joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fac0
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
sub esp, 0x244
push ebp
push edi
mov edi, dword [esp + 0x250]
push edi
push str.elimvirt__s
push 2
call fcn.0040d050
push edi
lea eax, [esp + 0x18]
push str._s.
push eax
call fcn.00418db9
add esp, 0x18
lea ecx, [esp + 0x10c]
lea edx, [esp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40fbe4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [esp + 0x140]
lea ecx, [esp + 0x10]
push eax
push edi
push str._s_sAppDataLocalVirtualStoreProgram_FilesLeveritAgent
push ecx
call fcn.00418db9
mov al, byte [esp + 0x124]
add esp, 0x10
test al, 0x10
je 0x40fbbd
cmp byte [esp + 0x140], 0x2e
je 0x40fbbd
lea edx, [esp + 0x10]
push edx
push str.encot__s
push 2
call fcn.0040d050
lea eax, [esp + 0x1c]
push 0x42d5a4
push eax
call fcn.00412000
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
call esi
lea edx, [esp + 0x10]
push edx
call fcn.0040f9b0
lea eax, [esp + 0x144]
lea ecx, [esp + 0x14]
push eax
push edi
push str._s_sAppDataLocalVirtualStoreProgram_FilesLevtemp
push ecx
call fcn.00418db9
lea edx, [esp + 0x24]
push 0x42d5a4
push edx
call fcn.00412000
add esp, 0x1c
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
call fcn.0040f9b0
add esp, 4
lea edx, [esp + 0x114]
push edx
push ebp
call ebx
test eax, eax
jne 0x40fb1b
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x244
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x244
ret
Function at 0x4102f0
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.C:WINDOWSLEVTEMP
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
push 0x2001f
push 0
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x410354
lea edx, [esp + 0xc]
push edx
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x410354
pop edi
xor eax, eax
pop esi
ret
mov edi, str.C:WINDOWSLEVTEMP
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.C:WINDOWSLEVTEMP
push 1
push eax
mov eax, dword [esp + 0x1c]
push str.TempDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
ret
Function at 0x4103a0
Capabilities:
Create directory

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
push edi
push 0x186
push eax
push str.TempDir
call fcn.0040de40
add esp, 0xc
test eax, eax
je 0x410406
lea ecx, [esp + 8]
push ecx
call fcn.00410280
add esp, 4
test eax, eax
je 0x410406
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 1
mov edx, ecx
mov esi, edi
mov edi, str.C:WINDOWSLEVTEMP
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x190
ret
lea eax, [esp + 8]
push eax
call fcn.0040c430
add esp, 4
test eax, eax
je 0x41047f
mov edi, str.LEVTEMP
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [esp + 0xc]
push ecx
call fcn.00410280
add esp, 4
test eax, eax
pop ebx
je 0x41047f
lea edx, [esp + 8]
push edx
call fcn.004102f0
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x190
ret
mov eax, dword [0x42d020]
xor edi, edi
test eax, eax
jle 0x4104e6
mov esi, 0x42cff8
mov eax, dword [esi]
lea ecx, [esp + 8]
push eax
push str._sLEVTEMP.
push ecx
call fcn.00418db9
lea edx, [esp + 0x14]
push edx
call fcn.00411f30
add esp, 0x10
test eax, eax
je 0x4104d9
mov eax, dword [esi]
lea ecx, [esp + 8]
push eax
push str._sLEVTEMP
push ecx
call fcn.00418db9
lea edx, [esp + 0x14]
push edx
call fcn.00410280
add esp, 0x10
test eax, eax
jne 0x41055d
mov eax, dword [0x42d020]
inc edi
add esi, 4
cmp edi, eax
jl 0x41048f
xor edi, edi
test eax, eax
jle 0x410552
mov esi, 0x42cff8
mov ecx, dword [esi]
lea edx, [esp + 8]
push ecx
push str._s.
push edx
call fcn.00418db9
lea eax, [esp + 0x14]
push eax
call fcn.00411f30
add esp, 0x10
test eax, eax
je 0x410545
mov ecx, dword [esi]
lea edx, [esp + 8]
push ecx
push str._sLEVTEMP
push edx
call fcn.00418db9
lea eax, [esp + 0x14]
push eax
call fcn.00411cb0
lea ecx, [esp + 0x18]
push ecx
call fcn.00410280
add esp, 0x14
test eax, eax
jne 0x410464
mov eax, dword [0x42d020]
inc edi
add esi, 4
cmp edi, eax
jl 0x4104f1
pop edi
xor eax, eax
pop esi
add esp, 0x190
ret
lea eax, [esp + 8]
push eax
call fcn.004102f0
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x190
ret
Function at 0x410a00
Capabilities:
Check for time delay via gettickcount
Create process on windows

Disassembly:
sub esp, 0x160
push ebx
push ebp
push esi
push edi
push str.ejeccallusr
push 1
xor edi, edi
call fcn.0040d050
add esp, 8
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ebp, eax
push str.127.0.0.1
call fcn.00410600
add esp, 4
mov esi, eax
call ebx
inc edi
test esi, esi
je 0x410a59
cmp esi, 1
je 0x410a93
cmp edi, 4
jge 0x410a59
sub eax, ebp
cmp eax, 0x7530
jb 0x410a30
cmp esi, 1
jge 0x410a93
push 0x42c4e0
lea eax, [esp + 0x14]
push str.__sDiscover.exe___SYSTEM
push eax
call fcn.00418db9
lea ecx, [esp + 0x1c]
push ecx
push str.ejecutara___disc_de__s
push 1
call fcn.0040d050
add esp, 0x18
lea edx, [esp + 0x10]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push esi
push str.res_d
push 1
call fcn.0040d050
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x160
ret

Function at 0x410ab0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push str.ejeccallsyst
push 1
xor edi, edi
call fcn.0040d050
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 8
call ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x10], eax
push ebp
push str.127.0.0.1
call fcn.004108b0
add esp, 8
mov esi, eax
call ebx
inc edi
cmp esi, 1
je 0x410afe
cmp edi, 4
jge 0x410afe
sub eax, dword [esp + 0x10]
cmp eax, 0x7530
jb 0x410ad6
push esi
push str.res_d
push 1
call fcn.0040d050
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x410b20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push str.ejecservs
push 1
xor edi, edi
call fcn.0040d050
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 8
call ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x10], eax
push 0x4325fc
push ebp
call fcn.00410710
add esp, 8
mov esi, eax
call ebx
inc edi
cmp esi, 1
je 0x410b6e
cmp edi, 4
jge 0x410b6e
sub eax, dword [esp + 0x10]
cmp eax, 0x7530
jb 0x410b46
push esi
push str.res_d
push 1
call fcn.0040d050
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x410b90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x258
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push esi
push edi
mov edi, 0x4325fc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 8]
push ecx
push str.Politica
push str.C:WINDOWSLEVTEMP
call fcn.00414720
add esp, 0xc
test eax, eax
pop edi
pop esi
je 0x410c8a
push str.C:WINDOWSLEVTEMP
lea edx, [esp + 4]
push str._sPolitica
push edx
call fcn.00418db9
push 0x42c4e0
lea eax, [esp + 0x13c]
push str._sInfoT.dat
push eax
call fcn.00418db9
lea ecx, [esp + 0x144]
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.00410580
add esp, 0x20
test eax, eax
jne 0x410c44
push str.no_igual
push 1
call fcn.0040d050
lea eax, [esp + 0x134]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.00412320
add esp, 0x10
lea edx, [esp]
push edx
call fcn.0041a21c
push 0x42c4e0
lea eax, [esp + 8]
push str._sQUMOV.exe__adv1
push eax
call fcn.00418db9
lea ecx, [esp + 0x10]
push ecx
push str.ejecutara__s
push 1
call fcn.0040d050
add esp, 0x1c
lea edx, [esp]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x258
ret
push str.no_trajo
push 1
call fcn.0040d050
add esp, 8
add esp, 0x258
ret
Function at 0x410d20
Capabilities:
Delete directory

Disassembly:
sub esp, 0x30c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
push ebx
push ebp
mov ebp, dword [esp + 0x318]
push esi
push edi
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x128]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x12c]
push ecx
call fcn.00419fac
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x410e0c
mov bl, 0x18
test byte [esp + 0x10], bl
jne 0x410dfa
lea edx, [esp + 0x24]
lea eax, [esp + 0x128]
push edx
push ebp
push 0x42b858
push eax
call fcn.00418db9
lea ecx, [esp + 0x138]
push 0x180
push ecx
call fcn.004226da
lea edx, [esp + 0x140]
push edx
push str.Bye_s
push 2
call fcn.0040d050
lea eax, [esp + 0x14c]
push eax
call fcn.0041a21c
add esp, 0x28
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.0041a076
add esp, 8
test eax, eax
je 0x410da6
push esi
call fcn.0041a13b
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x12c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x130]
push ecx
call fcn.00419fac
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x410f09
mov bl, 0x10
test byte [esp + 0x10], bl
je 0x410ef7
lea edx, [esp + 0x24]
push 0x42d990
push edx
call fcn.00422610
add esp, 8
test eax, eax
je 0x410ef7
lea eax, [esp + 0x24]
push 0x42d98c
push eax
call fcn.00422610
add esp, 8
test eax, eax
je 0x410ef7
lea ecx, [esp + 0x24]
lea edx, [esp + 0x128]
push ecx
push ebp
push 0x42b858
push edx
call fcn.00418db9
lea eax, [esp + 0x138]
push 0x180
push eax
call fcn.004226da
lea ecx, [esp + 0x140]
push ecx
call fcn.00410d20
add esp, 0x1c
lea edx, [esp + 0x10]
push edx
push esi
call fcn.0041a076
add esp, 8
test eax, eax
je 0x410e8b
push esi
call fcn.0041a13b
push ebp
push str.remd_s
push 2
call fcn.0040d050
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30c
ret
Function at 0x410f70
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x4c4
lea eax, [esp + 0x140]
push esi
mov esi, dword [esp + 0x4cc]
push edi
push esi
push str._s
push eax
call fcn.00418db9
add esp, 0xc
lea ecx, [esp + 8]
lea edx, [esp + 0x148]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x41101b
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp byte [esp + 0x38], 0x2e
je 0x410ff9
lea eax, [esp + 0x38]
lea ecx, [esp + 0x14c]
push eax
push esi
push str._s_sAppDataLocalVirtualStoreProgram_Files__x86_
push ecx
call fcn.00418db9
lea edx, [esp + 0x15c]
push edx
push str.encd_s
push 2
call fcn.0040d050
lea eax, [esp + 0x168]
push eax
call fcn.00410f40
add esp, 0x20
lea ecx, [esp + 0xc]
push ecx
push edi
call ebp
test eax, eax
jne 0x410fb6
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop edi
mov eax, 1
pop esi
add esp, 0x4c4
ret
pop edi
mov eax, 1
pop esi
add esp, 0x4c4
ret

Function at 0x411030
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x2cc
push ebx
mov ebx, dword [esp + 0x2d4]
push ebx
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x41106b
push ebx
push str.borr1_s
push 2
call fcn.0040d050
add esp, 0xc
mov eax, 1
pop ebx
add esp, 0x2cc
ret
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push ebx
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x411091
xor eax, eax
pop ebx
add esp, 0x2cc
ret
push ebp
push esi
push edi
push 0x1f4
call fcn.0040c170
add esp, 4
lea ecx, [esp + 0x18]
xor edi, edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push ecx
push edi
push edi
lea edx, [esp + 0x20]
mov esi, eax
mov eax, dword [esp + 0x1c]
push edi
push edx
push esi
push edi
push eax
mov dword [esp + 0x34], 0x1c2
call ebp
cmp eax, 0x103
je 0x411128
push esi
push ebx
lea ecx, [esp + 0x28]
push 0x42b858
push ecx
call fcn.00418db9
lea edx, [esp + 0x30]
push edx
push str.nomborr_s
push 2
call fcn.0040d050
lea eax, [esp + 0x3c]
push eax
call fcn.00411030
add esp, 0x20
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push 0
push 0
push 0
inc edi
push edx
push esi
push edi
push eax
mov dword [esp + 0x34], 0x1c2
call ebp
cmp eax, 0x103
jne 0x4110d0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
push ebx
jne 0x41114b
push str.bienbr_s
jmp 0x411150
push str.malborr_s
push 2
call fcn.0040d050
add esp, 0xc
push esi
call fcn.0041964f
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2cc
ret
Function at 0x4111d0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10
push str.entra_getvst
push 2
call fcn.0040d050
add esp, 8
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push 0x4325fc
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x411208
xor eax, eax
add esp, 0x10
ret
push ebx
push esi
push edi
push 0x1f4
call fcn.0040c170
add esp, 4
lea ecx, [esp + 0x14]
xor edi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push ecx
push edi
push edi
lea edx, [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x1c]
push edi
push edx
push esi
push edi
push eax
mov dword [esp + 0x2c], 0x1c2
call ebx
cmp eax, 0x103
je 0x411286
push esi
push str.nom_pos_user_s
push 1
call fcn.0040d050
push esi
call fcn.00411180
add esp, 0x10
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
push 0
push 0
push 0
inc edi
push edx
push esi
push edi
push eax
mov dword [esp + 0x2c], 0x1c2
call ebx
cmp eax, 0x103
jne 0x411247
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0041964f
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x411cb0
Capabilities:
Create directory
Set file attributes

Disassembly:
sub esp, 0x12c
push ebx
mov ebx, dword [esp + 0x134]
push ebp
push esi
push edi
push ebx
push str.cree_dir__s
push 1
call fcn.0040d050
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test al, al
lea esi, [esp + 0x10]
je 0x411d35
cmp byte [esi], 0x5c
jne 0x411d2d
lea ecx, [esp + 0x10]
push 0
push ecx
mov byte [esi], 0
call edi
test eax, eax
je 0x411d2a
lea edx, [esp + 0x10]
push 2
push edx
call ebp
mov byte [esi], 0x5c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x411d0c
push 0
push ebx
call edi
push 2
push ebx
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c
ret
Function at 0x412000
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x244
push ebp
mov ebp, dword [esp + 0x250]
push esi
mov esi, dword [esp + 0x250]
push edi
push ebp
push esi
push str.vacie__s__s
push 1
call fcn.0040d050
push ebp
push esi
lea eax, [esp + 0x24]
push 0x42b858
push eax
call fcn.00418db9
add esp, 0x20
lea ecx, [esp + 0x110]
lea edx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4120d9
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [esp + 0x140]
lea ecx, [esp + 0x10]
push eax
push esi
push 0x42b858
push ecx
call fcn.00418db9
mov al, byte [esp + 0x124]
add esp, 0x10
test al, 0x10
je 0x4120a5
cmp byte [esp + 0x140], 0x2e
je 0x4120a5
lea edx, [esp + 0x10]
push ebp
push edx
call fcn.00412000
add esp, 8
lea eax, [esp + 0x10]
push eax
call ebx
jmp 0x4120b2
lea ecx, [esp + 0x10]
push ecx
call fcn.00411fc0
add esp, 4
lea edx, [esp + 0x114]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41205e
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x244
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x244
ret

Function at 0x4120f0
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x30c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
push ebx
push ebp
mov ebp, dword [esp + 0x318]
push esi
push edi
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x128]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.bas.bas
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x12c]
xor esi, esi
push ecx
call fcn.00419fac
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x41217b
mov esi, 1
lea edx, [esp + 0x128]
push edx
push str.BuscaraB__s
push 2
call fcn.0040d050
add esp, 0xc
test esi, esi
jne 0x412227
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov bl, 0x18
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
push ecx
push str.dect_s_atrib_d
push 2
call fcn.0040d050
mov al, byte [esp + 0x20]
add esp, 0x10
test bl, al
jne 0x412211
lea edx, [esp + 0x24]
lea eax, [esp + 0x128]
push edx
push ebp
push 0x42b858
push eax
call fcn.00418db9
lea ecx, [esp + 0x138]
push ecx
push str.borrara_s
push 2
call fcn.0040d050
add esp, 0x1c
lea edx, [esp + 0x128]
push 0x80
push edx
call esi
lea eax, [esp + 0x128]
push eax
call fcn.0041a21c
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push edi
call fcn.0041a076
add esp, 8
test eax, eax
je 0x4121a2
push edi
call fcn.0041a13b
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30c
ret
Function at 0x412320
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push esi
push edi
push str.copiar_file__s__s
push 1
xor ebx, ebx
call fcn.0040d050
push 0x433db0
push edi
call fcn.00422610
add esp, 0x18
test eax, eax
jne 0x412356
pop edi
pop esi
mov eax, 1
pop ebx
ret
push edi
call fcn.00411f30
add esp, 4
test eax, eax
jne 0x41236d
pop edi
mov dword [0x433b30], ebx
pop esi
pop ebx
ret
mov eax, dword [0x4344e4]
push ebp
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x4344e4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call fcn.00411fc0
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 4
push ebx
push esi
push edi
call ebp
test eax, eax
jne 0x4123c7
push esi
call fcn.00412240
add esp, 4
push 0
push esi
push edi
call ebp
test eax, eax
jne 0x4123c7
mov dword [0x433b30], eax
jmp 0x4123cc
mov ebx, 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, dword [0x43480c]
push ebx
inc edi
push str.res__d
push 1
mov dword [0x43480c], edi
call fcn.0040d050
add esp, 0xc
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x412c60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
push edi
push 2
push 0
push ebx
call fcn.0041907f
push ebx
call fcn.00419215
push 0
mov edi, eax
push 0
push ebx
mov dword [esp + 0x34], edi
call fcn.0041907f
lea eax, [edi + 0xfa0]
push eax
call fcn.004195db
push ebx
mov esi, eax
push edi
push 1
push esi
call fcn.00418f64
push ebx
call fcn.00418f0e
add esp, 0x34
mov edi, str.FDACT001AA
mov eax, esi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x412cd7
test cl, cl
je 0x412cd3
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x412cd7
add eax, 2
add edi, 2
test cl, cl
jne 0x412cb3
xor eax, eax
jmp 0x412cdc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x412e2d
mov al, byte [esi + 0x64]
mov cl, byte [esi + 0x65]
mov dl, byte [esi + 0x66]
mov byte [esp + 0x12], al
mov eax, dword [esi + 0x68]
mov byte [esp + 0x13], cl
cmp eax, 1
mov byte [esp + 0x11], dl
mov ebp, 0x6e
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 1
jl 0x412dd9
mov eax, dword [esp + 0x18]
add eax, 0x3e8
mov dword [esp + 0x18], eax
mov edi, dword [esi + ebp]
mov eax, dword [esp + 0x18]
add ebp, 4
mov dword [esp + 0x1c], edi
lea ecx, [edi + ebp + 4]
cmp ecx, eax
jg 0x412dd9
mov al, byte [esp + 0x14]
mov bl, byte [esp + 0x12]
imul byte [esp + 0x11]
add al, bl
xor ecx, ecx
test edi, edi
jl 0x412d67
lea edx, [esi + ebp]
mov bl, byte [edx + ecx]
xor bl, al
mov byte [edx + ecx], bl
mov bl, byte [esp + 0x13]
add al, bl
inc ecx
cmp ecx, edi
jle 0x412d54
add ecx, ebp
lea ebx, [esi + ebp]
push 0x42bd5c
push ebx
mov byte [ecx + esi], 0
call fcn.00419e10
add esp, 8
test eax, eax
je 0x412d85
mov byte [eax], 0
mov edx, dword [esp + 0x28]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebx
call fcn.0041daf0
add esp, 0xc
test eax, eax
jne 0x412db8
mov edx, dword [esp + 0x28]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebx], 0x3d
je 0x412df2
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x34]
inc eax
lea ebp, [edx + ebp + 0xa]
cmp eax, ecx
mov dword [esp + 0x14], eax
jle 0x412d23
push ebx
call fcn.00418f0e
push esi
call fcn.0041964f
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ebx + 1]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
call fcn.00412bf0
mov edx, dword [esp + 0x3c]
push edx
call fcn.00418f0e
push esi
call fcn.0041964f
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push ebx
call fcn.00418f0e
push esi
call fcn.0041964f
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret