joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42cb60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
call fcn.0042c230
cmp eax, 1
jne 0x42cb92
push str._Zip_cloacking
push 0x3fa
call fcn.0042ae10
add esp, 8
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x452f2c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.MSVCRT.dll_rewind]
mov edx, dword [0x452f2c]
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x104]
mov esi, dword [sym.imp.MSVCRT.dll_fread]
mov dword [0x45327e], 0
mov dword [0x4532a2], 0
rep stosd dword es:[edi], eax
mov eax, dword [edx]
mov ecx, dword [0x453068]
push eax
push 0x1e
push 1
push ecx
call esi
add esp, 0x14
cmp eax, 0x1e
jne 0x42ccba
mov eax, dword [0x453068]
mov edx, dword [0x452f2c]
cmp dword [eax], 0x4034b50
jne 0x42ccd7
mov ecx, dword [edx]
xor edx, edx
mov dx, word [eax + 0x1a]
push ecx
push edx
lea eax, [ebp - 0x104]
push 1
push eax
call esi
mov ecx, dword [0x453068]
xor edx, edx
add esp, 0x10
mov dx, word [ecx + 0x1a]
cmp eax, edx
jne 0x42ccba
mov eax, dword [0x452f2c]
mov edx, dword [eax]
push edx
push ecx
call fcn.0042ccf0
add esp, 8
cmp eax, 1
je 0x42ccba
mov eax, dword [0x453068]
mov edx, dword [0x4532a2]
push 0
push 0
mov ecx, dword [eax + 0x16]
push 0
add edx, ecx
mov ecx, dword [0x45327e]
mov dword [0x4532a2], edx
mov edx, dword [eax + 0x16]
lea eax, [ebp - 0x104]
push edx
push eax
push ecx
call fcn.00432b40
add esp, 0x18
test eax, eax
jne 0x42cccc
mov edi, dword [0x45327e]
mov edx, dword [0x452f2c]
inc edi
mov ecx, 0x41
mov dword [0x45327e], edi
lea edi, [ebp - 0x104]
rep stosd dword es:[edi], eax
mov eax, dword [edx]
mov ecx, dword [0x453068]
push eax
push 0x1e
push 1
push ecx
call esi
add esp, 0x10
cmp eax, 0x1e
je 0x42cbeb
push 0x441880
push 0x3e9
call fcn.0042ae10
add esp, 8
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [edx]
push eax
call fcn.0042cd50
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42cd50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
call fcn.0042c230
cmp eax, 1
jne 0x42cd80
push str._Zip_cloacking
push 0x3fa
call fcn.0042ae10
add esp, 8
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x452f2c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.MSVCRT.dll_rewind]
mov edx, dword [0x452f2c]
mov ecx, dword [0x453068]
mov esi, dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [edx]
push eax
push 0x1e
push 1
push ecx
call esi
add esp, 0x14
cmp eax, 0x1e
jne 0x42cde6
mov edx, dword [0x452f2c]
xor ecx, ecx
mov eax, dword [edx]
mov edx, dword [0x453068]
push eax
lea eax, [ebp - 0x104]
mov cx, word [edx + 0x1a]
push ecx
push 1
push eax
call esi
mov ecx, dword [0x453068]
xor edx, edx
add esp, 0x10
mov dx, word [ecx + 0x1a]
cmp eax, edx
je 0x42ce02
push 0x441880
push 0x3e9
call fcn.0042ae10
add esp, 8
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ax, word [ecx + 0x1c]
cmp eax, 0xa00b0
jbe 0x42ce19
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, eax
dec eax
test ecx, ecx
je 0x42ce39
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_getc]
push edi
mov edi, dword [ebp + 8]
lea esi, [eax + 1]
push edi
call ebx
add esp, 4
dec esi
jne 0x42ce2e
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42ce40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [0x452f2c]
xor edx, edx
push ebx
mov dword [ebp - 4], edx
mov eax, dword [ecx]
mov dword [ebp - 8], edx
mov bl, byte [ecx + 0x17]
cmp bl, dl
pop ebx
jne 0x42ce83
push eax
push 1
lea eax, [ebp - 4]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [0x452f3a]
add esp, 0x10
dec eax
mov dword [0x452f3a], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45306c]
cmp byte [ecx], 1
jne 0x42ceb7
lea edx, [ebp - 8]
push edx
push eax
lea eax, [ebp - 4]
push eax
push 1
call fcn.0042e050
add esp, 0x10
test eax, eax
jne 0x42ced4
mov eax, dword [0x452f3a]
dec eax
mov dword [0x452f3a], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
push ecx
push eax
push edx
push 1
call fcn.0042df10
add esp, 0x10
test eax, eax
jne 0x42ced4
dec dword [0x452f3a]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x42cee0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [0x452f2c]
mov dword [ebp - 8], 0
mov dl, byte [ecx + 0x17]
mov eax, dword [ecx]
test dl, dl
jne 0x42cf22
push eax
push 4
lea eax, [ebp - 4]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [0x452f3a]
add esp, 0x10
sub eax, 4
mov dword [0x452f3a], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45306c]
cmp byte [ecx], 1
jne 0x42cf58
lea edx, [ebp - 8]
push edx
push eax
lea eax, [ebp - 4]
push eax
push 4
call fcn.0042e050
add esp, 0x10
test eax, eax
jne 0x42cf76
mov eax, dword [0x452f3a]
sub eax, 4
mov dword [0x452f3a], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
push ecx
push eax
push edx
push 4
call fcn.0042df10
add esp, 0x10
test eax, eax
jne 0x42cf76
sub dword [0x452f3a], 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x42cf80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x452f2c]
mov dword [ebp - 4], 0
mov dl, byte [ecx + 0x19]
mov eax, dword [ecx + 4]
test dl, dl
jne 0x42cfbc
push eax
push 1
lea eax, [ebp + 8]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
mov eax, dword [0x452f3a]
add esp, 0x10
inc eax
mov dword [0x452f3a], eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45306c]
cmp byte [ecx], 1
jne 0x42cfe8
lea edx, [ebp - 4]
push edx
push eax
lea eax, [ebp + 8]
push eax
push 1
call fcn.0042ddb0
add esp, 0x10
test eax, eax
jne 0x42d005
inc dword [0x452f3a]
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
lea edx, [ebp + 8]
push ecx
push eax
push edx
push 1
call fcn.0042dbf0
add esp, 0x10
test eax, eax
jne 0x42d005
inc dword [0x452f3a]
mov esp, ebp
pop ebp
ret

Function at 0x42d010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x452f2c]
mov edx, dword [ebp + 8]
mov dword [ebp + 8], edx
mov dword [ebp - 4], 0
mov dl, byte [ecx + 0x19]
mov eax, dword [ecx + 4]
test dl, dl
jne 0x42d054
push eax
push 4
lea eax, [ebp + 8]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
mov eax, dword [0x452f3a]
add esp, 0x10
add eax, 4
mov dword [0x452f3a], eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45306c]
cmp byte [ecx], 1
jne 0x42d081
lea edx, [ebp - 4]
push edx
push eax
lea eax, [ebp + 8]
push eax
push 4
call fcn.0042ddb0
add esp, 0x10
test eax, eax
jne 0x42d09f
add dword [0x452f3a], 4
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
lea edx, [ebp + 8]
push ecx
push eax
push edx
push 4
call fcn.0042dbf0
add esp, 0x10
test eax, eax
jne 0x42d09f
add dword [0x452f3a], 4
mov esp, ebp
pop ebp
ret
Function at 0x42dbf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x45306c]
mov edx, dword [ebp + 8]
push ebx
push esi
mov ecx, dword [eax + 9]
push edi
mov edi, dword [eax + 0xd]
lea esi, [edi + edx]
cmp esi, ecx
jle 0x42dd80
mov esi, dword [ebp + 0x14]
mov ebx, ecx
sub ebx, edi
sub edi, ecx
add edi, edx
test ebx, ebx
jle 0x42dc47
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ebx
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, ebx
mov dword [esi], eax
je 0x42dc42
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov eax, dword [0x45306c]
cmp edi, dword [eax + 9]
jle 0x42dce9
mov ecx, dword [0x452f2c]
mov eax, dword [eax + 1]
lea edx, [ebp + 0x10]
push 1
push edx
add ecx, 0x127
push eax
push ecx
call fcn.0042da50
add esp, 0x10
cmp eax, 1
je 0x42dd15
mov eax, dword [0x45306c]
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [esi]
mov ecx, dword [eax + 9]
mov eax, dword [ebp + 0xc]
push ecx
add edx, eax
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov ebx, dword [esi]
add ebx, eax
mov dword [esi], ebx
mov eax, dword [0x45306c]
mov ecx, dword [eax + 9]
mov dword [eax + 0xd], ecx
mov eax, dword [0x45306c]
mov edx, dword [eax + 9]
mov ecx, dword [eax + 1]
sub edi, edx
inc ecx
mov dword [eax + 1], ecx
mov eax, dword [0x45306c]
mov edx, dword [0x452f2c]
mov ecx, dword [eax + 1]
add edx, 0x127
dec ecx
push edx
push ecx
push 0xc02
call fcn.0042be50
mov eax, dword [0x45306c]
add esp, 0x1c
cmp edi, dword [eax + 9]
jg 0x42dc50
test edi, edi
je 0x42dd9c
mov ecx, dword [0x452f2c]
mov eax, dword [eax + 1]
lea edx, [ebp + 0x10]
push 1
push edx
add ecx, 0x127
push eax
push ecx
call fcn.0042da50
add esp, 0x10
cmp eax, 1
jne 0x42dd25
mov dword [esi], 0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, dword [ebp + 0xc]
push edx
push edi
add eax, ecx
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
mov ecx, dword [esi]
add ecx, eax
mov dword [esi], ecx
mov ecx, dword [0x45306c]
mov dword [ecx + 0xd], edi
mov eax, dword [0x45306c]
mov ebx, dword [eax + 1]
inc ebx
mov dword [eax + 1], ebx
mov eax, dword [0x45306c]
mov edx, dword [0x452f2c]
mov ecx, dword [eax + 1]
add edx, 0x127
dec ecx
push edx
push ecx
push 0xc02
call fcn.0042be50
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0xd], esi
mov eax, dword [ebp + 0x10]
push eax
push edx
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov edx, dword [ebp + 0x14]
add esp, 0x10
mov dword [edx], eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x42de50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x452f2c]
mov dword [ebp - 4], 0
push esi
push edi
mov cl, byte [eax + 0x19]
test cl, cl
jne 0x42de84
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edi
push esi
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
jmp 0x42deeb
mov eax, dword [0x45306c]
cmp byte [eax], 1
jne 0x42debb
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 4]
mov edx, dword [ebp + 0x14]
push ecx
mov ecx, esi
mov eax, dword [ebp + 8]
imul ecx, edi
push edx
push eax
push ecx
call fcn.0042ddb0
add esp, 0x10
test eax, eax
je 0x42dee8
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 4]
mov eax, dword [ebp + 0x14]
push edx
mov edx, esi
mov ecx, dword [ebp + 8]
imul edx, edi
push eax
push ecx
push edx
call fcn.0042dbf0
add esp, 0x10
test eax, eax
je 0x42dee8
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
imul esi, edi
mov ecx, dword [0x452f3a]
pop edi
add ecx, esi
pop esi
mov dword [0x452f3a], ecx
mov esp, ebp
pop ebp
ret

Function at 0x42df10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
mov esi, dword [ebp + 0x14]
add esp, 0x10
cmp eax, edi
mov dword [esi], eax
je 0x42e046
sub edi, eax
mov eax, dword [0x45306c]
cmp edi, dword [eax + 9]
jle 0x42dfd3
mov edx, dword [eax + 1]
mov eax, dword [0x452f2c]
lea ecx, [ebp + 0x10]
push 0
push ecx
add eax, 0x127
push edx
push eax
call fcn.0042da50
add esp, 0x10
cmp eax, 1
je 0x42dff4
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x45306c]
push ecx
mov ecx, dword [esi]
mov eax, dword [edx + 9]
add ecx, ebx
push eax
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi]
add ecx, eax
mov dword [esi], ecx
mov eax, dword [0x45306c]
mov edx, dword [eax + 9]
mov eax, dword [eax + 1]
sub edi, edx
mov edx, dword [0x452f2c]
add edx, 0x127
push edx
push eax
push 0xc03
call fcn.0042be50
mov eax, dword [0x45306c]
add esp, 0x1c
mov edx, dword [eax + 1]
inc edx
mov dword [eax + 1], edx
mov eax, dword [0x45306c]
cmp edi, dword [eax + 9]
jg 0x42df4a
mov edx, dword [eax + 1]
mov eax, dword [0x452f2c]
lea ecx, [ebp + 0x10]
push 0
push ecx
add eax, 0x127
push edx
push eax
call fcn.0042da50
add esp, 0x10
test eax, eax
je 0x42e004
mov dword [esi], 0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi]
push ecx
push edi
add edx, ebx
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi]
add ecx, eax
mov dword [esi], ecx
mov eax, dword [0x452f2c]
mov ecx, dword [0x45306c]
add eax, 0x127
push eax
mov edx, dword [ecx + 1]
push edx
push 0xc03
call fcn.0042be50
mov eax, dword [0x45306c]
add esp, 0x1c
inc dword [eax + 1]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x42e0f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x452f2c]
mov dword [ebp - 4], 0
push esi
push edi
mov cl, byte [eax + 0x17]
test cl, cl
jne 0x42e124
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edi
push esi
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
jmp 0x42e18b
mov eax, dword [0x45306c]
cmp byte [eax], 1
jne 0x42e15b
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 4]
mov edx, dword [ebp + 0x14]
push ecx
mov ecx, esi
mov eax, dword [ebp + 8]
imul ecx, edi
push edx
push eax
push ecx
call fcn.0042e050
add esp, 0x10
test eax, eax
je 0x42e188
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 4]
mov eax, dword [ebp + 0x14]
push edx
mov edx, esi
mov ecx, dword [ebp + 8]
imul edx, edi
push eax
push ecx
push edx
call fcn.0042df10
add esp, 0x10
test eax, eax
je 0x42e188
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
imul esi, edi
mov ecx, dword [0x452f3a]
pop edi
sub ecx, esi
pop esi
mov dword [0x452f3a], ecx
mov esp, ebp
pop ebp
ret

Function at 0x42f040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0x14]
push esi
mov esi, dword [0x452f2c]
push edi
test al, al
je 0x42f05e
mov al, byte [esi + 0x331]
test al, al
je 0x42f0b6
jmp 0x42f068
mov al, byte [esi + 0x332]
test al, al
je 0x42f0b6
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
mov al, byte [esi + 0x332]
not ecx
dec ecx
mov edi, ecx
dec edi
test al, al
je 0x42f0b6
test edi, edi
jle 0x42f0b6
mov eax, dword [ebp + 0x10]
xor esi, esi
test eax, eax
jbe 0x42f0b6
mov ecx, dword [ebp + 0xc]
push ebx
xor eax, eax
test edi, edi
jle 0x42f0ad
mov bl, byte [eax + edx]
xor byte [esi + ecx], bl
mov bl, byte [eax + edx + 1]
xor byte [eax + edx], bl
inc eax
cmp eax, edi
jl 0x42f09b
mov eax, dword [ebp + 0x10]
inc esi
cmp esi, eax
jb 0x42f095
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x42f460
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
mov edx, dword [ebp + 8]
push 0
lea eax, [ebp - 0x208]
push 0
lea ecx, [ebp - 0x104]
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__splitpath]
push 0
lea eax, [ebp - 0x208]
push 0
lea ecx, [ebp - 0x104]
push eax
lea edx, [ebp - 0x30c]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__makepath]
add esp, 0x28
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x430890
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x208]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [ebp - 0x104]
rep stosd dword es:[edi], eax
mov al, byte [ebx + 1]
mov cl, 0x3a
cmp al, cl
mov eax, dword [ebp + 0xc]
mov dl, byte [eax + 1]
je 0x430927
cmp dl, cl
je 0x43092b
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
push 0
lea ecx, [ebp - 0x104]
push 0
lea edx, [ebp - 0x208]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__splitpath]
mov al, byte [ebp - 0x104]
add esp, 0x14
test al, al
je 0x430996
lea edi, [ebp - 0x104]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ebp + ecx - 0x105], 0x5c
je 0x430996
jmp 0x430966
cmp dl, cl
jne 0x430996
push 0
push 0
lea ecx, [ebp - 0x104]
push 0
push ecx
push eax
call dword [sym.imp.MSVCRT.dll__splitpath]
mov al, byte [ebp - 0x104]
add esp, 0x14
test al, al
je 0x430996
lea edi, [ebp - 0x104]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ebp + ecx - 0x105], 0x5c
je 0x430996
mov edi, 0x43fe58
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x104]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x104]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [ebp - 0x104]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4325c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov edx, ecx
dec ecx
mov eax, dword [edi]
test edx, edx
je 0x4325fb
push ebx
push esi
lea esi, [ecx + 1]
mov ecx, dword [ebp + 8]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x441454]
xor eax, edx
inc ecx
dec esi
jne 0x4325db
pop esi
pop ebx
not eax
mov dword [edi], eax
pop edi
pop ebp
ret
Function at 0x432610
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov edx, eax
dec eax
mov ecx, dword [edi]
test edx, edx
je 0x43266f
mov edx, dword [ebp + 8]
push ebx
push esi
lea esi, [eax + 1]
xor eax, eax
mov ax, word [edx]
add edx, 2
mov ebx, eax
xor ebx, ecx
and ebx, 0xff
mov dword [ebp + 0x10], ebx
mov ebx, ecx
mov ecx, dword [ebp + 0x10]
shr ebx, 8
mov ecx, dword [ecx*4 + 0x441454]
xor ecx, ebx
mov ebx, ecx
shr eax, 8
and ebx, 0xff
xor eax, ebx
shr ecx, 8
mov eax, dword [eax*4 + 0x441454]
xor ecx, eax
dec esi
jne 0x43262b
pop esi
pop ebx
not ecx
mov dword [edi], ecx
pop edi
pop ebp
ret
Function at 0x40652d
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00406016
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
test cl, 8
je 0x406562
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x470648], eax
jmp 0x406708
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x40657d
test eax, eax
je 0x4066b3
test cl, 2
je 0x4066b3
push edi
push ebx
mov esi, 0x45b8f8
push esi
call fcn.00405a8c
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x4065a0
push 0x4089b4
push esi
call edi
jmp 0x4065a6
push ebx
call fcn.00405fe9
cmp word [ebx], 0
jne 0x4065b6
cmp word [0x45b8f8], 0x5c
jne 0x4065be
push 0x4082c8
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebx + eax*2]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x4066a2
lea esi, [ebp - 0x230]
push 0x3f
mov eax, esi
push eax
call fcn.00405787
xor edi, edi
cmp word [eax], di
je 0x406605
cmp word [ebp - 0x28], di
je 0x406605
lea esi, [ebp - 0x28]
cmp word [esi], 0x2e
jne 0x406620
movzx eax, word [esi + 2]
cmp ax, di
je 0x40667f
cmp ax, 0x2e
jne 0x406620
cmp word [esi + 4], di
je 0x40667f
push esi
push dword [ebp - 4]
call fcn.00405a8c
test byte [ebp - 0x25c], 0x10
je 0x406647
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x40667f
push dword [ebp + 0xc]
push ebx
call fcn.0040652d
jmp 0x40667f
push ebx
call fcn.004058b2
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x406677
test byte [ebp + 0xc], 4
je 0x40666f
push ebx
push 0xfffffffffffffff1
call fcn.00404a47
push edi
push ebx
call fcn.004064fa
jmp 0x40667f
inc dword [0x470648]
jmp 0x40667f
push ebx
push 0xfffffffffffffff2
call fcn.00404a47
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4065e5
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4066a4
xor edi, edi
cmp dword [ebp + 8], edi
pop edi
je 0x4066b3
mov ecx, dword [ebp - 4]
xor eax, eax
mov word [ecx - 2], ax
xor esi, esi
cmp dword [ebp + 8], esi
je 0x406707
cmp dword [ebp - 0xc], esi
je 0x4066f7
push ebx
call fcn.00405b6c
test eax, eax
je 0x406707
push ebx
call fcn.00405fba
push ebx
call fcn.004058b2
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4066ff
test byte [ebp + 0xc], 4
je 0x4066f7
push ebx
push 0xfffffffffffffff1
call fcn.00404a47
push esi
push ebx
call fcn.004064fa
jmp 0x406707
inc dword [0x470648]
jmp 0x406707
push ebx
push 0xffffffffffffffe5
call fcn.00404a47
pop esi
pop ebx
leave
ret 8