joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ea44
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov edx, 0x7f7f7f
test eax, eax
je 0x41ea7d
mov edx, 0x811c9dc5
jmp 0x41ea77
and ebx, 0xff
xor edx, ebx
inc eax
imul ebx, edx, 0x1000193
mov edx, ebx
inc ecx
cmp ecx, 0x104
jg 0x41ea7d
mov bl, byte [eax]
test bl, bl
jne 0x41ea5d
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x423078
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x423081
mov eax, dword [ebp - 4]
push ebx
push esi
push edi
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 8]
xor ebx, ebx
test edi, edi
je 0x423214
mov eax, dword [ebp + 0x14]
add eax, ebx
cmp eax, dword [ebp + 0xc]
jg 0x423208
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
lea eax, [ebx + edi]
push eax
call fcn.004ce208
add esp, 0xc
test eax, eax
jne 0x423208
test ebx, ebx
je 0x4230db
jmp 0x4230d2
dec ebx
movsx edx, byte [edi + ebx]
cmp edx, 0x2d
je 0x4230d1
test ebx, ebx
je 0x4230ee
movsx eax, byte [edi + ebx]
cmp eax, 0xd
je 0x4230ed
cmp eax, 0xa
jne 0x4230ee
dec ebx
test esi, esi
je 0x423203
lea edx, [ebp - 0x2004]
push edx
push 0x2000
call sub.KERNEL32.dll_GetTempPathA
test eax, eax
je 0x423203
push esi
call sub.KERNEL32.dll_GetTickCount
and eax, 0xfff
push eax
call fcn.0041eb2c
and eax, 0xfff
lea ecx, [ebp - 0x4004]
push eax
push 0x5ce6ef
push ecx
call fcn.004d26c8
add esp, 0x14
lea eax, [ebp - 0x4004]
push eax
push 0x5ce6fd
lea edx, [ebp - 0x2004]
push edx
call fcn.004cdfec
pop ecx
lea ecx, [ebp - 0x2004]
add eax, ecx
push eax
call fcn.004d26c8
add esp, 0xc
push pe_nt_image_headers32
lea eax, [ebp - 0x2004]
push eax
call fcn.00405b9c
add esp, 8
test eax, eax
je 0x423185
push 0x64
call sub.KERNEL32.dll_Sleep
jmp 0x42310f
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x4004]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x2004]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 6
push eax
call fcn.00403da4
add esp, 8
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
push edx
call fcn.00403e40
pop ecx
test eax, eax
jne 0x4231e2
push 2
lea ecx, [ebp - 0x2004]
push ecx
call fcn.00403da4
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x423203
push ebx
push edi
mov edx, dword [ebp - 4]
push edx
call fcn.004042b4
add esp, 0xc
test eax, eax
lea ecx, [ebp - 4]
push ecx
call fcn.00403e78
pop ecx
lea eax, [ebx + 2]
jmp 0x423216
inc ebx
mov edx, dword [ebp + 0xc]
cmp ebx, edx
jl 0x4230a1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429880
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov esi, 0x811c9dc5
jmp 0x4298a0
and edx, 0xff
xor esi, edx
inc eax
imul ecx, esi, 0x1000193
mov esi, ecx
mov dl, byte [eax]
test dl, dl
jne 0x42988f
mov edx, esi
movzx ecx, si
sar ecx, 8
mov eax, esi
shr eax, 0x10
and esi, 0xff000000
shr esi, 0x18
mov ebx, esi
xor al, bl
mov bl, byte [ebp + 0x10]
test bl, bl
je 0x4298e2
or dl, 0x88
or cl, 0x88
or al, 0x88
cmp dl, 0xff
jne 0x4298d5
dec edx
cmp cl, 0xff
jne 0x4298db
dec ecx
cmp al, 0xff
jne 0x4298f9
dec eax
jmp 0x4298f9
and dl, 0x77
and cl, 0x77
and al, 0x77
test dl, dl
jne 0x4298ef
inc edx
test cl, cl
jne 0x4298f4
inc ecx
test al, al
jne 0x4298f9
inc eax
mov esi, edx
xor edx, edx
mov dl, cl
and eax, 0xff
movzx ecx, dx
shl ecx, 8
and esi, 0xff
shl eax, 0x10
or esi, ecx
or esi, eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x429938
mov edx, esi
and edx, 0xffffff
push edx
push 0x5cfafc
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004d26c8
add esp, 0xc
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x42b9e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
add edx, eax
test eax, eax
je 0x42ba00
dec eax
dec edx
xor byte [edx], 0x33
test eax, eax
jne 0x42b9f7
pop ebp
ret

Function at 0x42ba04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
add edx, eax
test eax, eax
je 0x42ba1c
dec eax
dec edx
xor byte [edx], 0x33
test eax, eax
jne 0x42ba13
pop ebp
ret
Function at 0x42de30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x5d0561
cmp esi, 1
jl 0x42de4e
cmp esi, 8
jle 0x42de52
xor eax, eax
jmp 0x42de57
mov eax, 1
push eax
push ebx
call fcn.0042c564
add esp, 0xc
xor edx, edx
mov dword [ebx + 0x6af70], edx
mov ecx, dword [ebx + 0x6af68]
test ecx, ecx
jne 0x42de87
mov dword [ebx + 0x6af70], 1
mov dword [ebx + 0x6af68], 0x10000
xor eax, eax
mov dword [ebx + 0x6af64], eax
push 0x1fffc
push 0
lea edx, [ebx + 0x4af68]
push edx
call fcn.004cde6c
movzx ecx, word [esi*8 + 0x50924d]
mov dword [ebx + 0x6af90], ecx
add esp, 0xc
movzx eax, word [esi*8 + 0x50924b]
mov dword [ebx + 0x6af94], eax
cmp esi, 2
movzx edx, word [esi*8 + 0x50924f]
mov dword [ebx + 0x6af98], edx
movzx ecx, word [esi*8 + 0x509251]
mov dword [ebx + 0x6af8c], ecx
jg 0x42dee8
or word [edi], 4
jmp 0x42def1
cmp esi, 8
jl 0x42def1
or word [edi], 2
xor eax, eax
xor edx, edx
mov dword [ebx + 0x6af7c], eax
mov esi, 0x8000
add esi, esi
mov dword [ebx + 0x6af6c], edx
push esi
lea eax, [ebx + 0x1af68]
push eax
push ebx
call dword [ebx + 9]
add esp, 0xc
mov dword [ebx + 0x6af88], eax
mov eax, dword [ebx + 0x6af88]
test eax, eax
je 0x42df2c
cmp eax, 0xffffffff
jne 0x42df40
mov dword [ebx + 0x6af84], 1
xor edx, edx
mov dword [ebx + 0x6af88], edx
jmp 0x42df8e
xor ecx, ecx
mov dword [ebx + 0x6af84], ecx
mov eax, dword [ebx + 0x6af88]
cmp eax, 0x106
jae 0x42df5c
push ebx
call fcn.0042e188
pop ecx
xor edx, edx
xor esi, esi
mov dword [ebx + 0x6af74], edx
lea eax, [ebx + 0x1af68]
mov edx, dword [ebx + 0x6af74]
xor ecx, ecx
shl edx, 5
mov cl, byte [eax]
xor edx, ecx
inc eax
and edx, 0x7fff
inc esi
cmp esi, 2
mov dword [ebx + 0x6af74], edx
jb 0x42df6c
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42f3a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test edx, edx
jne 0x42f3b6
xor eax, eax
pop ebx
pop ebp
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0x42f4a6
xor ebx, ebx
sub ecx, 8
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x5092f8]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x5092f8]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x5092f8]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x5092f8]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x5092f8]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x5092f8]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x5092f8]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x5092f8]
xor ebx, eax
cmp ecx, 8
mov eax, ebx
jae 0x42f3c2
test ecx, ecx
je 0x42f4c8
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x5092f8]
xor ebx, eax
dec ecx
mov eax, ebx
jne 0x42f4aa
xor eax, 0xffffffff
pop ebx
pop ebp
ret
Function at 0x42fb98
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x15]
test eax, eax
je 0x42fc76
mov edx, dword [ebx + 0x19]
add edx, esi
mov eax, dword [ebx + 0x1d]
cmp edx, eax
jb 0x42fc59
add eax, eax
cmp edx, eax
jae 0x42fbcf
mov edx, dword [ebx + 0x1d]
add edx, edx
jmp 0x42fbd4
mov edx, dword [ebx + 0x19]
add edx, esi
mov dword [ebp - 4], edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.KERNEL32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
jne 0x42fbfa
mov eax, 0x300
jmp 0x42fca2
mov edx, dword [ebp - 4]
push edx
push 0
push 0
push 0xf001f
push edi
call sub.KERNEL32.dll_MapViewOfFile
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x42fc24
push edi
call sub.KERNEL32.dll_CloseHandle
mov eax, 0x300
jmp 0x42fca2
mov edx, dword [ebx + 0x1d]
push edx
mov ecx, dword [ebx + 0x15]
push ecx
mov eax, dword [ebp - 8]
push eax
call fcn.004cddfc
add esp, 0xc
mov edx, dword [ebx + 0x15]
push edx
call sub.KERNEL32.dll_UnmapViewOfFile
mov ecx, dword [ebx + 4]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 4]
mov dword [ebx + 0x1d], eax
mov edx, dword [ebp - 8]
mov dword [ebx + 0x15], edx
mov dword [ebx + 4], edi
push esi
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebx + 0x15]
mov edx, dword [ebx + 0x19]
add eax, edx
push eax
call fcn.004cddfc
add esp, 0xc
add dword [ebx + 0x19], esi
mov eax, esi
jmp 0x42fca2
mov edx, dword [ebx]
test edx, edx
je 0x42fc99
xor ecx, ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
push 0
push eax
push esi
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebx]
push ecx
call sub.KERNEL32.dll_WriteFile
mov eax, dword [ebp - 0xc]
jmp 0x42fca2
mov dword [ebx + 0xc], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4300a4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x430108
mov ecx, dword [ebx + 0x50]
mov eax, dword [ebx + 0x54]
cmp ecx, eax
ja 0x4300cc
xor eax, eax
jmp 0x430154
mov esi, ecx
sub esi, eax
cmp edx, esi
jae 0x4300d6
mov esi, edx
push esi
mov edx, dword [ebx + 0x4c]
add edx, eax
push edx
push edi
call fcn.004cddfc
add esp, 0xc
add dword [ebx + 0x54], esi
mov eax, dword [ebx + 0x3f]
add eax, esi
mov dword [ebx + 0x3f], eax
push esi
push edi
mov ecx, dword [ebx + 0x43]
push ecx
call fcn.0042f3a0
add esp, 0xc
mov dword [ebx + 0x43], eax
mov eax, esi
jmp 0x430154
mov eax, dword [ebx + 0x47]
test eax, eax
je 0x43014b
push 0
lea ecx, [ebp - 4]
push ecx
push edx
push edi
push eax
call sub.KERNEL32.dll_ReadFile
test eax, eax
jne 0x430125
xor eax, eax
jmp 0x430154
mov edx, dword [ebx + 0x3f]
mov ecx, dword [ebp - 4]
add edx, ecx
mov dword [ebx + 0x3f], edx
mov eax, dword [ebp - 4]
push eax
push edi
mov edx, dword [ebx + 0x43]
push edx
call fcn.0042f3a0
add esp, 0xc
mov dword [ebx + 0x43], eax
mov eax, dword [ebp - 4]
jmp 0x430154
mov dword [ebx + 0xc], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x433434
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test edx, edx
jne 0x43344a
xor eax, eax
pop ebx
pop ebp
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0x43353a
xor ebx, ebx
sub ecx, 8
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x50ae24]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x50ae24]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x50ae24]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x50ae24]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x50ae24]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x50ae24]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x50ae24]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x50ae24]
xor ebx, eax
cmp ecx, 8
mov eax, ebx
jae 0x433456
test ecx, ecx
je 0x43355c
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x50ae24]
xor ebx, eax
dec ecx
mov eax, ebx
jne 0x43353e
xor eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x433ed8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, edi
imul esi, dword [ebp + 0x10]
mov al, byte [ebx]
test al, al
je 0x433f16
push 0
lea ecx, [ebp - 4]
push ecx
push esi
push edx
mov edx, dword [ebx + 2]
push edx
call sub.KERNEL32.dll_ReadFile
test eax, eax
jne 0x433f0d
mov byte [ebx + 6], 1
mov eax, dword [ebp - 4]
xor edx, edx
div edi
jmp 0x433f42
mov eax, dword [ebx + 0x13]
mov ecx, eax
add ecx, esi
cmp ecx, dword [ebx + 0xf]
jbe 0x433f27
mov esi, dword [ebx + 0xf]
sub esi, eax
push esi
mov ecx, dword [ebx + 0xb]
add ecx, eax
push ecx
push edx
call fcn.004cddfc
add esp, 0xc
mov ecx, esi
add dword [ebx + 0x13], ecx
mov eax, ecx
xor edx, edx
div edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x435120
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x435139
mov edx, dword [ebx + 4]
inc edx
je 0x435140
mov eax, 0x1000000
jmp 0x4351a7
lea edi, [ebx + 0x138]
push edi
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
push 0x5d0bc5
push edi
call fcn.004cdf10
add esp, 8
cmp esi, 1
jne 0x435179
mov eax, dword [ebp + 0xc]
push eax
call sub.KERNEL32.dll_GetFileType
cmp eax, 1
je 0x435179
mov eax, 0x2000000
jmp 0x4351a7
lea edx, [ebp - 4]
push edx
push esi
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00433c88
add esp, 0x10
mov esi, eax
test esi, esi
jne 0x435199
mov eax, dword [ebp - 4]
jmp 0x4351a7
push esi
call fcn.00434238
pop ecx
mov dword [ebx], eax
mov eax, dword [0x509a7c]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x435650
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test esi, esi
je 0x435708
mov al, byte [esi]
test al, al
je 0x435708
mov ebx, esi
mov eax, ebx
jmp 0x43568a
movsx edx, byte [eax]
cmp edx, 0x2f
je 0x435687
cmp edx, 0x5c
jne 0x435689
mov ebx, eax
inc eax
mov dl, byte [eax]
test dl, dl
jne 0x43567a
cmp esi, ebx
je 0x4356c3
mov eax, ebx
lea ecx, [ebp - 0x104]
sub eax, esi
push eax
push esi
push ecx
call fcn.004ce1b8
add esp, 0xc
sub ebx, esi
lea eax, [ebp - 0x104]
mov byte [ebp + ebx - 0x104], 0
push eax
push edi
call fcn.00435650
add esp, 8
push esi
xor eax, eax
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x208]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x208]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push esi
push eax
call fcn.004cdf10
add esp, 8
push 0
lea edx, [ebp - 0x208]
push edx
call sub.KERNEL32.dll_CreateDirectoryA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4365ec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x4365f5
add esp, 0xfffffbf4
mov eax, dword [ebp - 4]
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
lea ebx, [ebp - 0x4410]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
test edi, edi
jne 0x436639
mov ebx, 0xffffff9b
jmp 0x436740
push 0x5d0edf
call fcn.004036e4
pop ecx
mov dword [ebp - 8], eax
push 0x5d0ef2
call fcn.004036e4
pop ecx
mov dword [ebp - 0xc], eax
push 1
push 0x5d0f04
call fcn.004038c8
add esp, 8
push 1
push 0x5d0f17
call fcn.004038c8
add esp, 8
push edi
call sub.KERNEL32.dll_GetFileAttributesA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x43668c
mov ebx, 0xffffff91
jmp 0x436740
test byte [ebp - 0x10], 0x10
je 0x436698
test byte [ebp - 0xf], 4
jne 0x4366a2
mov ebx, 0xffffff87
jmp 0x436740
push 0
push 0x2200000
push 3
push 0
push 1
push 0x80000000
push edi
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4366c8
mov ebx, 0xffffff7d
jmp 0x436740
push 0
lea eax, [ebp - 0x10]
push eax
push 0x4400
push ebx
push 0
push 0
push 0x900a8
push esi
call sub.KERNEL32.dll_DeviceIoControl
test eax, eax
jne 0x4366ee
mov ebx, 0xffffff73
jmp 0x436740
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebx]
cmp eax, 0xa0000003
je 0x436704
mov ebx, 0xffffff69
jmp 0x436740
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43673e
add ebx, 0x10
push 4
push 0x5d0f29
push ebx
call fcn.004ce44c
add esp, 0xc
test eax, eax
jne 0x436725
add ebx, 8
push 0
push 0
push 0x104
mov eax, dword [ebp + 0xc]
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0
call sub.KERNEL32.dll_WideCharToMultiByte
xor ebx, ebx
test esi, esi
je 0x43674a
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 4]
push eax
push 0x5d0f33
call fcn.004038c8
add esp, 8
mov edx, dword [ebp - 8]
push edx
push 0x5d0f47
call fcn.004038c8
add esp, 8
mov ecx, dword [ebp - 0xc]
push ecx
push 0x5d0f5a
call fcn.004038c8
add esp, 8
test ebx, ebx
je 0x43678e
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43678e
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4367b8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4367d2
test esi, esi
jne 0x4367dc
mov eax, 0xffffff9b
jmp 0x43691f
push 0
push ebx
call sub.KERNEL32.dll_CreateDirectoryA
push 0
push 0x2200000
push 3
push 0
push 3
push 0xc0000000
push ebx
call sub.KERNEL32.dll_CreateFileA
mov edi, eax
test edi, edi
jne 0x43680c
mov eax, 0xffffff87
jmp 0x43691f
push esi
push edi
xor eax, eax
mov edi, esi
or ecx, 0xffffffff
lea esi, [ebp - 0x220]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea ebx, [ebp - 0x220]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov al, byte [ebp - 0x220]
cmp al, 0x5c
pop esi
jne 0x436865
mov dl, byte [ebp - 0x21f]
cmp dl, 0x3f
je 0x436865
mov cl, byte [ebp - 0x21e]
cmp cl, 0x3f
je 0x436865
mov al, byte [ebp - 0x21d]
cmp al, 0x5c
jne 0x43687a
push esi
push 0x5d0f6c
lea edx, [ebp - 0x220]
push edx
call fcn.004d26c8
add esp, 0xc
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x220]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x220]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x21a
push 0
push eax
call fcn.004cde6c
add esp, 0xc
mov dword [ebx], 0xa0000003
push 0x104
lea edx, [ebx + 0x10]
push edx
push 0xffffffffffffffff
push esi
push 0
push 0
call sub.KERNEL32.dll_MultiByteToWideChar
mov ecx, eax
dec eax
mov edx, eax
add ecx, ecx
add edx, edx
movzx eax, dx
mov word [ebx + 0xc], cx
add eax, 0xc
mov word [ebx + 0xa], dx
mov dword [ebx + 4], eax
lea ecx, [ebp - 4]
push 0
push ecx
push 0
add eax, 8
push 0
push eax
push ebx
push 0x900a4
push edi
call sub.KERNEL32.dll_DeviceIoControl
test eax, eax
jne 0x436917
push edi
call sub.KERNEL32.dll_CloseHandle
mov eax, 0xffffff9b
jmp 0x43691f
push edi
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436928
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
or edi, 0xffffffff
mov dword [ebp - 4], 0xffffffff
xor ebx, ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
test esi, esi
jne 0x436954
mov esi, 0xffffff9b
jmp 0x436a12
push 0x5d0f73
call fcn.004036e4
pop ecx
mov edi, eax
push 0x5d0f86
call fcn.004036e4
pop ecx
mov dword [ebp - 4], eax
push 1
push 0x5d0f98
call fcn.004038c8
add esp, 8
push 1
push 0x5d0fab
call fcn.004038c8
add esp, 8
push 0
push 0x2200000
push 3
push 0
push 3
push 0x40000000
push esi
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
test ebx, ebx
jne 0x4369b2
mov esi, 0xffffff87
jmp 0x436a12
push 8
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.004cde6c
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov dword [edx], 0xa0000003
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
push 8
mov eax, dword [ebp - 0x10]
push eax
push 0x900ac
push ebx
call sub.KERNEL32.dll_DeviceIoControl
test eax, eax
jne 0x4369f7
push ebx
call sub.KERNEL32.dll_CloseHandle
mov esi, 0xffffff73
jmp 0x436a12
push ebx
call sub.KERNEL32.dll_CloseHandle
xor ebx, ebx
push esi
call sub.KERNEL32.dll_RemoveDirectoryA
test eax, eax
jne 0x436a10
mov esi, 0xffffff41
jmp 0x436a12
xor esi, esi
test ebx, ebx
je 0x436a1c
push ebx
call sub.KERNEL32.dll_CloseHandle
push edi
push 0x5d0fbd
call fcn.004038c8
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x5d0fd0
call fcn.004038c8
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a15c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, esi
mov eax, dword [ebx + 0x14]
push eax
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
test edx, edx
jne 0x43a18f
mov ecx, dword [ebp + 0x18]
xor eax, eax
mov dword [ecx], 2
jmp 0x43a2ea
push 0
push esi
mov edx, dword [ebp - 4]
push edx
movzx ecx, word [ebx + 8]
push ecx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0x14]
push edx
call sub.GDI32.dll_GetDIBits
test eax, eax
jne 0x43a1bc
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 3
jmp 0x43a2df
push 3
mov eax, dword [ebp + 8]
push eax
call fcn.00403da4
add esp, 8
mov edi, eax
test edi, edi
jne 0x43a1de
mov eax, dword [ebp + 0x18]
mov dword [eax], 4
jmp 0x43a2df
mov word [ebp - 0x18], 0x4d42
mov eax, dword [ebx + 0x20]
mov edx, dword [ebx]
shl eax, 2
add eax, edx
mov edx, dword [ebx + 0x14]
mov ecx, eax
add ecx, edx
add ecx, 0xe
add eax, 0xe
mov dword [ebp - 0x16], ecx
lea ecx, [ebp - 0x18]
mov word [ebp - 0x12], 0
mov word [ebp - 0x10], 0
mov dword [ebp - 0xe], eax
lea eax, [ebp - 8]
push 0
push eax
push 0xe
push ecx
push edi
call sub.KERNEL32.dll_WriteFile
test eax, eax
jne 0x43a231
mov eax, dword [ebp + 0x18]
mov dword [eax], 5
jmp 0x43a2df
push 0
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebx + 0x20]
shl ecx, 2
add ecx, 0x28
push ecx
push ebx
push edi
call sub.KERNEL32.dll_WriteFile
test eax, eax
jne 0x43a25a
mov eax, dword [ebp + 0x18]
mov dword [eax], 6
jmp 0x43a2df
mov ebx, dword [ebx + 0x14]
mov esi, dword [ebp - 4]
cmp ebx, 0xfde8
jbe 0x43a29d
push 0
lea eax, [ebp - 8]
push eax
push 0xfde8
push esi
push edi
call sub.KERNEL32.dll_WriteFile
test eax, eax
jne 0x43a289
mov edx, dword [ebp + 0x18]
mov dword [edx], 7
jmp 0x43a2df
sub ebx, 0xfde8
add esi, 0xfde8
cmp ebx, 0xfde8
ja 0x43a268
push 0
lea ecx, [ebp - 8]
push ecx
push ebx
push esi
push edi
call sub.KERNEL32.dll_WriteFile
test eax, eax
jne 0x43a2ba
mov eax, dword [ebp + 0x18]
mov dword [eax], 8
jmp 0x43a2df
push edi
call sub.KERNEL32.dll_CloseHandle
test eax, eax
jne 0x43a2cf
mov edx, dword [ebp + 0x18]
mov dword [edx], 9
jmp 0x43a2df
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_GlobalFree
mov eax, 1
jmp 0x43a2ea
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_GlobalFree
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret