joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d96d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea eax, [ebp + 0xc]
call fcn.0040a7ac
xor eax, eax
push ebp
push 0x5d9893
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
cmp byte [ebp + 8], 0
jne 0x5d97b3
cmp dword [esi], 0xffffffff
jne 0x5d9741
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0xc]
call fcn.005d4710
mov eax, dword [ebp - 0x10]
call fcn.0040b26c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x5d9779
push 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x5d9779
cmp edi, dword [ebp - 0xc]
je 0x5d986e
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
call fcn.005d4710
mov eax, dword [ebp - 0x14]
call fcn.0040b26c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
jmp 0x5d986a
mov bl, 1
cmp dword [esi], 0xffffffff
jne 0x5d97f0
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x18]
mov eax, dword [ebp + 0xc]
call fcn.005d4710
mov eax, dword [ebp - 0x18]
call fcn.0040b26c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
jmp 0x5d9860
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x5d9824
push 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x5d9824
cmp edi, dword [ebp - 0xc]
je 0x5d986e
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
call fcn.005d4710
mov eax, dword [ebp - 0x1c]
call fcn.0040b26c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
inc ebx
cmp bl, 0xb
jne 0x5d97b5
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d989a
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.0040a768
lea eax, [ebp + 0xc]
call fcn.0040a6e0
pop eax
jmp eax
Function at 0x5d9dd4
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x5d9e6e
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x5d9df3
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x5d9e84
dec edx
je 0x5d9eb9
jmp 0x5d9f0a
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x5d9f0a
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5da01c
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x5da03b
add edx, 3
sar edx, 2
test edx, edx
jle 0x5da149
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x5da070
je 0x5da0b3
sub ecx, 0x2b
je 0x5da0a9
sub ecx, 4
je 0x5da0ae
dec ecx
sub ecx, 0xa
jb 0x5da09b
jmp 0x5da0b6
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x5da082
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x5da08d
jmp 0x5da0b6
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x5da0b6
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x5da0b6
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x5da0b6
mov byte [eax], 0x3e
jmp 0x5da0b6
mov byte [eax], 0x3f
jmp 0x5da0b6
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x5da053
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x5da107
cmp byte [esp + 7], 0xff
jne 0x5da107
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x5da13e
cmp dl, 0xff
je 0x5da13e
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x5da04a
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x5dc758
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
mov edx, ecx
dec edx
test edx, edx
jb 0x5dc773
inc edx
xor eax, eax
movzx ecx, byte [edi + eax]
xor byte [esi + eax], cl
inc eax
dec edx
jne 0x5dc768
pop edi
pop esi
ret

Function at 0x5de020
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jb 0x5de06a
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
mov esi, dword [esi*4 + 0x60306c]
movzx edi, byte [eax + ecx + 1]
xor esi, dword [edi*4 + 0x60346c]
movzx edi, byte [eax + ecx + 2]
xor esi, dword [edi*4 + 0x60386c]
movzx edi, byte [eax + ecx + 3]
xor esi, dword [edi*4 + 0x603c6c]
mov dword [eax + ecx], esi
inc edx
dec ebx
jne 0x5de02e
pop edi
pop esi
pop ebx
ret
Function at 0x5de954
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x5de962
sub ecx, 4
mov ecx, dword [ecx]
mov edi, dword [edx]
mov esi, edi
test esi, esi
je 0x5de96f
sub esi, 4
mov esi, dword [esi]
cmp ecx, esi
jle 0x5de97e
mov ecx, edi
test ecx, ecx
je 0x5de97e
sub ecx, 4
mov ecx, dword [ecx]
mov esi, ecx
dec esi
test esi, esi
jl 0x5de997
inc esi
xor ecx, ecx
mov ebx, dword [edx]
movzx ebx, byte [ebx + ecx]
mov edi, dword [eax]
xor byte [edi + ecx], bl
inc ecx
dec esi
jne 0x5de988
pop edi
pop esi
pop ebx
ret

Function at 0x5df0f0
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp], eax
lea esi, [esp + 8]
lea ebp, [esp + 0x18]
mov eax, dword [esp]
mov byte [eax], 0
mov edi, 0x3e8
mov byte [ebp], 0
mov ebx, 8
shl byte [ebp], 1
push esi
call sub.kernel32.dll_QueryPerformanceCounter
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
mov eax, dword [esi]
mov edx, dword [esi + 4]
sub eax, dword [esp + 0x10]
sbb edx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], edx
push 0
push 2
mov eax, dword [esi]
mov edx, dword [esi + 4]
call fcn.0040d1bc
cmp edx, 0
jne 0x5df162
cmp eax, 0
jne 0x5df162
mov dword [esi], 0
mov dword [esi + 4], 0
jmp 0x5df16f
mov dword [esi], 1
mov dword [esi + 4], 0
movzx eax, byte [esi]
add byte [ebp], al
dec ebx
jne 0x5df116
mov eax, dword [esp]
movzx edx, byte [ebp]
xor byte [eax], dl
dec edi
jne 0x5df10d
mov edi, 8
push esi
call sub.kernel32.dll_QueryPerformanceCounter
push 1
call sub.kernel32.dll_Sleep
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, dword [esi]
sbb edx, dword [esi + 4]
mov dword [esi], eax
mov dword [esi + 4], edx
movzx eax, byte [esi]
mov byte [ebp], al
mov eax, dword [esp]
movzx edx, byte [ebp]
xor byte [eax], dl
dec edi
jne 0x5df189
mov dword [esi], 0
mov dword [esi + 4], 0
mov edx, ebp
mov eax, esi
mov ecx, 1
call fcn.004071b4
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5e161c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x11
call fcn.0040b230
add esp, 0x28
pop ebx
ret

Function at 0x5e4468
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x60485c]
mov eax, dword [eax]
mov eax, dword [eax + 0x408]
xor edx, edx
call fcn.00521130
mov eax, dword [0x60485c]
mov eax, dword [eax]
xor edx, edx
call fcn.005f19f8
mov eax, dword [0x60bf74]
call fcn.005bdb2c
mov edx, eax
mov eax, dword [0x60485c]
mov eax, dword [eax]
call fcn.005c46d4
mov eax, dword [0x60bf74]
call fcn.005bdb4c
mov edx, eax
mov eax, dword [0x60485c]
mov eax, dword [eax]
call fcn.005c4710
xor edx, edx
mov eax, dword [0x60bf74]
call fcn.005be02c
mov eax, dword [0x60485c]
mov eax, dword [eax]
mov dl, 1
call fcn.005be02c
push 0
mov eax, dword [0x60bf74]
call fcn.0052ac08
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x5e4efc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.0040a7ac
lea edi, [ebp - 0x254]
xor eax, eax
push ebp
push 0x5e500a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push edi
lea eax, [ebp - 0x25c]
mov ecx, 0x5e5020
mov edx, dword [ebp - 4]
call fcn.0040b2f4
mov eax, dword [ebp - 0x25c]
lea edx, [ebp - 0x258]
call fcn.005d4710
mov eax, dword [ebp - 0x258]
call fcn.0040b26c
push eax
call sub.kernel32.dll_FindFirstFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5e4fe2
lea eax, [ebp - 0x260]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.0040b230
mov eax, dword [ebp - 0x260]
mov edx, 0x5e5028
call fcn.0040b43c
je 0x5e4fcb
lea eax, [ebp - 0x264]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.0040b230
mov eax, dword [ebp - 0x264]
mov edx, 0x5e5030
call fcn.0040b43c
je 0x5e4fcb
inc esi
push edi
push ebx
call sub.kernel32.dll_FindNextFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5e4f80
push ebx
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e5011
lea eax, [ebp - 0x264]
mov edx, 4
call fcn.0040a768
lea eax, [ebp - 4]
call fcn.0040a6e0
pop eax
jmp eax
Function at 0x5e79bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5e7aa7
push dword fs:[eax]
mov dword fs:[eax], esp
inc dword [ebx]
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.005d5068
mov eax, 1
mov edx, dword [esi]
movzx edx, byte [edx]
mov ecx, dword [esi]
xor byte [ecx + eax], dl
inc eax
cmp eax, 0x10
jne 0x5e79e6
xor eax, eax
mov edx, dword [esi]
movzx edx, byte [edx + eax]
shl edx, 4
movzx edx, dl
shr edx, 4
movzx ecx, dl
mov ebx, dword [esi]
movzx ecx, byte [ebx + ecx]
movzx edx, dl
mov ebx, dword [esi]
add ebx, edx
mov edx, dword [esi]
movzx edx, byte [edx + eax]
mov byte [ebx], dl
mov edx, dword [esi]
mov byte [edx + eax], cl
inc eax
cmp eax, 0x10
jne 0x5e79f8
xor eax, eax
mov edx, dword [esi]
movzx edx, byte [edx + 0xf]
mov ecx, dword [esi]
xor byte [ecx + eax], dl
inc eax
cmp eax, 0xf
jne 0x5e7a2c
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 3]
shl edx, 6
movzx eax, dl
shr eax, 6
mov edx, eax
xor eax, eax
movzx ecx, dl
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
mov ebx, dword [esi]
xor byte [ebx + eax], cl
inc eax
cmp eax, 0x10
jne 0x5e7a51
xor eax, eax
mov edx, eax
and edx, 0x80000003
jns 0x5e7a77
dec edx
or edx, 0xfffffffc
inc edx
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx]
mov ecx, dword [esi]
xor byte [ecx + eax], dl
inc eax
cmp eax, 0x10
jne 0x5e7a68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e7aae
lea eax, [ebp - 4]
mov edx, dword [0x5d3f80]
call fcn.0040d96c
pop eax
jmp eax

Function at 0x5ebaf8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [0x60485c]
mov eax, dword [ebx]
mov eax, dword [eax + 0x408]
xor edx, edx
call fcn.00521130
mov eax, dword [ebx]
mov eax, dword [eax + 0x43c]
xor edx, edx
call fcn.00521130
mov eax, dword [ebx]
xor edx, edx
call fcn.005f19f8
mov eax, dword [ebx]
xor edx, edx
call fcn.005f1b0c
mov eax, dword [ebx]
mov edx, dword [eax + 0x41c]
mov eax, dword [ebx]
mov eax, dword [eax + 0x3e8]
call fcn.0054caa8
mov eax, dword [ebx]
xor edx, edx
call fcn.005f222c
mov eax, dword [0x60bf78]
call fcn.005bdb2c
mov edx, eax
mov eax, dword [ebx]
call fcn.005c46d4
mov eax, dword [0x60bf78]
call fcn.005bdb4c
mov edx, eax
mov eax, dword [ebx]
call fcn.005c4710
xor edx, edx
mov eax, dword [0x60bf78]
call fcn.005be02c
mov eax, dword [ebx]
mov dl, 1
call fcn.005be02c
push 0
mov eax, dword [0x60bf78]
call fcn.0052ac08
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x5ebb9c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [0x60485c]
mov eax, dword [ebx]
mov eax, dword [eax + 0x408]
xor edx, edx
call fcn.00521130
mov eax, dword [ebx]
mov eax, dword [eax + 0x43c]
xor edx, edx
call fcn.00521130
mov eax, dword [ebx]
xor edx, edx
call fcn.005f19f8
mov eax, dword [ebx]
xor edx, edx
call fcn.005f1b0c
mov eax, dword [ebx]
mov edx, dword [eax + 0x3ec]
mov eax, dword [ebx]
mov eax, dword [eax + 0x3e8]
call fcn.0054caa8
mov eax, dword [ebx]
xor edx, edx
call fcn.005f222c
mov eax, dword [0x60bf78]
call fcn.005bdb2c
mov edx, eax
mov eax, dword [ebx]
call fcn.005c46d4
mov eax, dword [0x60bf78]
call fcn.005bdb4c
mov edx, eax
mov eax, dword [ebx]
call fcn.005c4710
xor edx, edx
mov eax, dword [0x60bf78]
call fcn.005be02c
mov eax, dword [ebx]
mov dl, 1
call fcn.005be02c
push 0
mov eax, dword [0x60bf78]
call fcn.0052ac08
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x5ed328
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.0040a7ac
lea edi, [ebp - 0x254]
xor eax, eax
push ebp
push 0x5ed436
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push edi
lea eax, [ebp - 0x25c]
mov ecx, 0x5ed44c
mov edx, dword [ebp - 4]
call fcn.0040b2f4
mov eax, dword [ebp - 0x25c]
lea edx, [ebp - 0x258]
call fcn.005d4710
mov eax, dword [ebp - 0x258]
call fcn.0040b26c
push eax
call sub.kernel32.dll_FindFirstFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5ed40e
lea eax, [ebp - 0x260]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.0040b230
mov eax, dword [ebp - 0x260]
mov edx, 0x5ed454
call fcn.0040b43c
je 0x5ed3f7
lea eax, [ebp - 0x264]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.0040b230
mov eax, dword [ebp - 0x264]
mov edx, 0x5ed45c
call fcn.0040b43c
je 0x5ed3f7
inc esi
push edi
push ebx
call sub.kernel32.dll_FindNextFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5ed3ac
push ebx
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ed43d
lea eax, [ebp - 0x264]
mov edx, 4
call fcn.0040a768
lea eax, [ebp - 4]
call fcn.0040a6e0
pop eax
jmp eax
Function at 0x5f01a8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x20c], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x5f029b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0xffffffffffffffff
push edi
call sub.shell32.dll_DragQueryFileW
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5f0215
inc ebx
xor esi, esi
push 0xfe
lea eax, [ebp - 0x202]
push eax
push esi
push edi
call sub.shell32.dll_DragQueryFileW
lea eax, [ebp - 4]
lea edx, [ebp - 0x202]
mov ecx, 0xff
call fcn.0040b578
inc esi
dec ebx
jne 0x5f01eb
push edi
call sub.shell32.dll_DragFinish
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.005d6db4
test al, al
je 0x5f0273
push 0
lea edx, [ebp - 0x20c]
xor eax, eax
call fcn.004073d8
mov eax, dword [ebp - 0x20c]
lea edx, [ebp - 0x208]
call fcn.00426460
lea eax, [ebp - 0x208]
mov edx, 0x5f02b8
call fcn.0040b6d0
mov eax, dword [ebp - 0x208]
call fcn.0040b4d8
push eax
mov eax, dword [ebp - 4]
call fcn.0040b4d8
push eax
call sub.kernel32.dll_CopyFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f02a2
lea eax, [ebp - 0x20c]
mov edx, 2
call fcn.0040a6f8
lea eax, [ebp - 4]
call fcn.0040a698
pop eax
jmp eax

Function at 0x5f1c30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a78c
xor eax, eax
push ebp
push 0x5f1db7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor edx, edx
mov eax, 2
call fcn.005e1f0c
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.005e1f2c
mov edi, eax
jmp 0x5f1d81
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.0040b578
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.004264ac
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x234]
call fcn.00424ee4
mov eax, dword [ebp - 0x234]
push eax
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 4]
call fcn.00424ee4
mov edx, dword [ebp - 0x240]
pop eax
call fcn.0040b860
je 0x5f1d54
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.0040b578
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.00424ee4
mov eax, dword [ebp - 0x244]
push eax
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 4]
call fcn.00424ee4
mov edx, dword [ebp - 0x24c]
pop eax
call fcn.0040b860
jne 0x5f1d72
push 0
mov eax, dword [ebp - 0x228]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.005e1f4c
mov edi, eax
test edi, edi
jne 0x5f1caf
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f1dbe
lea eax, [ebp - 0x24c]
mov edx, 7
call fcn.0040a6f8
lea eax, [ebp - 4]
call fcn.0040a698
pop eax
jmp eax
Function at 0x408fba
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408ff9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408ff9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408ff9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408ff9
cmp dword [ecx + 0x74], 0xe
jbe 0x408ff9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40eec6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4778a8
push 0x4778a0
push str.FlsAlloc
push 0x1f
call fcn.0040ed85
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40eefa
push dword [ebp + 8]
mov ecx, esi
call dword [0x427130]
call esi
jmp 0x40ef00
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40ef44
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4778b8
push 0x4778b0
push str.FlsGetValue
push 0x21
call fcn.0040ed85
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ef7b
push dword [ebp + 8]
mov ecx, esi
call dword [0x427130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40ef83
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4778c0
push 0x4778b8
push str.FlsSetValue
push 0x22
call fcn.0040ed85
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40efbd
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x427130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4042a9
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
test eax, eax
setne al
ret

Function at 0x4042d2
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42295c], 0
push esi
mov esi, edx
jne 0x40430a
mov edx, ecx
push ebx
lea ecx, [ebp - 0xc]
call fcn.0040431a
mov eax, dword [eax]
mov edx, esi
mov ecx, eax
call fcn.004042a9
mov bl, al
push dword [ebp - 0xc]
call fcn.00403226
pop ecx
mov al, bl
pop ebx
jmp 0x404317
push esi
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test eax, eax
setne al
pop esi
leave
ret

Function at 0x404369
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42295c], 0
jne 0x40439a
mov edx, ecx
push ebx
lea ecx, [ebp - 0xc]
call fcn.0040431a
mov ecx, dword [eax]
call fcn.004042b7
mov bl, al
push dword [ebp - 0xc]
call fcn.00403226
pop ecx
mov al, bl
pop ebx
leave
ret
push ecx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
setne al
leave
ret

Function at 0x404429
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42295c], 0
jne 0x40445a
mov edx, ecx
push ebx
lea ecx, [ebp - 0xc]
call fcn.0040431a
mov ecx, dword [eax]
call fcn.0040441a
mov bl, al
push dword [ebp - 0xc]
call fcn.00403226
pop ecx
mov al, bl
pop ebx
leave
ret
push 0
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
setne al
leave
ret

Function at 0x404691
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42295c], 0
push esi
mov esi, ecx
jne 0x4046c5
push ebx
mov edx, esi
lea ecx, [ebp - 0xc]
call fcn.0040431a
mov ecx, dword [eax]
call fcn.00404673
mov bl, al
push dword [ebp - 0xc]
call fcn.00403226
pop ecx
mov al, bl
pop ebx
jmp 0x4046de
xor edx, edx
mov ecx, esi
call fcn.004042d2
test al, al
je 0x4046de
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
setne al
pop esi
leave
ret