joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016870
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10016d08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1002a060]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x10016600
push 0x1002c0c8
call fcn.100162a0
mov eax, dword [0x1002c0d0]
add esp, 8
test eax, eax
je 0x100168c9
push dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret
lea ecx, [esp + 4]
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_void_]
mov dword [esp + 0x10], 0
mov dword [esp + 4], vtable.boost::thread_resource_error.0
lea eax, [esp + 4]
push eax
mov dword [esp + 0x20], 0
call fcn.1000c300
int3

Function at 0x42e560
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1b000]
push edi
or ebp, 0xffffffff
jmp 0x42e582
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42e589
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42e578
mov eax, 1
add ebx, ebx
jne 0x42e59b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42e590
jne 0x42e5ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42e590
xor ecx, ecx
sub eax, 3
jb 0x42e5c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42e632
mov ebp, eax
add ebx, ebx
jne 0x42e5cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42e5d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42e5fc
inc ecx
add ebx, ebx
jne 0x42e5e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42e5dd
jne 0x42e5f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42e5dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42e61c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42e60d
jmp 0x42e57e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42e61c
add edi, ecx
jmp 0x42e57e
pop esi
mov edi, esi
mov ecx, 0x761
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42e63a
cmp byte [edi], 0xc
jne 0x42e63a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42e63f
lea edi, [esi + 0x2c000]
mov eax, dword [edi]
or eax, eax
je 0x42e6b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x30954]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x30a1c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42e66c
mov ecx, edi
jns 0x42e69b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x30a20]
or eax, eax
je 0x42e6b1
mov dword [ebx], eax
add ebx, 4
jmp 0x42e689
call dword [esi + 0x30a24]
popal
jmp 0x41a05e
Function at 0x43717a
Capabilities:
Encode data using xor

Disassembly:
imul ebp
xchg esi, eax
fiadd dword [eax - 0x47d1fc47]
sahf
jae 0x4371a3
push 0xffffffffffffffc5
outsb dx, byte [esi]
mov cl, al
dec ebp
push ss
and edi, ebx
push esi
jns 0x437107
mov esp, 0xce1066d6
invalid
pop ss
into
add al, 0xe
jl 0x437115
add dword [ecx + 0x271b2c8d], 0xffffffbb
aaa
xchg byte [edi - 2], ch
idiv edi
jecxz 0x43715e
invalid
ror byte [edx + 0x5eae8a27], 0x45
xlatb
push esp
pop ecx
and al, 0x4e
push ds
or dl, bl
jne 0x43713d
xor ah, byte [eax]
in al, 0xfe
invalid

Function at 0x44503e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xdc3b2590
inc eax
cmpsd dword [esi], dword es:[edi]
jno 0x44505d
mov byte [0xb23ef3a3], al
xchg edx, eax
nop
xchg edx, eax
xchg ecx, eax
jecxz 0x444fe4
dec edx
das
sbb dword [edx], edi
cmpsb byte [esi], byte es:[edi]
inc eax
adc cl, bl
ficom dword [eax + 0x6aeb5713]
sub ah, byte [ecx + 0x4fb1b322]
xor ecx, dword [ecx + edx - 0x7a]
xchg byte [edx - 0x4e8fa839], al
insb byte es:[edi], dx
sbb bl, al
jno 0x445029
adc bh, byte [esi + ebx*8]
invalid

Function at 0x4659be
Capabilities:
Encode data using xor

Disassembly:
mov byte [esi - 0x18], dh
movsd dword es:[edi], dword [esi]
out dx, al
mov ch, 0x38
dec esp
je 0x4659b9
invalid

Function at 0x4a1e12
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0xe99667a7
xor ebp, esi
jg fcn.004a1e12
pop ebx
mov cs, word [ebx - 0x44]
retf

Function at 0x4bad51
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c5398
cmp edx, dword [eax]
je 0x4bad73
add eax, 8
inc ecx
cmp eax, 0x4c5428
jl 0x4bad64
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c5398]
jne 0x4baea1
mov eax, dword [0x4c9d24]
cmp eax, 1
je 0x4bae7b
test eax, eax
jne 0x4bada4
cmp dword [0x4c52c0], 1
je 0x4bae7b
cmp edx, 0xfc
je 0x4baea1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4baddb
lea eax, [ebp - 0x1a4]
push 0x4c0d58
push eax
call fcn.004bb730
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbbc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bae1e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbbc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0d54
push edi
call fcn.004bda90
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0d38
push eax
call fcn.004bb730
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb740
lea eax, [ebp - 0xa0]
push 0x4c0d34
push eax
call fcn.004bb740
push dword [esi + 0x4c539c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb740
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c0d0c
push eax
call fcn.004bda04
add esp, 0x2c
pop edi
jmp 0x4baea1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c539c]
push 0
push eax
push dword [esi]
call fcn.004bbbc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x410f5c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42104c]
jne 0x413fe3
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x422720], eax
mov dword [0x42271c], ecx
mov dword [0x422718], edx
mov dword [0x422714], ebx
mov dword [0x422710], esi
mov dword [0x42270c], edi
mov word [0x422738], ss
mov word [0x42272c], cs
mov word [0x422708], ds
mov word [0x422704], es
mov word [0x422700], fs
mov word [0x4226fc], gs
pushfd
pop dword [0x422730]
mov eax, dword [ebp]
mov dword [0x422724], eax
mov eax, dword [ebp + 4]
mov dword [0x422728], eax
lea eax, [ebp + 8]
mov dword [0x422734], eax
mov eax, dword [ebp - 0x320]
mov dword [0x422670], 0x10001
mov eax, dword [0x422728]
mov dword [0x422624], eax
mov dword [0x422618], 0xc0000409
mov dword [0x42261c], 1
mov eax, dword [0x42104c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x421050]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x422668], eax
push 1
call fcn.00415efd
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x402cf0
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x422668], 0
jne 0x4140cf
push 1
call fcn.00415efd
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x416456
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x416465
pop dword [ebp - 4]
mov eax, 0xa462b82f
sub eax, 0xa42153ca
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x3c0ca
push 0
mov eax, 0x9602f34f
sub eax, 0x95c2e22f
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x4659106d
sub ecx, 0x4658c367
xor edi, edi
add edi, eax
mov ebx, 0x3bc211f0
add ebx, 0xc4806410
add ebx, dword [ebp - 4]
mov esi, 0x7dd21dfa
mov edx, dword [ebx]
xor edx, esi
mov dword [edi], edx
add edi, 0xcef97a1a
sub edi, 0xcef97a16
add ebx, 4
loop 0x4164c0
add eax, 0x4dfef6ad
sub eax, 0x4dfdcfc2
mov ebx, eax
add eax, 0x4f057f67
add eax, 0xb0fa809e
mov ecx, 0x6f98d469
add ecx, 0x90a72b97
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6a
nop
sub eax, 0x403d10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x28ca6edc
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x190b0fdb
nop
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x427a91
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00427a9c
Function at 0x10013074
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10013083
pop dword [ebp - 0x3c]
mov eax, 0xde43e675
sub eax, 0xce42b5f2
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x6f562ff9
add dword [ebp - 0x4c], 0xdefc1552
mov dword [ebp - 0x48], 0x4938b80d
add dword [ebp - 0x48], 0xe8fa9438
mov dword [ebp - 0x44], 0x19b71a95
add dword [ebp - 0x44], 0x32952999
mov dword [ebp - 0x40], 0x32838830
add dword [ebp - 0x40], 0xcd7c77d0
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xcb5b0194
add eax, 0x44a64f04
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xbff8d2e8
sub dword [ebp - 0x4c], 0x4b866992
mov dword [ebp - 0x48], 0x6d71b14c
add dword [ebp - 0x48], 0xd3fab029
mov dword [ebp - 0x44], 0xb0e4fbc9
add dword [ebp - 0x44], 0xb28a70a3
mov dword [ebp - 0x40], 0xfff87bf9
sub dword [ebp - 0x40], 0xfff87bf9
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x1d80b4fa
add eax, 0xf2809ba2
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x381b8
push 0
call eax
mov ecx, 0x45e2
mov esi, eax
mov edx, 0xc51dcc50
sub edx, 0xb519b050
add edx, dword [ebp - 0x3c]
mov ebx, 0xf55ba7dd
sub ebx, 0x8103c0e8
sub dword [ebp - 0x34], 0x68921919
mov edi, dword [edx]
xor dword [ebp - 0x38], 0x42316f15
add edi, ebx
mov dword [ebp - 0x24], 0x1fb258af
mov dword [esi], edi
add dword [ebp - 0x30], edi
add esi, 4
add edx, 0x93ff84c3
sub edx, 0x93ff84bf
loop 0x1001319f
add eax, 0x7baa1604
add eax, 0x8456f457
xor ebx, ebx
add ebx, eax
add eax, 0xcb3616f7
sub eax, 0xcb3616f2
mov ecx, 0x58b86ba
add ecx, 0xa747946
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401daf
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56c17c
call fcn.004fb864
push ecx
mov eax, dword [0x655358]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x18], eax
mov eax, dword [0x655358]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x28], eax
mov eax, dword [0x655358]
mov dword [esi + 0x2c], eax
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 2
call fcn.00401d55
push 4
mov edi, 0x65d130
pop eax
lea ecx, [esi + 0x18]
push edi
mov byte [ebp - 4], 3
mov dword [esi], ebx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.00552978
push edi
lea ecx, [esi + 0x28]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
call fcn.00552978
push edi
lea ecx, [esi + 0x2c]
call fcn.00552978
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x401dc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56c17c
call fcn.004fb864
push ecx
mov eax, dword [0x655358]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x18], eax
mov eax, dword [0x655358]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x28], eax
mov eax, dword [0x655358]
mov dword [esi + 0x2c], eax
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 2
call fcn.00401d55
push 4
mov edi, 0x65d130
pop eax
lea ecx, [esi + 0x18]
push edi
mov byte [ebp - 4], 3
mov dword [esi], ebx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.00552978
push edi
lea ecx, [esi + 0x28]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
call fcn.00552978
push edi
lea ecx, [esi + 0x2c]
call fcn.00552978
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40c15d
Capabilities:
Check os version

Disassembly:
mov eax, 0x56ce4b
call fcn.004fb864
sub esp, 0x118
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 0x1c]
mov esi, ecx
mov dword [ebp - 0x10], esi
push ebx
call fcn.005576cf
mov eax, dword [0x655358]
mov dword [ebp - 4], ebx
mov dword [esi + 0x64], eax
cmp dword [ebp + 0x20], ebx
mov byte [ebp - 4], 1
mov dword [esi], 0x585020
jne 0x40c1e3
mov edi, 0x114
lea eax, [ebp - 0x124]
push edi
push ebx
push eax
call fcn.004fb890
add esp, 0xc
lea eax, [ebp - 0x124]
mov dword [ebp - 0x124], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 2
jne 0x40c1dc
cmp dword [ebp - 0x120], 5
mov dword [ebp + 0x20], 0x58
jae 0x40c1e3
mov dword [ebp + 0x20], 0x4c
push dword [ebp + 0x20]
call fcn.004fc03e
cmp eax, ebx
pop ecx
mov dword [esi + 0x5c], eax
jne 0x40c1f8
call fcn.0055023a
push dword [ebp + 0x20]
mov ecx, esi
push ebx
call fcn.0040c3bd
push eax
call fcn.004fb890
push 0x200002
call fcn.00552dd0
mov dword [esi + 0xe8], eax
mov word [eax], bx
mov eax, dword [ebp + 8]
add esp, 0x10
mov dword [esi + 0x60], eax
lea edi, [esi + 0x68]
neg eax
sbb eax, eax
mov ecx, esi
add eax, 0x7005
mov word [edi], bx
mov dword [esi + 0xec], ebx
mov dword [esi + 0x3c], eax
call fcn.0040c3bd
mov ecx, dword [ebp + 0x20]
mov dword [eax], ecx
mov ecx, esi
call fcn.0040c3bd
mov ecx, dword [esi + 0xe8]
mov dword [eax + 0x1c], ecx
mov ecx, esi
call fcn.0040c3bd
mov ecx, esi
mov dword [eax + 0x20], 0x100000
call fcn.0040c3bd
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x3c], ecx
mov ecx, esi
call fcn.0040c3bd
mov ecx, esi
mov dword [eax + 0x24], edi
call fcn.0040c3bd
mov ecx, esi
mov dword [eax + 0x28], 0x40
call fcn.0040c3bd
mov ecx, dword [ebp + 0x14]
add eax, 0x34
or ecx, 0x880020
or dword [eax], ecx
test byte [ebp + 0x14], 0x40
je 0x40c2b5
mov ecx, esi
call fcn.0040c3bd
add eax, 0x34
and byte [eax + 2], 0x7f
call fcn.00566f78
mov edi, dword [eax + 0xc]
mov ecx, esi
call fcn.0040c3bd
mov ecx, esi
mov dword [eax + 8], edi
call fcn.0040c3bd
cmp dword [ebp + 0x10], ebx
mov dword [eax + 0x44], 0x40bfe6
je 0x40c2ee
push 0x100000
push dword [ebp + 0x10]
push dword [esi + 0xe8]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp dword [ebp + 0x18], ebx
je 0x40c32d
push dword [ebp + 0x18]
lea edi, [esi + 0x64]
mov ecx, edi
call fcn.00552978
push ebx
mov ecx, edi
call fcn.00552c26
push 0x7c
push eax
call fcn.004fc015
pop ecx
cmp eax, ebx
pop ecx
je 0x40c320
mov word [eax], bx
push 0x7c
add eax, 2
jmp 0x40c30a
mov edi, dword [esi + 0x64]
mov ecx, esi
call fcn.0040c3bd
mov dword [eax + 0xc], edi
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x1c
Function at 0x40eb25
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x56d0e8
call fcn.004fb864
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00552855
mov eax, dword [ebp - 0x18]
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [eax - 8], edi
jne 0x40eb5f
push eax
mov ecx, esi
call fcn.005565ef
or ebx, 0xffffffff
jmp 0x40ebf1
mov edx, dword [esi]
push eax
push edi
mov ecx, esi
call dword [edx + 0xe0]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40ebd1
mov eax, dword [esi]
or dword [ebp - 0x10], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push ebx
mov ecx, esi
call dword [eax + 0xd4]
push ebx
mov ecx, esi
call fcn.005516b8
cmp dword [ebp - 0x10], edi
jge 0x40ebbb
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ebbb
push edi
push 1
push dword [ebp + 8]
call fcn.00411ff9
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0x10]
push dword [ebp + 8]
push edi
call dword [eax + 0xd8]
jmp 0x40ebdf
push dword [ebp - 0x18]
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0xf0]
mov ebx, eax
push edi
push ebx
push 0x14e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.005527e1
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x41087d
Capabilities:
Find taskbar

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
xor edi, edi
push edi
push str.Shell_TrayWnd
push edi
push edi
call esi
cmp eax, edi
jne 0x410899
xor eax, eax
jmp 0x4108a3
push edi
push str.TrayNotifyWnd
push edi
push eax
call esi
pop edi
pop esi
ret

Function at 0x410a56
Capabilities:
Read clipboard data

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0x65d130
mov ecx, edi
call fcn.00552978
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x410a88
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x410a8c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
jmp 0x410ab3
push eax
mov ecx, edi
call fcn.00552978
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [esp + 0x10], 0
je 0x410ab0
mov ecx, edi
call fcn.0054fc3b
mov ecx, edi
call fcn.0054fbaf
push 1
pop eax
pop edi
pop esi
ret 8
Function at 0x410b7d
Capabilities:
Copy file

Disassembly:
mov eax, 0x56d33c
call fcn.004fb864
mov eax, 0x1024
call fcn.004fc4a0
push ebx
lea ecx, [ebp - 0x10]
push dword [ebp + 0xc]
call fcn.00552855
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
mov dword [ebp - 4], ebx
jne 0x410bcd
push dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
call fcn.00411816
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00552928
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], bl
call fcn.005527e1
push dword [ebp - 0x10]
call fcn.00411a8b
cmp eax, 0xffffffff
pop ecx
jne 0x410be2
push 0xfffffffffffffffe
jmp 0x410ca8
push esi
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x830]
push dword [ebp + 8]
push eax
call fcn.004fb8e8
lea eax, [ebp - 0x830]
push eax
call fcn.004fbcba
mov word [ebp + eax*2 - 0x82e], bx
lea eax, [ebp - 0x830]
push 0x7c
push eax
call fcn.004fc015
add esp, 0x18
cmp eax, ebx
je 0x410c33
mov word [eax], bx
add eax, 2
push 0x7c
push eax
call fcn.004fc015
pop ecx
pop ecx
jmp 0x410c1d
push esi
lea eax, [ebp - 0x1030]
push dword [ebp + 0xc]
push eax
call fcn.004fb8e8
lea eax, [ebp - 0x1030]
push eax
call fcn.004fbcba
mov word [ebp + eax*2 - 0x102e], bx
push 0x1e
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.004fb890
mov eax, dword [ebp + 0x18]
add esp, 0x1c
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x830]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x1030]
mov dword [ebp - 0x24], eax
mov ax, word [ebp + 0x14]
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
pop esi
je 0x410ca1
or ebx, 0xffffffff
jmp 0x410ca9
cmp dword [ebp - 0x1e], ebx
je 0x410ca9
push 1
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.005527e1
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x410d76
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push 0x3ff
lea eax, [ebp - 0x820]
push dword [ebp + 8]
push eax
call fcn.004fb8e8
lea eax, [ebp - 0x820]
push eax
call fcn.004fbcba
and word [ebp + eax*2 - 0x81e], 0
push 0x1e
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.004fb890
mov eax, dword [ebp + 0x10]
add esp, 0x1c
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x820]
mov dword [ebp - 0x18], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x410de9
or eax, 0xffffffff
leave
ret
xor eax, eax
cmp dword [ebp - 0xe], eax
setne al
leave
ret