joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c2c0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x50c
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x508], eax
mov eax, dword [esp + 0x510]
lea ecx, [esp + 0x108]
push ecx
push eax
call fcn.00428830
push 0x105
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x41c3af
mov ecx, 0x4508c4
lea eax, [esp]
jmp 0x41c320
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41c340
test dl, dl
je 0x41c33c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41c340
add eax, 2
add ecx, 2
test dl, dl
jne 0x41c320
xor eax, eax
jmp 0x41c345
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41c393
mov ecx, str.FAT32
lea eax, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41c371
test dl, dl
je 0x41c36d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41c371
add eax, 2
add ecx, 2
test dl, dl
jne 0x41c351
xor eax, eax
jmp 0x41c376
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41c393
xor eax, eax
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.00441a0e
add esp, 0x50c
ret 4
mov eax, 1
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.00441a0e
add esp, 0x50c
ret 4
mov ecx, dword [esp + 0x508]
xor ecx, esp
xor al, al
call fcn.00441a0e
add esp, 0x50c
ret 4

Function at 0x41c3d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.0041efe0
test eax, eax
je 0x41c3fb
mov eax, dword [esp + 8]
test eax, eax
je 0x41c3fb
cmp word [eax], 0
je 0x41c3fb
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8
mov eax, dword [esp + 4]
test eax, eax
je 0x41c417
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41c417
mov eax, 1
ret 8
xor eax, eax
ret 8

Function at 0x41c420
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.0041efe0
test eax, eax
je 0x41c447
mov eax, dword [esp + 4]
test eax, eax
je 0x41c447
cmp word [eax], 0
je 0x41c447
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret 4
xor al, al
ret 4

Function at 0x41c4b0
Capabilities:
Get file attributes

Disassembly:
call fcn.0041efe0
test eax, eax
je 0x41c4d1
mov eax, dword [esp + 8]
test eax, eax
je 0x41c4d1
cmp word [eax], 0
je 0x41c4d1
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret 8
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x41c4e0
Capabilities:
Set file attributes

Disassembly:
call fcn.0041efe0
test eax, eax
je 0x41c50b
mov eax, dword [esp + 8]
test eax, eax
je 0x41c50b
cmp word [eax], 0
je 0x41c50b
mov ecx, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x41c527
mov edx, dword [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 0xc
xor al, al
ret 0xc
Function at 0x41c530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, dword [esp + 0x30]
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c540
sub eax, edx
mov ebx, eax
cmp ebx, 6
ja 0x41c55a
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 4
push ebp
push edi
lea ecx, [esp + 0x10]
call fcn.00438c60
lea ecx, [esp + 0x10]
call fcn.00438f30
lea ecx, [esp + 0x10]
call fcn.00438d70
mov ebp, eax
lea eax, [ebx + esi - 6]
xor edi, edi
mov dword [esp + 0x38], eax
lea ebx, [ebx + esi - 4]
lea eax, [edi + ebp]
cdq
mov ecx, 0xf4240
idiv ecx
push edx
mov edx, dword [esp + 0x3c]
push str._06u
push edx
call fcn.00441a1d
add esp, 0xc
mov byte [ebx], 0x2e
call fcn.0041efe0
test esi, esi
je 0x41c5c8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41c5c8
cmp edi, 0x3e8
je 0x41c5d4
inc edi
jmp 0x41c587
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret 4
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 4

Function at 0x41c5e0
Capabilities:
Move file

Disassembly:
mov eax, 0x1004
call fcn.00442380
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
mov ebp, dword [esp + 0x1018]
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1024]
call fcn.0041efe0
test eax, eax
je 0x41c66f
test esi, esi
je 0x41c62b
cmp word [esi], 0
jne 0x41c635
test edi, edi
je 0x41c66f
cmp word [edi], 0
je 0x41c66f
push 0x400
lea eax, [esp + 0x814]
push eax
push esi
push ebx
call fcn.004288d0
push 0x400
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
call fcn.004288d0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x41c677
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
test eax, eax
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.00441a0e
add esp, 0x1004
ret 0x10

Function at 0x41c8c0
Capabilities:
Delete directory

Disassembly:
sub esp, 0xc24
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0xc20], eax
push ebx
mov ebx, dword [esp + 0xc30]
push edi
mov edi, dword [esp + 0xc30]
lea eax, [esp + 0x414]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.0041c7f0
test al, al
je 0x41c925
call fcn.0041efe0
test eax, eax
je 0x41c91e
cmp word [esp + 0x414], 0
je 0x41c91e
lea edx, [esp + 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x41c948
lea eax, [esp + 8]
push eax
jmp 0x41c942
call fcn.0041efe0
test eax, eax
je 0x41c941
test ebx, ebx
je 0x41c941
cmp word [ebx], 0
je 0x41c941
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x41c948
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0xc28]
test eax, eax
pop edi
setne al
pop ebx
xor ecx, esp
call fcn.00441a0e
add esp, 0xc24
ret 8
Function at 0x41cba0
Capabilities:
Check if file exists
Create directory

Disassembly:
push esi
push edi
call fcn.0041efe0
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
test eax, eax
je 0x41cbc8
test esi, esi
je 0x41cbc8
cmp word [esi], 0
je 0x41cbc8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x41cbd5
test edi, edi
je 0x41cc08
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41cbf3
cmp byte [esp + 0x14], 0
je 0x41cbec
mov eax, dword [esp + 0x18]
push eax
push esi
push edi
call fcn.0041c4e0
pop edi
xor eax, eax
pop esi
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41cc08
cmp eax, 3
mov eax, 1
jne 0x41cc0d
mov eax, 2
pop edi
pop esi
ret 0x10

Function at 0x41cc20
Capabilities:
Create directory

Disassembly:
sub esp, 0x40c
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x408], eax
push ebp
mov ebp, dword [esp + 0x414]
test ebp, ebp
je 0x41cd85
cmp byte [ebp], 0
je 0x41cd85
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
mov byte [esp + 0xf], 1
mov edi, ebp
push esi
mov edi, edi
mov esi, edi
sub esi, ebp
cmp esi, 0x400
jge 0x41cd08
cmp byte [edi], 0x5c
jne 0x41cce6
push esi
lea eax, [esp + 0x1c]
push ebp
push eax
call fcn.00442870
add esp, 0xc
mov byte [esp + esi + 0x18], 0
call fcn.0041efe0
push 0
lea ecx, [esp + 0x1c]
push ecx
call ebx
test eax, eax
je 0x41ccdb
push 0
push 0
lea edx, [esp + 0x20]
push edx
call fcn.0041c4e0
lea eax, [esp + 0x18]
push eax
push 0xd66
call fcn.00432f80
push eax
call fcn.00412ab0
add esp, 8
push 0xd14
call fcn.00432f80
push eax
push 0x45086c
call fcn.00412ab0
add esp, 8
jmp 0x41cce6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
cmp byte [0x4679c8], 0
je 0x41ccfe
push edi
mov ecx, 0x4678c8
call fcn.004397a0
mov edi, eax
jmp 0x41ccff
inc edi
cmp byte [edi], 0
jne 0x41cc60
cmp byte [esp + 0x424], 0
pop esi
jne 0x41cd67
push ebp
call fcn.00428a80
movsx ecx, byte [eax]
push ecx
call fcn.00428560
test al, al
jne 0x41cd67
call fcn.0041efe0
push 0
push ebp
call ebx
test eax, eax
je 0x41cd5c
push 0
push 0
push ebp
call fcn.0041c4e0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.00441a0e
add esp, 0x40c
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.00441a0e
add esp, 0x40c
ret 8
mov ecx, dword [esp + 0x40c]
pop ebp
xor ecx, esp
xor al, al
call fcn.00441a0e
add esp, 0x40c
ret 8
Function at 0x41cda0
Capabilities:
Create directory

Disassembly:
sub esp, 0xc0c
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0xc08], eax
push ebx
push ebp
mov ebp, dword [esp + 0xc18]
xor ebx, ebx
cmp ebp, ebx
je 0x41cf0e
cmp word [ebp], bx
je 0x41cf0e
push esi
push edi
mov byte [esp + 0x13], 1
xor edi, edi
lea ebx, [ebx]
mov esi, edi
sar esi, 1
cmp esi, 0x400
jge 0x41ceb7
cmp word [edi + ebp], 0x5c
jne 0x41ceaa
push esi
lea eax, [esp + 0x41c]
push ebp
push eax
call fcn.00442994
xor ecx, ecx
add esp, 0xc
mov word [esp + esi*2 + 0x418], cx
call fcn.0041efe0
test eax, eax
je 0x41cea6
cmp word [esp + 0x418], bx
je 0x41cea6
push ebx
lea edx, [esp + 0x41c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41cea0
push ebx
lea eax, [esp + 0x41c]
push eax
push ebx
call fcn.0041c4e0
push 0x400
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x420]
push edx
call fcn.004390c0
lea eax, [esp + 0x18]
push eax
push 0xd66
mov byte [esp + 0x41f], bl
call fcn.00432f80
push eax
call fcn.00412ab0
add esp, 8
push 0xd14
call fcn.00432f80
push eax
push 0x45086c
call fcn.00412ab0
add esp, 8
jmp 0x41ceaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], bl
add edi, 2
cmp word [edi + ebp], bx
jne 0x41cde0
pop edi
pop esi
cmp byte [esp + 0xc1c], bl
jne 0x41cf08
push ebp
call fcn.004284e0
movzx ecx, word [eax]
push ecx
call fcn.00428560
test al, al
jne 0x41cf08
call fcn.0041efe0
test eax, eax
je 0x41cf04
cmp word [ebp], bx
je 0x41cf04
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41cefe
push ebx
push ebp
push ebx
call fcn.0041c4e0
mov al, byte [esp + 0xb]
jmp 0x41cf10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xb], bl
mov al, byte [esp + 0xb]
jmp 0x41cf10
xor al, al
mov ecx, dword [esp + 0xc10]
pop ebp
pop ebx
xor ecx, esp
call fcn.00441a0e
add esp, 0xc0c
ret 8
Function at 0x41cf70
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x830
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x82c], eax
mov eax, dword [esp + 0x844]
push ebx
mov ebx, dword [esp + 0x844]
push ebp
mov ebp, dword [esp + 0x83c]
push esi
mov esi, dword [esp + 0x848]
push edi
mov edi, dword [esp + 0x848]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], eax
call fcn.0041efe0
test eax, eax
je 0x41d10e
test esi, esi
je 0x41cfd2
cmp dword [esi], 0
mov byte [esp + 0x12], 1
jne 0x41cfd7
mov byte [esp + 0x12], 0
test ebx, ebx
je 0x41cfe5
cmp dword [ebx], 0
mov byte [esp + 0x11], 1
jne 0x41cfea
mov byte [esp + 0x11], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41cffc
cmp dword [eax], 0
mov byte [esp + 0x13], 1
jne 0x41d001
mov byte [esp + 0x13], 0
call fcn.0041efe0
test eax, eax
je 0x41d021
test edi, edi
je 0x41d021
cmp word [edi], 0
je 0x41d021
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x14], eax
jmp 0x41d02c
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x41d129
test al, 1
je 0x41d129
push 0
push edi
push ebp
mov bl, 1
call fcn.0041c4e0
push 0x400
lea ecx, [esp + 0x40]
push ecx
push edi
push ebp
call fcn.004288d0
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41d10e
cmp byte [esp + 0x12], 0
je 0x41d096
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push eax
call fcn.00438970
cmp byte [esp + 0x11], 0
je 0x41d0ab
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x24]
call fcn.00438970
cmp byte [esp + 0x13], 0
je 0x41d0c0
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
call fcn.00438970
movzx eax, byte [esp + 0x12]
movzx edx, byte [esp + 0x13]
neg eax
sbb eax, eax
lea ecx, [esp + 0x34]
and eax, ecx
movzx ecx, byte [esp + 0x11]
neg edx
push eax
sbb edx, edx
lea eax, [esp + 0x28]
and edx, eax
push edx
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x34]
and ecx, edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x41d10e
mov eax, dword [esp + 0x14]
push eax
push edi
push ebp
call fcn.0041c4e0
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00441a0e
add esp, 0x830
ret 0x14
xor bl, bl
jmp 0x41d048

Function at 0x41d230
Capabilities:
Set file attributes

Disassembly:
call fcn.0041efe0
test eax, eax
je 0x41d259
mov eax, dword [esp + 8]
test eax, eax
je 0x41d259
cmp word [eax], 0
je 0x41d259
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 4]
test eax, eax
je 0x41d273
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 8
Function at 0x41d440
Capabilities:
Delete file

Disassembly:
xor eax, eax
sub esp, 0x20
cmp dword [ecx + 0xc], eax
jbe 0x41d498
mov dword [ecx + 0xc], eax
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
mov eax, 0x54
push edx
mov dword [esp + 8], 3
mov word [esp + 0x14], ax
mov dword [esp + 0xc], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret
Function at 0x41d4a0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x44e9d6
mov eax, dword fs:[0]
push eax
mov eax, 0x1860
call fcn.00442380
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x185c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4577c0]
xor eax, esp
push eax
lea eax, [esp + 0x1874]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1884]
mov ebx, dword [esp + 0x1888]
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
call fcn.0041b0b0
push 1
xor ebp, ebp
push ebp
push ebx
push edi
lea ecx, [esp + 0x40]
mov dword [esp + 0x188c], ebp
call fcn.0041b4f0
test al, al
je 0x41d5ed
lea ecx, [esp + 0x30]
call fcn.0041b400
mov edi, 0x10000
push edi
mov dword [esp + 0x20], eax
mov ebx, edx
call fcn.00441ae7
mov esi, eax
add esp, 4
mov dword [esp + 0x24], esi
cmp esi, ebp
jne 0x41d54e
mov ecx, 0x46260c
call fcn.004171e0
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
push edi
push ebp
push esi
mov byte [esp + 0x1888], 1
call fcn.00441f20
add esp, 0xc
xor edi, edi
test ebx, ebx
jl 0x41d5a4
jg 0x41d580
cmp dword [esp + 0x1c], edi
jbe 0x41d5a4
jmp 0x41d580
push 0x10000
push esi
lea ecx, [esp + 0x38]
call fcn.0041bc10
add edi, 0x10000
adc ebp, 0
cmp ebp, ebx
jl 0x41d580
jg 0x41d5a4
cmp edi, dword [esp + 0x1c]
jb 0x41d580
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push 0
push 0
lea ecx, [esp + 0x3c]
call fcn.0041bb30
lea ecx, [esp + 0x30]
call fcn.0041b3a0
lea ecx, [esp + 0x30]
call fcn.0041b130
mov byte [esp + 0x187c], 0
test esi, esi
je 0x41d5e5
push esi
call fcn.00441765
add esp, 4
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0xc50]
push ecx
lea edx, [esp + 0x1468]
push edx
call fcn.0041c7f0
test al, al
je 0x41d644
call fcn.0041efe0
test eax, eax
je 0x41d62f
cmp word [esp + 0xc50], 0
je 0x41d62f
lea eax, [esp + 0xc50]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
jmp 0x41d66e
lea ecx, [esp + 0x1464]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne bl
jmp 0x41d66e
call fcn.0041efe0
test eax, eax
je 0x41d660
test ebx, ebx
je 0x41d660
cmp word [ebx], 0
je 0x41d660
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x41d667
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
mov bl, al
lea ecx, [esp + 0x30]
mov dword [esp + 0x187c], 0xffffffff
call fcn.0041b4c0
mov al, bl
mov ecx, dword [esp + 0x1874]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x185c]
xor ecx, esp
call fcn.00441a0e
add esp, 0x186c
ret 8
Function at 0x41d6b0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x44ea26
mov eax, dword fs:[0]
push eax
mov eax, 0x41ac
call fcn.00442380
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x41a8], eax
push ebp
push esi
push edi
mov eax, dword [0x4577c0]
xor eax, esp
push eax
lea eax, [esp + 0x41bc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x41cc]
push esi
call fcn.00428800
test al, al
je 0x41d971
push esi
call fcn.0041c0f0
test al, al
je 0x41d971
movsx eax, byte [esi]
push eax
lea ecx, [esp + 0x3988]
push 0x450904
push ecx
call fcn.00441a1d
movsx edx, byte [esp + 0x3990]
add esp, 0xc
push edx
push 0xdfe
call fcn.00432f80
push eax
call fcn.00412ab0
add esp, 8
lea ecx, [esp + 0x10]
call fcn.00438140
lea eax, [esp + 0x3984]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x41c8], 0
call fcn.004381a0
push 2
push 0
push 2
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1568]
call fcn.004350a0
lea ecx, [esp + 0xccc]
mov byte [esp + 0x41c4], 1
call fcn.00438c60
lea ecx, [esp + 0xcf0]
call fcn.00438c60
lea ecx, [esp + 0xd14]
call fcn.00438c60
lea edx, [esp + 0xb8]
push edx
lea ecx, [esp + 0x155c]
call fcn.00435bf0
test eax, eax
jne 0x41d93b
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41d7e0
mov al, byte [esi]
cmp byte [esp + 0xb8], al
jne 0x41d93b
cmp byte [esp + 0xb9], 0x3a
jne 0x41d93b
mov cx, word [esp + 0x4b8]
test cx, cx
je 0x41d827
movsx eax, al
movzx ecx, cx
cmp ecx, eax
jne 0x41d93b
cmp word [esp + 0x4ba], 0x3a
jne 0x41d93b
call fcn.0041efe0
test eax, eax
je 0x41d849
cmp word [esp + 0x4b8], 0
je 0x41d849
push 0
lea edx, [esp + 0x4bc]
push edx
call edi
jmp 0x41d855
push 0
lea eax, [esp + 0xbc]
push eax
call ebp
cmp byte [esp + 0xcc8], 0
je 0x41d899
call fcn.0041efe0
test eax, eax
je 0x41d886
cmp word [esp + 0x4b8], 0
je 0x41d886
lea ecx, [esp + 0x4b8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x41d91f
lea edx, [esp + 0xb8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x41d91f
call fcn.0041efe0
test eax, eax
je 0x41d8bd
cmp word [esp + 0x4b8], 0
je 0x41d8bd
lea eax, [esp + 0x4b8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x41d8cb
lea ecx, [esp + 0xb8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
test al, al
jne 0x41d91f
push 0xd48
call fcn.00432f80
push eax
lea edx, [esp + 0xbc]
push edx
lea eax, [esp + 0x3d8c]
push str._s____s
push eax
call fcn.00441a1d
lea ecx, [esp + 0x3d94]
push ecx
push 0x4505f4
push 0
call fcn.00413250
add esp, 0x1c
call fcn.004128b0
mov ecx, 0x46260c
call fcn.00416dc0
lea edx, [esp + 0xb8]
push edx
lea ecx, [esp + 0x155c]
call fcn.00435bf0
test eax, eax
je 0x41d7e0
lea ecx, [esp + 0x1558]
mov byte [esp + 0x41c4], 0
call fcn.00435350
mov eax, dword [esp + 0x20]
test eax, eax
je 0x41d960
push eax
call fcn.00441765
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41d971
push eax
call fcn.00441765
add esp, 4
mov ecx, dword [esp + 0x41bc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x41a8]
xor ecx, esp
call fcn.00441a0e
add esp, 0x41b8
ret 4
Function at 0x420f60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xb4
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xc0]
push ebp
xor edx, edx
push esi
add ebx, 0xffffff88
push edi
add eax, 2
lea edi, [esp + 0x20]
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
mov edi, edi
cmp edx, ebx
jge 0x4210c3
lea eax, [esp + 0x48]
sub eax, 2
lea ecx, [eax + 3]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x48]
sub ecx, eax
add ecx, 0xfffffffd
mov dword [esp + 0x3c], ecx
mov ecx, eax
neg ecx
lea esi, [esp + ecx + 0x48]
mov dword [esp + 0x44], esi
lea esi, [esp + ecx + 0x49]
mov dword [esp + 0x30], esi
lea esi, [esp + 0x48]
sub esi, eax
lea eax, [esp + ecx + 0x4a]
mov ecx, dword [esp + 0x14]
sub ebx, edx
mov dword [esp + 0x40], eax
dec ebx
mov eax, 0x88888889
mul ebx
dec esi
mov ebp, edx
shr ebp, 0xa
mov dword [esp + 0x2c], esi
mov esi, dword [edi]
mov dword [esp + 0x10], ecx
inc ebp
mov eax, dword [esp + 0x10]
xor edi, edi
lea ebx, [ebx]
movzx edx, byte [eax - 2]
mov cl, byte [eax - 1]
sub dl, cl
mov byte [esp + edi + 0x48], dl
movzx edx, byte [eax]
sub dl, cl
mov byte [esp + edi + 0x49], cl
mov byte [esp + edi + 0x4a], dl
add edi, 3
add eax, 3
cmp edi, 0x78
jl 0x421020
mov ecx, dword [esp + 0x34]
mov edi, 0x27
mov edi, edi
mov eax, dword [esp + 0x40]
movzx edx, byte [eax + ecx]
mov eax, dword [esp + 0x2c]
sub dl, byte [eax + ecx]
add ecx, 3
movsx eax, dl
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov edx, dword [esp + 0x44]
mov al, byte [edx + ecx - 3]
mov edx, dword [esp + 0x3c]
sub al, byte [edx + ecx - 3]
movsx eax, al
cdq
xor eax, edx
sub eax, edx
add ebx, eax
mov eax, dword [esp + 0x30]
movzx edx, byte [eax + ecx - 3]
sub dl, byte [ecx - 3]
movsx eax, dl
cdq
xor eax, edx
sub eax, edx
add eax, esi
sub edi, 1
lea esi, [eax + ebx]
jne 0x421050
add dword [esp + 0x10], 0x780
sub ebp, 1
jne 0x421014
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [edi], esi
inc dword [esp + 0x14]
inc edx
add edi, 4
cmp edx, 2
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edi
jle 0x420fb0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
cmp eax, ecx
ja 0x42110d
cmp eax, edx
ja 0x42110d
xor eax, eax
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.00441a0e
add esp, 0xb4
ret 8
cmp edx, ecx
mov ecx, dword [esp + 0xb0]
sbb eax, eax
neg eax
xor ecx, esp
inc eax
call fcn.00441a0e
add esp, 0xb4
ret 8
Function at 0x423b00
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0
push 0
mov esi, ebp
push 1
mov edi, ecx
shl esi, 5
push 0
add esi, edi
call ebx
push 0
push 0
push 1
push 0
mov dword [esi + 8], eax
call ebx
mov dword [esi + 0xc], eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x4215d0
push 0x10000
push 0
mov dword [esi + 0x14], 0
mov byte [esi + 0x18], 0
mov byte [esi + 4], 1
mov dword [esi + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x423b88
push str.CreateThread_failed
mov ecx, 0x46260c
call fcn.00417100
mov ecx, 0x46260c
call fcn.00416dc0
push 2
mov ecx, 0x46260c
call fcn.004171c0
push 1
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov dword [esi], ebx
mov dword [esp + 0x1c], ebp
call fcn.00421730
pop edi
pop esi
pop ebp
pop ebx
ret 4