joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101f791
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0100b6e0
mov eax, dword [0x1022018]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2008], 0
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x101f7d0
and dword [ebp - 0x2008], edi
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x101f8f2
push esi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x2004]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
push esi
lea eax, [ebp - 0x2004]
push eax
push 0x1008aa8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
cmp eax, 0xffe
jne 0x101f817
and dword [ebp - 0x2008], 0
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x101f8f1
xor eax, eax
xor ecx, ecx
lea esi, [ebp - 0x2004]
cmp word [ebp + ecx*2 - 0x2004], ax
jne 0x101f839
cmp word [ebp + ecx*2 - 0x2002], ax
je 0x101f8f1
cmp ecx, 0xfff
jae 0x101f8f1
cmp word [esi], ax
jne 0x101f84d
inc esi
inc esi
inc ecx
mov edi, esi
jmp 0x101f854
inc esi
inc esi
inc ecx
cmp word [esi], ax
jne 0x101f851
cmp ebx, eax
je 0x101f868
mov edx, dword [ebp - 0x2008]
cmp edx, dword [ebp + 8]
je 0x101f874
cmp edi, esi
je 0x101f821
inc dword [ebp - 0x2008]
jmp 0x101f821
push 0x3d
push edi
call sub.msvcrt.dll_wcschr
pop ecx
pop ecx
mov dword [ebp - 0x200c], eax
test eax, eax
je 0x101f88a
mov esi, eax
sub esi, edi
sar esi, 1
cmp esi, dword [ebp + 0x10]
jb 0x101f897
push 0x7a
jmp 0x101f8e4
push esi
push edi
push dword [ebp + 0x10]
push ebx
call fcn.010192bb
push 2
xor eax, eax
push ebx
mov word [ebx + esi*2], ax
call fcn.01019253
movzx eax, ax
test eax, eax
je 0x101f8dd
cmp eax, 0x7f
je 0x101f8dd
mov eax, dword [ebp - 0x200c]
test eax, eax
je 0x101f8f1
add eax, 2
push eax
call sub.msvcrt.dll__wtoi
or eax, 0x10000000
pop ecx
mov dword [ebp - 0x2008], eax
jmp 0x101f8f1
xor eax, eax
mov word [ebx], ax
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
and dword [ebp - 0x2008], 0
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x2008]
pop edi
xor ecx, ebp
pop ebx
call fcn.0100b6a5
leave
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x407ef8
nop
mov ecx, 0x19545011
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x1a0d5367
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x408769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40c190
cmp edx, dword [eax]
je 0x40878b
add eax, 8
inc ecx
cmp eax, 0x40c220
jl 0x40877c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40c190]
jne 0x4088b9
mov eax, dword [0x40cbb0]
cmp eax, 1
je 0x408893
test eax, eax
jne 0x4087bc
cmp dword [0x40c0e4], 1
je 0x408893
cmp edx, 0xfc
je 0x4088b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4087f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00409670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00409490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x408836
lea eax, [ebp - 0x1a4]
push eax
call fcn.00409490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b45c
push edi
call fcn.00409f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00409670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00409680
lea eax, [ebp - 0xa0]
push 0x40b43c
push eax
call fcn.00409680
push dword [esi + 0x40c194]
lea eax, [ebp - 0xa0]
push eax
call fcn.00409680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00409e75
add esp, 0x2c
pop edi
jmp 0x4088b9
lea eax, [ebp + 8]
lea esi, [esi + 0x40c194]
push 0
push eax
push dword [esi]
call fcn.00409490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40de38
nop
nop
mov ecx, 0x245e4ee2
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x760a480d
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40ab90
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43a13b
push eax
mov eax, 0x18a0
mov dword fs:[0], esp
call fcn.0042f9b0
lea ecx, [esp]
call fcn.00421d60
lea ecx, [esp]
mov dword [esp + 0x18a8], 0
call fcn.00421db0
test al, al
je 0x40abf9
lea eax, [esp + 0x98]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x18b4]
call fcn.00408cf0
jmp 0x40ac4d
lea edx, [esp + 0x89c]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x40ac39
lea eax, [esp + 0x98]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x18b4]
call fcn.00408cf0
jmp 0x40ac4d
mov ecx, dword [esp + 0x18b0]
lea edx, [esp + 0x89c]
push edx
call fcn.00408f30
lea ecx, [esp]
mov dword [esp + 0x18a8], 0xffffffff
call fcn.00421da0
mov ecx, dword [esp + 0x18a0]
mov dword fs:[0], ecx
add esp, 0x18ac
ret

Function at 0x40ac80
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43a15b
push eax
mov eax, 0x20a4
mov dword fs:[0], esp
call fcn.0042f9b0
lea ecx, [esp]
call fcn.00421d60
lea ecx, [esp]
mov dword [esp + 0x20ac], 0
call fcn.00421db0
test al, al
je 0x40ace9
lea eax, [esp + 0x89c]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x89c]
push ecx
mov ecx, dword [esp + 0x20b8]
call fcn.00408cf0
jmp 0x40ad48
lea edx, [esp + 0x10a0]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40ad34
lea eax, [esp + 0x98]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40ad1e
mov byte [esp + 0x98], al
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x20b8]
call fcn.00408cf0
jmp 0x40ad48
mov ecx, dword [esp + 0x20b4]
lea edx, [esp + 0x10a0]
push edx
call fcn.00408f30
lea ecx, [esp]
mov dword [esp + 0x20ac], 0xffffffff
call fcn.00421da0
mov ecx, dword [esp + 0x20a4]
mov dword fs:[0], ecx
add esp, 0x20b0
ret
Function at 0x40af80
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x43a1dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x440
push ebx
push esi
lea ecx, [esp + 8]
call fcn.00408aa0
mov eax, dword [esp + 0x458]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x454], 0
call fcn.00409af0
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.0040a010
lea ecx, [esp + 0x140]
call fcn.00421d60
lea ecx, [esp + 0x140]
mov byte [esp + 0x450], 1
call fcn.00421db0
test al, al
lea ecx, [esp + 8]
je 0x40b00d
call fcn.004093e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne bl
jmp 0x40b0da
call fcn.00408be0
cmp eax, 0x104
jle 0x40b11b
lea ecx, [esp + 0x310]
call fcn.00408aa0
lea ecx, [esp + 0x310]
lea edx, [esp + 8]
push ecx
push edx
mov byte [esp + 0x458], 2
call fcn.0040aa80
add esp, 8
lea ecx, [esp + 0x1d8]
call fcn.00408aa0
push 0x4458a0
lea ecx, [esp + 0x1dc]
mov byte [esp + 0x454], 3
call fcn.00409790
lea ecx, [esp + 0x310]
call fcn.004098a0
push eax
lea ecx, [esp + 0x1dc]
call fcn.00409790
lea ecx, [esp + 0x1d8]
call fcn.00408fb0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x40b0af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40b0ad
mov esi, 1
test esi, esi
lea ecx, [esp + 0x1d8]
mov byte [esp + 0x450], 2
setne bl
call fcn.00408b70
lea ecx, [esp + 0x310]
mov byte [esp + 0x450], 1
call fcn.00408b70
lea ecx, [esp + 0x140]
mov byte [esp + 0x450], 0
call fcn.00421da0
lea ecx, [esp + 8]
mov dword [esp + 0x450], 0xffffffff
call fcn.00408b70
mov al, bl
pop esi
pop ebx
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
add esp, 0x44c
ret
push edi
lea ecx, [esp + 0xc]
call fcn.00408fb0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test edi, edi
jne 0x40b171
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x460]
mov ebx, eax
test esi, esi
je 0x40b165
push ebp
push ebx
mov ecx, esi
call fcn.0041c420
mov ebp, dword [esi]
lea ecx, [esp + 0x10]
call fcn.004098a0
push eax
push str.failedToDeleteFilepath
mov ecx, esi
call dword [ebp + 0x2c]
pop ebp
cmp ebx, 2
jne 0x40b16f
mov edi, 1
test edi, edi
lea ecx, [esp + 0x144]
mov byte [esp + 0x454], 0
setne bl
call fcn.00421da0
lea ecx, [esp + 0xc]
mov dword [esp + 0x454], 0xffffffff
call fcn.00408b70
mov ecx, dword [esp + 0x44c]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x44c
ret
Function at 0x40bf10
Capabilities:
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43a291
push eax
mov dword fs:[0], esp
sub esp, 0x308
push ebp
mov ebp, dword [esp + 0x324]
push esi
mov esi, dword [esp + 0x324]
push edi
mov edi, dword [esp + 0x324]
mov dword [ebp], 0
mov ecx, edi
mov dword [esi], 0xffffffff
call fcn.00408be0
test eax, eax
jne 0x40bf77
mov ecx, dword [esp + 0x330]
test ecx, ecx
je 0x40bf70
mov eax, dword [ecx]
push str.GetAttributes:_filename_is_empty
call dword [eax + 0x14]
xor al, al
jmp 0x40c0ab
push ebx
lea ecx, [esp + 0x10]
call fcn.00408aa0
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x324], 0
call fcn.00409af0
push 0x5c
push 0x2f
lea ecx, [esp + 0x18]
call fcn.0040a010
lea ecx, [esp + 0x10]
call fcn.00408be0
lea ecx, [esp + 0x148]
mov edi, eax
call fcn.00421d60
mov bl, 1
cmp edi, 0x104
mov byte [esp + 0x320], bl
jge 0x40c003
lea ecx, [esp + 0x10]
call fcn.00409180
test al, al
jne 0x40bfe8
lea ecx, [esp + 0x148]
call fcn.00421db0
test al, al
je 0x40c003
lea ecx, [esp + 0x10]
call fcn.004093e0
push eax
call fcn.0040d7f0
add esp, 4
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x40c07a
jmp 0x40c071
test edi, edi
jle 0x40c05a
lea ecx, [esp + 0x1e0]
call fcn.00408aa0
lea ecx, [esp + 0x1e0]
lea edx, [esp + 0x10]
push ecx
push edx
mov byte [esp + 0x328], 2
call fcn.0040ae70
add esp, 8
lea ecx, [esp + 0x1e0]
call fcn.00408fc0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x1e0]
mov dword [esi], eax
mov byte [esp + 0x320], bl
call fcn.00408b70
jmp 0x40c06c
lea ecx, [esp + 0x10]
call fcn.00408fc0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x40c07d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp], eax
cmp dword [esi], 0xffffffff
lea ecx, [esp + 0x148]
mov byte [esp + 0x320], 0
setne bl
call fcn.00421da0
lea ecx, [esp + 0x10]
mov dword [esp + 0x320], 0xffffffff
call fcn.00408b70
mov al, bl
pop ebx
mov ecx, dword [esp + 0x314]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x314
ret
Function at 0x40c350
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x43a2fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x388
push ebx
push esi
push edi
lea ecx, [esp + 0x8c]
call fcn.00408aa0
mov eax, dword [esp + 0x3a4]
lea ecx, [esp + 0x8c]
push eax
mov dword [esp + 0x3a0], 0
call fcn.00409af0
push 0x5c
push 0x2f
lea ecx, [esp + 0x94]
call fcn.0040a010
lea ecx, [esp + 0x1c4]
call fcn.00421d60
mov bl, 1
lea ecx, [esp + 0x1c4]
mov byte [esp + 0x39c], bl
call fcn.00421db0
test al, al
je 0x40c3e7
push 0
lea ecx, [esp + 0x90]
call fcn.004093e0
push eax
call fcn.0040d7b0
add esp, 8
jmp 0x40c464
lea ecx, [esp + 0x8c]
call fcn.00408be0
test eax, eax
jle 0x40c44f
lea ecx, [esp + 0x25c]
call fcn.00408aa0
lea ecx, [esp + 0x25c]
lea edx, [esp + 0x8c]
push ecx
push edx
mov byte [esp + 0x3a4], 2
call fcn.0040ae70
add esp, 8
lea ecx, [esp + 0x25c]
push 0
call fcn.00408fb0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 0x25c]
mov esi, eax
mov byte [esp + 0x39c], bl
call fcn.00408b70
jmp 0x40c466
push 0
lea ecx, [esp + 0x90]
call fcn.00408fb0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x40c4b9
mov edi, dword [esp + 0x3a8]
test edi, edi
je 0x40c4b7
push ebp
lea ecx, [esp + 0x10]
call fcn.00405600
lea ecx, [esp + 0x10]
mov byte [esp + 0x3a0], 3
call fcn.00406650
mov ebp, dword [edi]
lea ecx, [esp + 0x10]
call fcn.00404320
push eax
push str.errorMsg
mov ecx, edi
call dword [ebp + 0x2c]
lea ecx, [esp + 0x10]
mov byte [esp + 0x3a0], bl
call fcn.004056c0
pop ebp
test esi, esi
lea ecx, [esp + 0x1c4]
mov byte [esp + 0x39c], 0
setne bl
call fcn.00421da0
lea ecx, [esp + 0x8c]
mov dword [esp + 0x39c], 0xffffffff
call fcn.00408b70
mov ecx, dword [esp + 0x394]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x394
ret
Function at 0x40c510
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x43a331
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x308
push ebx
push esi
lea ecx, [esp + 8]
call fcn.00408aa0
mov eax, dword [esp + 0x320]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x31c], 0
call fcn.00409af0
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.0040a010
lea ecx, [esp + 0x140]
call fcn.00421d60
mov bl, 1
lea ecx, [esp + 0x140]
mov byte [esp + 0x318], bl
call fcn.00421db0
test al, al
lea ecx, [esp + 8]
je 0x40c596
call fcn.004093e0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x40c602
call fcn.00408be0
test eax, eax
jle 0x40c5f2
lea ecx, [esp + 0x1d8]
call fcn.00408aa0
lea ecx, [esp + 0x1d8]
lea edx, [esp + 8]
push ecx
push edx
mov byte [esp + 0x320], 2
call fcn.0040ae70
add esp, 8
lea ecx, [esp + 0x1d8]
call fcn.00408fb0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [esp + 0x1d8]
mov esi, eax
mov byte [esp + 0x318], bl
call fcn.00408b70
jmp 0x40c604
lea ecx, [esp + 8]
call fcn.00408fb0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, eax
test esi, esi
lea ecx, [esp + 0x140]
mov byte [esp + 0x318], 0
setne bl
call fcn.00421da0
lea ecx, [esp + 8]
mov dword [esp + 0x318], 0xffffffff
call fcn.00408b70
mov ecx, dword [esp + 0x310]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x314
ret

Function at 0x40c6b0
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x43a361
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x308
push ebx
push esi
lea ecx, [esp + 8]
call fcn.00408aa0
mov eax, dword [esp + 0x320]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x31c], 0
call fcn.00409af0
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.0040a010
mov ebx, 1
push 0
lea ecx, [esp + 0xc]
push ebx
push ecx
call fcn.0040b1c0
add esp, 0xc
lea ecx, [esp + 0x140]
call fcn.00421d60
lea ecx, [esp + 0x140]
mov byte [esp + 0x318], bl
call fcn.00421db0
test al, al
je 0x40c75b
mov edx, dword [esp + 0x324]
lea ecx, [esp + 8]
push edx
call fcn.004093e0
push eax
call fcn.0040d7d0
add esp, 8
and eax, 0xff
jmp 0x40c7db
lea ecx, [esp + 8]
call fcn.00408be0
test eax, eax
jle 0x40c7c3
lea ecx, [esp + 0x1d8]
call fcn.00408aa0
lea eax, [esp + 0x1d8]
lea ecx, [esp + 8]
push eax
push ecx
mov byte [esp + 0x320], 2
call fcn.0040ae70
mov edx, dword [esp + 0x32c]
add esp, 8
lea ecx, [esp + 0x1d8]
push edx
call fcn.00408fb0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x1d8]
mov esi, eax
mov byte [esp + 0x318], bl
call fcn.00408b70
jmp 0x40c7dd
mov eax, dword [esp + 0x324]
lea ecx, [esp + 8]
push eax
call fcn.00408fb0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
test esi, esi
lea ecx, [esp + 0x140]
mov byte [esp + 0x318], 0
setne bl
call fcn.00421da0
lea ecx, [esp + 8]
mov dword [esp + 0x318], 0xffffffff
call fcn.00408b70
mov ecx, dword [esp + 0x310]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x314
ret
Function at 0x40cd40
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x43a416
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x270
push esi
lea ecx, [esp + 4]
call fcn.00408aa0
mov eax, dword [esp + 0x284]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x280], 0
call fcn.00409af0
push 0x5c
push 0x2f
lea ecx, [esp + 0xc]
call fcn.0040a010
lea ecx, [esp + 4]
call fcn.00408be0
test eax, eax
jle 0x40cdef
lea ecx, [esp + 0x13c]
call fcn.00408aa0
lea ecx, [esp + 0x13c]
lea edx, [esp + 4]
push ecx
push edx
mov byte [esp + 0x284], 1
call fcn.0040ae70
add esp, 8
lea ecx, [esp + 0x13c]
call fcn.00408fb0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0x13c]
mov esi, eax
mov byte [esp + 0x27c], 0
call fcn.00408b70
jmp 0x40ce01
lea ecx, [esp + 4]
call fcn.00408fb0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test esi, esi
pop esi
jne 0x40ce41
mov ecx, dword [esp + 0x284]
test ecx, ecx
je 0x40ce16
call fcn.0041c380
lea ecx, [esp]
mov dword [esp + 0x278], 0xffffffff
call fcn.00408b70
xor al, al
mov ecx, dword [esp + 0x270]
mov dword fs:[0], ecx
add esp, 0x27c
ret
lea ecx, [esp]
mov dword [esp + 0x278], 0xffffffff
call fcn.00408b70
mov ecx, dword [esp + 0x270]
mov al, 1
mov dword fs:[0], ecx
add esp, 0x27c
ret

Function at 0x40d7d0
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret

Function at 0x40d7f0
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret
Function at 0x40fe10
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
test ebp, ebp
push edi
je 0x40ffc8
mov ebx, dword [esp + 0x120]
test ebx, ebx
je 0x40ffc8
push ebp
push ebp
call fcn.0040fdc0
mov edi, dword [esp + 0x134]
add esp, 8
mov ecx, edi
push eax
call fcn.00404de0
mov eax, 0xaaaaaaab
xor esi, esi
mul ebp
mov ebp, dword [esp + 0x128]
xor ecx, ecx
shr edx, 1
je 0x40ff26
mov dword [esp + 0x10], edx
jmp 0x40fe78
mov ebx, dword [esp + 0x120]
xor eax, eax
xor edx, edx
mov al, byte [esi + ebx]
mov dl, byte [esi + ebx + 1]
inc esi
mov edi, edx
inc esi
xor edx, edx
mov dl, byte [esi + ebx]
mov ebx, eax
sar ebx, 2
and ebx, 0x3f
and eax, 3
shl eax, 4
mov bl, byte [ebx + ebp]
inc esi
mov byte [esp + ecx + 0x14], bl
mov ebx, edi
sar ebx, 4
and ebx, 0xf
inc ecx
or ebx, eax
and edi, 0xf
shl edi, 2
mov al, byte [ebx + ebp]
mov byte [esp + ecx + 0x14], al
mov eax, edx
sar eax, 6
and eax, 3
inc ecx
or eax, edi
and edx, 0x3f
inc ecx
mov al, byte [eax + ebp]
mov byte [esp + ecx + 0x13], al
mov dl, byte [edx + ebp]
mov byte [esp + ecx + 0x14], dl
inc ecx
cmp ecx, 0x100
jl 0x40fef8
mov edi, dword [esp + 0x12c]
lea eax, [esp + 0x14]
push ecx
push eax
mov ecx, edi
call fcn.00405230
xor ecx, ecx
jmp 0x40feff
mov edi, dword [esp + 0x12c]
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x40fe71
test ecx, ecx
je 0x40ff1f
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
call fcn.00405230
mov ebx, dword [esp + 0x120]
mov eax, dword [esp + 0x124]
xor edx, edx
mov ecx, 3
div ecx
dec edx
je 0x40ff8b
dec edx
jne 0x40ffc8
xor eax, eax
xor edx, edx
mov al, byte [esi + ebx]
mov dl, byte [esi + ebx + 1]
mov dword [esp + 0x10], eax
mov ecx, edi
sar eax, 2
and eax, 0x3f
mov esi, edx
mov al, byte [eax + ebp]
push eax
call fcn.004047e0
mov eax, dword [esp + 0x10]
mov ecx, esi
sar ecx, 4
and eax, 3
and ecx, 0xf
shl eax, 4
or ecx, eax
mov dl, byte [ecx + ebp]
mov ecx, edi
push edx
call fcn.004047e0
and esi, 0xf
mov al, byte [ebp + esi*4]
push eax
jmp 0x40ffb8
xor ecx, ecx
mov cl, byte [esi + ebx]
mov esi, ecx
mov ecx, edi
mov edx, esi
sar edx, 2
and edx, 0x3f
mov al, byte [edx + ebp]
push eax
call fcn.004047e0
and esi, 3
shl esi, 4
mov cl, byte [esi + ebp]
push ecx
mov ecx, edi
call fcn.004047e0
push 0x3d
mov ecx, edi
call fcn.004047e0
push 0x3d
mov ecx, edi
call fcn.004047e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x41b670
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43a8bb
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push esi
mov esi, dword [esp + 0x150]
mov ecx, esi
call fcn.004046a0
mov al, byte [0x458b85]
test al, al
jne 0x41b6fa
push edi
mov ecx, 0x80
xor eax, eax
mov edi, 0x4587cc
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x100
push eax
push 0x4587cc
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
pop edi
jne 0x41b6f3
mov ecx, dword [str.Win32]
mov edx, dword [0x44760c]
mov ax, word [0x447610]
mov dword [0x4587cc], ecx
mov dword [0x4587d0], edx
mov word [0x4587d4], ax
mov byte [0x458b85], 1
lea ecx, [esp + 8]
call fcn.00408aa0
push 0x4587cc
lea ecx, [esp + 0xc]
mov dword [esp + 0x14c], 0
call fcn.00409740
lea ecx, [esp + 8]
call fcn.004098a0
push eax
mov ecx, esi
call fcn.00405070
lea ecx, [esp + 8]
mov dword [esp + 0x148], 0xffffffff
call fcn.00408b70
mov ecx, dword [esp + 0x140]
pop esi
mov dword fs:[0], ecx
add esp, 0x148
ret

Function at 0x41bf00
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
call fcn.0041b870
test al, al
jne 0x41bf32
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x41bf26
mov eax, dword [ecx]
push str.Failed_to_write_because_file_is_not_open.
call dword [eax + 0x14]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0x14
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x1c]
test edi, edi
je 0x41bf4b
mov dword [edi], 0
mov dword [edi + 4], 0
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, ebp
or ecx, eax
je 0x41c000
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
test eax, eax
jl 0x41bf7a
jg 0x41bf73
cmp ebp, 0x989680
jbe 0x41bf7a
mov esi, 0x989680
jmp 0x41bf7c
mov esi, ebp
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x41bfae
lea edx, [esp + 0x10]
push 0
push edx
push esi
push ebx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41c00c
mov edx, dword [esp + 0x10]
cmp edx, esi
jne 0x41c00c
jmp 0x41bfcd
mov eax, dword [ecx + 8]
test eax, eax
je 0x41bfcd
push eax
push 1
push esi
push ebx
call fcn.00430a21
add esp, 0x10
cmp eax, 1
jne 0x41c03c
mov edx, esi
mov dword [esp + 0x10], edx
add ebx, esi
sub ebp, esi
mov esi, dword [esp + 0x24]
mov eax, 0
sbb esi, eax
cmp edi, eax
mov dword [esp + 0x24], esi
je 0x41bff2
mov esi, dword [edi]
add esi, edx
mov dword [edi], esi
mov ecx, dword [edi + 4]
adc ecx, eax
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x24]
mov eax, ebp
or eax, ecx
jne 0x41bf61
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 0x14
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x41c030
mov edx, dword [esi]
push 1
push str.WriteFileError
mov ecx, esi
call dword [edx + 0x24]
mov ecx, esi
call fcn.0041c380
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0x14
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x41c04e
mov edx, dword [ecx]
push str.fwrite_failed.
call dword [edx + 0x14]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0x14