f88e
dec esi
ror dword [ebp + 0x55], 1
jno 0x40d1f9
mov al, 0xd8
xchg esi, eax
cmc
pop esi
mov dh, 0x5c
loop 0x40d21b
pop ebx
dec eax
push 0x5ead33c3
shl dword [ebx], 1
int3
Function at 0x43af6a
Capabilities:
Encode data using xor

Disassembly:
adc byte [ecx + 0x3d], dl
xor al, 0x61
pop ebp
xor edi, esp
cmp edi, dword [eax + 0x4f]
std
push eax
mov al, byte [0xadceca2e]
and al, 0xfa
arpl dx, bx
and eax, 0x456dee02
pop edi
dec edx
arpl word [eax + 0x396dcf59], si
jns 0x43af4d
rcr byte [eax + 0x10], 1
popal
push ss
cmpsd dword [esi], dword es:[edi]
jno 0x43afa3
in al, dx
test eax, 0x10f3d8a6
add eax, 0xd798c430
mov byte [0xa4b183f6], al
mov cl, 0x85
mov ebp, 0x227763f6
int 0xae
and ch, byte [esi - 0x63c6f188]
pushfd
jmp 0x4ea0875c
cmp dword [ecx + edi*2 + 0x26bb666c], edi
sbb al, 0x1e
mov esp, 0x5c60f748
mov byte [edi + 0x24], cl
pushal
jns 0x43afac
sbb byte [edi + ebp*2 - 0x369d7a7f], cl
pop ds
cmp dword [esi + 0x24], edx
mov bh, byte [ecx]
jge 0x43af9a
fdivr dword [eax]
aam 0xab
in eax, dx
and byte [eax + 0xdbcf87d], bh
stosd dword es:[edi], eax
invalid

Function at 0x45c1aa
Capabilities:
Encode data using xor

Disassembly:
fst dword [eax]
sub dword [edx - 0x7c], ebx
pushfd
sal dword [ebx - 0x1f2bcc0d], 1
xchg edi, eax
add eax, 0xecbac20b
sub dword [edx], edx
push 0xfc449593
cli
salc
invalid

Function at 0x47f706
Capabilities:
Encode data using xor

Disassembly:
or esp, ebx
and al, 0xf
mov dh, 0x7c
jmp 0x47f6ec
cmpsb byte [esi], byte es:[edi]
push esp
inc ebx
call 0x52ae18e5
scasb al, byte es:[edi]
xor ebx, dword [edi]
fld xword [edi - 0x7a]
xchg byte [esi], cl
push cs
and al, 0x2f
xor eax, 0x723b121c
lcall 0xcd01, 0x2876b993
jbe 0x47f716
add ebp, ecx
pop esi
out dx, eax
ja 0x47f6e0
xor ch, byte [edx]
inc ebp
jo 0x47f6e1
sub al, byte [ebp + 0x65]
jo 0x47f6e1
imul ah
mov es, word [esi - 0x53]
dec eax
punpckldq mm3, dword [esi + 0x37]
jne 0x47f757
jne 0x47f757
mov edx, 0xaafbbb24
dec edi
jne 0x47f73b
jb 0x47f6c0
xor ah, byte [ebx]
daa
pop es
invalid
mov bh, 0x2f
sub dword [ebx + 0x63], esp
fbstp tbyte [esi]
lcall 0xe2a7, 0xb8f6b0e6
sbb edi, 0x18610097
sar byte [esi], 1
loope 0x47f6f5
popal
sbb al, dl
loope 0x47f6f5
out 0xae, eax
je 0x47f6d2
mov al, byte [0x7200e22f]
fisub word [ecx - 0x300fd899]
das
loop 0x47f73e
jb 0x47f71e
mov eax, dword [0xcff02767]
insb byte es:[edi], dx
cli
lahf
push esp
lahf
cmc
mov esp, 0x19c05a
inc edx
and ch, al
add byte [esp + edi*4 - 0x2ed25971], ch
cld
jmp 0x47f730
cmpsb byte [esi], byte es:[edi]
sub eax, 0xd3ebfcd1
outsd dx, dword [esi]
aas
inc eax
and al, 0x65
and al, 0xa1
pop edx
cmpsb byte [esi], byte es:[edi]
invalid
Function at 0x4ba905
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33a8
cmp edx, dword [eax]
je 0x4ba927
add eax, 8
inc ecx
cmp eax, 0x4c3438
jl 0x4ba918
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33a8]
jne 0x4baa55
mov eax, dword [0x4c7d2c]
cmp eax, 1
je 0x4baa2f
test eax, eax
jne 0x4ba958
cmp dword [0x4c32d4], 1
je 0x4baa2f
cmp edx, 0xfc
je 0x4baa55
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba98f
lea eax, [ebp - 0x1a4]
push 0x4bfb78
push eax
call fcn.004bb2f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb780
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba9d2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb780
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfb74
push edi
call fcn.004bd650
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bfb58
push eax
call fcn.004bb2f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb300
lea eax, [ebp - 0xa0]
push 0x4bfb54
push eax
call fcn.004bb300
push dword [esi + 0x4c33ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb300
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bfb2c
push eax
call fcn.004bd5c4
add esp, 0x2c
pop edi
jmp 0x4baa55
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33ac]
push 0
push eax
push dword [esi]
call fcn.004bb780
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40141e
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x214
lea eax, [esp]
push ebp
push esi
mov esi, dword [esp + 0x228]
push edi
mov edi, dword [esp + 0x22c]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or eax, 9
push eax
push dword [esp + 0x230]
push dword [esp + 0x230]
call fcn.004062a5
test eax, eax
jne 0x401527
xor ebp, ebp
test byte [esp + 0x22c], 2
je 0x401493
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebp
push eax
lea eax, [esp + 0x28]
push eax
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x401503
push 0x105
lea eax, [esp + 0x18]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x4014ce
test edi, edi
jne 0x401503
push dword [esp + 0x22c]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call fcn.0040141e
test eax, eax
jne 0x4014d8
push 0x105
lea eax, [esp + 0x18]
push eax
push edi
push dword [esp + 0x18]
call ebp
test eax, eax
je 0x4014a6
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004068b3
test eax, eax
jne 0x401514
push dword [esp + 0x228]
push dword [esp + 0x228]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x401527
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x401527
push 0
push esi
push dword [esp + 0x230]
push dword [esp + 0x230]
call eax
pop edi
pop esi
pop ebp
add esp, 0x214
ret 0xc
Function at 0x403307
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
test ecx, ecx
js 0x403330
mov eax, dword [0x434278]
push edi
add eax, ecx
push edi
push eax
push dword [0x40a014]
mov dword [0x40c974], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.00403188
test eax, eax
js 0x403406
push ebx
push esi
push 4
lea eax, [ebp + 8]
push eax
push dword [0x40a014]
call fcn.00406915
test eax, eax
je 0x403401
push dword [ebp + 8]
add dword [0x40c974], 4
call fcn.00403188
mov esi, eax
test esi, esi
js 0x4033fd
cmp dword [ebp + 0x10], edi
jne 0x4033d1
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x4033fd
mov ebx, 0x4000
mov edi, 0x41e550
cmp ecx, ebx
mov eax, ebx
cmovl eax, ecx
push eax
push edi
push dword [0x40a014]
mov dword [ebp - 4], eax
call fcn.00406915
test eax, eax
je 0x403401
push dword [ebp - 4]
push edi
push dword [ebp + 0xc]
call fcn.004069d8
test eax, eax
je 0x4033cd
mov eax, dword [ebp - 4]
add esi, eax
mov ecx, dword [ebp + 8]
add dword [0x40c974], eax
sub ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
jg 0x403389
jmp 0x4033fd
push 0xfffffffffffffffe
jmp 0x403403
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 8], eax
cmovl eax, dword [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403401
mov esi, dword [ebp - 4]
add dword [0x40c974], esi
mov eax, esi
jmp 0x403404
push 0xfffffffffffffffd
pop eax
pop esi
pop ebx
pop edi
leave
ret 0x10

Function at 0x403429
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
cmp dword [ebp + 8], 0
je 0x403451
mov eax, dword [0x40c988]
test eax, eax
je 0x403448
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40c988], 0
leave
ret
cmp dword [0x40c988], 0
je 0x403463
push 0
call fcn.004061dc
leave
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x434220]
jbe 0x4034cd
cmp dword [0x433218], 0
je 0x4034a8
test byte [0x434314], 1
je 0x4034cd
call fcn.0040340b
push eax
lea eax, [ebp - 0x80]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push 0
call fcn.00405d16
leave
ret
push 0
push 0x4037ac
push 0
push 0x6f
push dword [0x433214]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x40c988], eax
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret
Function at 0x405dfa
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x405e14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4
Function at 0x40616b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
lea eax, [ebp - 0x23c]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
ja 0x4061a5
test eax, eax
je 0x4061a5
add eax, eax
cmp word [ebp + eax - 0x23e], 0x5c
je 0x4061a7
mov ecx, 0x4082a8
jmp 0x4061ac
xor eax, eax
mov ecx, 0x4082aa
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x23c]
add eax, ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x40620a
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40622d
push dword [esp + 8]
push dword [esp + 8]
call fcn.004062d3
pop ecx
pop ecx
inc dword [0x4342f0]
ret 8

Function at 0x4062d3
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, 0x400
mov dword [0x4301d8], 0x55004e
mov ebp, 0x4301d8
mov dword [0x4301dc], 0x4c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
je 0x406329
push 1
push 0
push esi
call fcn.004068e8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x406409
cmp eax, ebx
jg 0x406409
push ebx
mov esi, 0x42f9d8
push esi
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x406409
cmp eax, ebx
jg 0x406409
push esi
push ebp
push str._ls_ls_r_n
push 0x42f5d8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x434230]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.00405e75
push 4
push 0xc0000000
push esi
call fcn.004068e8
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406409
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebp + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x406402
push esi
push edi
push ebx
call fcn.00406915
test eax, eax
je 0x406402
push str._Rename__r_n
push edi
call fcn.00406b03
test eax, eax
jne 0x40640e
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x42f5d8
lea eax, [ecx + edi]
push eax
call fcn.00406681
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.004069d8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x408984
add eax, 0xa
push eax
call fcn.00406b03
mov ecx, eax
test ecx, ecx
je 0x4063d3
lea edx, [edi + esi]
jmp 0x40642d
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x406427
sub ecx, edi
inc ecx
jmp 0x4063d5
Function at 0x406552
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00406b6a
mov edi, eax
cmp edi, 0xffffffff
je 0x406595
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x406576
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x40657c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x406585
xor eax, eax
inc eax
jmp 0x406597
test byte [ebp + 0xc], 4
jne 0x406595
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x406605
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x42edd8
push ebx
call fcn.00406ae7
push ebx
call fcn.00406b92
mov esi, eax
test esi, esi
je 0x40667a
push esi
call fcn.00406d0a
test byte [0x43422c], 0x80
je 0x40663e
movzx eax, word [esi]
test ax, ax
je 0x40667a
cmp eax, 0x5c
je 0x40667a
sub esi, ebx
sar esi, 1
jmp 0x406658
call fcn.0040659c
test eax, eax
je 0x406652
test byte [eax], 0x10
je 0x40667a
push ebx
call fcn.00406cdd
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
cmp eax, esi
jg 0x406644
call fcn.00406523
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40667a
xor eax, eax
inc eax
jmp 0x40667c
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x4066a3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x42e590], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x42e590
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4066e2
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x4066e6
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x268]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.00406605
mov dword [esp + 0x14], eax
test bl, 8
je 0x406728
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x4342e8], eax
jmp 0x4068a7
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x14], ebp
je 0x406745
test eax, eax
je 0x406896
test bl, 2
je 0x40685f
push esi
push 0x42e5d8
call fcn.00406ae7
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406768
push str..
push 0x42e5d8
call ebp
jmp 0x40676e
push esi
call fcn.00406cdd
xor eax, eax
cmp word [esi], ax
jne 0x40677f
cmp word [0x42e5d8], 0x5c
jne 0x406787
push 0x4082a8
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0x42e5d8
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x406848
push 0x2e
pop eax
cmp word [esp + 0x48], ax
jne 0x4067d1
cmp word [esp + 0x4a], 0
je 0x40682a
cmp word [esp + 0x4a], ax
jne 0x4067d1
cmp word [esp + 0x4c], 0
je 0x40682a
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x14]
call fcn.00406ae7
test byte [esp + 0x1c], 0x10
je 0x4067f8
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x40682a
push ebx
push esi
call fcn.004066e6
jmp 0x40682a
push edi
push esi
call fcn.00406552
test eax, eax
jne 0x406822
test edi, edi
je 0x40681a
push esi
push 0xfffffffffffffff1
call fcn.00405d16
xor eax, eax
push eax
push esi
call fcn.0040620a
jmp 0x40682a
inc dword [0x4342e8]
jmp 0x40682a
push esi
push 0xfffffffffffffff2
call fcn.00405d16
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4067b3
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
je 0x4068a6
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax - 2], cx
cmp dword [esp + 0x18], ecx
je 0x406896
push esi
call fcn.0040659c
test eax, eax
je 0x4068a6
push esi
call fcn.00406523
mov eax, edi
or eax, 1
push eax
push esi
call fcn.00406552
test eax, eax
jne 0x40689e
test edi, edi
je 0x406896
push esi
push 0xfffffffffffffff1
call fcn.00405d16
xor eax, eax
push eax
push esi
call fcn.0040620a
jmp 0x4068a6
inc dword [0x4342e8]
jmp 0x4068a6
push esi
push 0xffffffffffffffe5
call fcn.00405d16
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x25c
ret 8

Function at 0x4068e8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc