joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412cf0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412e9a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x69
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x38
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xad
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x89
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xfd
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa7
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xfc
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x52
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 8
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x53
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc0
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x86
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x6c
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x39
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc9
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d10
pop ebx
pop edi
pop esi
ret

Function at 0x4035d5
Capabilities:
Terminate process

Disassembly:
jmp 0x451b59
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451b6a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004058fd
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403706
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b002
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b013
pop esi
ret
push ebx
push edi
push esi
call fcn.0049aee9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fd0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b03b
push ebx
push esi
push edi
call fcn.004056f0
add esp, 0xc
push 0
call fcn.0040623a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4013c5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4159d0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x415b7a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
sub byte [esi + ebx], 0x50
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x4b
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0x53
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xba
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xe9
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
add esp, 0x44
push eax
call fcn.0040616d
add byte [esi + ebx], 0xa2
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x97
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xb5
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xa4
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x54
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xf9
add esp, 0x40
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xc
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0x40
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xbc
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x59
add esp, 0x30
inc esi
cmp esi, edi
jb 0x4159f0
pop ebx
pop edi
pop esi
ret

Function at 0x4035f3
Capabilities:
Terminate process

Disassembly:
jmp 0x453df9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x453e0a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405948
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40371f
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c842
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c853
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c729
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c87b
push ebx
push esi
push edi
call fcn.0040572c
add esp, 0xc
push 0
call fcn.004062b2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4a6c5c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4d4b88]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4a6c9f
cmp word [esi], dx
jne 0x4a6c9f
or byte [edi + eax + 0x28], 4
jmp 0x4a6ca4
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4a6df7
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4a6dd7
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4a6ce6
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4a6d1c
cmp eax, edx
jae 0x4a6d28
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4a6cbe
jmp 0x4a6df7
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a6dd3
cmp dword [ebp - 0x14], 0
je 0x4a6dd3
mov eax, dword [ebx*4 + 0x4d4b88]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4a6dab
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4a6d74
mov word [esi], cx
jmp 0x4a6da7
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4d4b88]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4d4b88]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4d4b88]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4a6df7
pop ebx
cmp word [ebp - 4], bx
jne 0x4a6dbc
cmp esi, dword [ebp + 0xc]
jne 0x4a6dbc
mov word [esi], bx
jmp 0x4a6df4
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00401942
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4a6df7
push 0xd
jmp 0x4a6df0
mov ecx, dword [ebx*4 + 0x4d4b88]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4a6dee
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4a6df7
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x402df5
Capabilities:
Encode data using xor

Disassembly:
call 0x402cdb
mov ecx, 0x1ab
add al, ch
invalid
invalid
invalid
inc ecx
pop esi
xor byte [esi + ecx + 7], cl
xor byte [esi + ecx + 7], cl
loop 0x402df8
mov eax, 0x504029b
out dx, al
clc
div esi
cmc
retf 0x3d52
Function at 0xc734ff
Capabilities:
Encode data using xor

Disassembly:
push 0x65b8cd3d
not al
add al, 0x29
push 0x4114c288
neg al
jmp 0xc661de
add al, 0x1d
shl dword [esp + 3], 0xdf
xor bl, al
rol dword [esp], 0x3d
call fcn.00f5a7e7
movsb byte es:[edi], byte [esi]
dec edx
inc ebp
out dx, eax
faddp st(6)
xchg edi, eax
div byte [ebp + eax*8 + 0x28]
aaa
pop ebp
inc eax
sahf
pop ds
sub ebp, 1
mov eax, 0x5217adb3
lodsd eax, dword [esi]
pop ss
push edx
rol al, 0x27
movzx eax, byte [eax + ebp - 0x5217add9]
xor al, bl
jmp 0xb7a201
mov dword [esp + ecx - 0x5d4af546], ebx
and ecx, 0xcf3a17b5
cpuid
jge 0xc9b094
fisttp qword [edi + edx*4 - 0x50644dba]
scasb al, byte es:[edi]
leave
or bl, bl
xor dl, byte [edx - 0x622138b5]
jecxz 0xc734d2
lcall 0x7a7, 0x809c176b
aaa
fidiv word [eax]
cli
mov al, byte [0x39f80787]
xchg esp, eax
push ebp
add byte [esi + 0x40b7f107], al
xchg byte [edi], al
and ah, byte [edx - 0x6d]
popal
cmpsb byte [esi], byte es:[edi]
pop es
lodsd eax, dword [esi]
jle 0xc734ea
jns 0xc73546
xchg ebp, eax
pop eax
jle 0xc735ca
clc
or eax, ebx
inc ebx
mov dl, 0x8a
pop ebx
cmp al, byte [esi + ebx]
pop eax
clc
mov bh, 0x66
xchg esi, eax
popal
cmpsb byte [esi], byte es:[edi]
pop es
cmp dl, bh
invalid
neg byte [esi - 0x71]
iretd
jbe 0xc735bb
test cl, al
enter 0x3130, 0x7d
cld
pop ds
ljmp 0x752
sbb esi, 0xc
push 0x92bbf1b8
call fcn.00cd4aba
mov dword [esp], 0x4091c846
call int.00cad376
mov eax, 0xe142d85
mov eax, dword [ebp + eax*4 - 0x3850b614]
mov ecx, 0x11812f1c
bswap ecx
dec cl
mov cx, word [ebp + ecx*2 - 0x385f021c]
push 0xf7b89127
add ebp, 6
push 0x27266625
mov word ss:[eax], cx
push 0x9f3057a1
lea esp, [esp + 0xc]
jmp fcn.00f8e03d

Function at 0xf57b02
Capabilities:
Encode data using xor

Disassembly:
push 0xf40342ac
and word [esp + 2], 0xd8ad
adc esi, 4
dec dword [esp]
mov dword [esp], ecx
jno 0xf63148
mov ebp, edi
jo 0xff6051
mov dword [esp + ecx - 0x6e313130], 0xf4a48d35
or cl, 8
pop edx
jg 0xf48697
mov dword [0x91b8b145], eax
dec ebp
fsubp st(3)
jae 0xf57ba3
add dword [eax], edi
mov ah, 0xfc
imul edx, dword [esi + 0x6e], 0xffffffee
jb 0xf57b6d
rcr dword [ebp + edx + 0x7ba73e86], 1
dec ebx
in eax, dx
jns 0xf57adf
xor dword [ebp + 0x122bf6fe], ebx
fst qword [eax]
div dword [ebx]
jecxz 0xf57b4a
invalid
invalid
int3
xor bh, bh
push esi
sal byte [esp + edi*2 - 0x52], 1
push ebx
sbb al, 0x40
inc ebp
popfd
test byte [edi], bl
xor eax, 0x6d9f5744
push cs
mov al, byte [0xcb1aad85]
sbb byte [edi + esi*4 + 0x71], al
idiv byte [ebx + ebx + 0x2f]
invalid
popfd
push 0xb9246d32
push 0x9514548b
lea esp, [esp + 8]
jmp fcn.00c655f3
add esi, 2
call fcn.00ca27c4
Function at 0xf8a276
Capabilities:
Encode data using xor

Disassembly:
mov ebp, edi
mov ebx, edx
call fcn.00f888b3
call fcn.00c690d6
inc ecx
and al, 0xe5
xor dword [edx], esp
mov ch, 0x45
aam 0xc9
in eax, dx
push ecx
sbb dword [esi - 0x32a16e4f], eax
and dword [esi - 0x17], ecx
xor edx, dword [ebx + eax*2 - 0x18]
invalid
mov dword [esp + ebp*4 - 0x6d014f88], ebx
shl eax, 0x41
jns 0xf3dc90
cmp bh, bl
call [ecx + 0x7038aaa6]
popal
cdq
cmpsb byte [esi], byte es:[edi]
stosb byte es:[edi], al
cmp byte [eax + 0x61], dh
insb byte es:[edi], dx
and al, 0x1d
stosd dword es:[edi], eax
popal
add ebp, ebx
sar dword [esi + 0x7954fc], cl
sbb esp, dword [ebx + 0x88e563a]
lodsb al, byte [esi]
je 0xf8a307
jns 0xf8a318
cmp eax, dword [esi - 0x1222ab62]
and dword [ecx], ecx
jg 0xf8a283
sbb eax, 0xffdcee8f
invalid
mov dh, 0xd7
stosd dword es:[edi], eax
push ds
xlatb
mov bh, 0x1e
push ds
add dword [edx], 0x28499fcf
aam 0x48
lea ebx, [eax + ebx*2]
test dword [ebx - 0x3acbfdee], edi
push cs
lds ecx, [esi]
push ss
push ecx
xchg al, dh
xor ebx, edx
xor byte [ebp + 0xfc], ah
xor byte [eax], 7
dec esi
push eax
add byte [eax], al
add byte [eax + 0x504e0730], al
jns 0xf8a301
into
wait
mov dl, 0x62
sub byte [edx + 0x70], cl
jecxz 0xf8a394
push cs
mul byte [ebp - 0x5f]
sub al, 0x92
out 0xf3, eax
loope 0xf8a369
mov bh, 0xd7
stosd dword es:[edi], eax
cdq
and byte [esi + 0x38f7ab47], bl
cmpsb byte [esi], byte es:[edi]
pop edi
mov dh, bh
mov di, 0x3cc
and eax, 0xee7041f6
xchg dword [ecx], ebx
adc byte [esi - 0x1b], ch
jp 0xf8a323
insd dword es:[edi], dx
mov eax, dword [0x580b029a]
mov ecx, 0xb7844212
xlatb
lodsd eax, dword [esi]
rcl cl, 0x13
mov byte [0xf63b1f2b], al
test byte [edi - 0x2e3f5229], dh
adc esp, dword [edx - 0x9c4e0d5]
sbb ch, byte [0x3205889e]
cmp edi, esi
into
cmp edx, edx
or dword [edi + 0x3e24abd7], esi
pop eax
mov ah, 0xed
inc esp
outsb dx, byte [esi]
mov ah, byte [esi - 0x3dab81b6]
push ds
invalid
fisubr word [esi + ebx]
cmp eax, dword [ebp + 0xb14696b]
push edx
lodsd eax, dword [esi]
sti
pop edi
outsd dx, dword [esi]
lodsd eax, dword [esi]
clc
push ss
mov eax, 0xbb0eef0a
xchg ebx, eax
lodsd eax, dword [esi]
sbb dword [ecx + 0x21], edi
xlatb
stosd dword es:[edi], eax
enter 0xffffffffffffff61, 0x36
cli
sbb dword [eax + 0x21], 0xf68cabd7
int3
Function at 0xfa59d5
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ret
push esi
test edx, edx
jmp 0xcb0cd2
je 0xfe63c9
mov esi, dword [ebp + 0xc]
cmc
clc
stc
test esi, esi
jmp 0x1003c05
ja 0xf5a1e2
mov eax, esi
cmc
sub eax, dword [ecx + edx + 0x10]
jmp 0xffa2e3
mov edi, dword [ecx + edx + 0x18]
test edi, edi
jmp 0xfaa6dc
push ebp
mov ebp, 0x4518d787
shr edx, cl
mov ebp, esp
btc dx, sp
sar dl, cl
mov edx, dword [ebp + 8]
sub esp, 0x114
jmp 0xc6caa1
je 0xf4c2f0
mov eax, dword [ecx + edx + 0x20]
jmp 0x101e575
je 0xfe63c9
mov eax, dword [eax + 0x7c]
test ebp, ecx
push ebx
cmc
test ebp, 0xd93caaf
push edi
clc
mov dword [ebp - 0x10], eax
test eax, 0x74bedd25
test bx, si
mov dword [ebp - 8], 0xffffffff
cmc
cmp esi, 0xffff
jmp 0xf43851
je 0x1028824
sub eax, eax
mov si, sp
pop esi
mov esp, ebp
mov ebp, ebp
pop ebp
jmp 0xb7c60b
jmp 0xf4c2e7
je 0xfe63c9
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0xfe63c3
dec edi
test ebp, 0x39128c38
add eax, edx
clc
sub ebx, ebx
mov dword [ebp - 0xc], eax
test ebp, edx
cmc
clc
test edi, edi
jmp 0xf486b6
mov eax, dword [edx + 0x3c]
lea eax, [eax + edx]
clc
test esp, 0xc499ba90
cmc
cmp dword [eax], 0x4550
jne 0xfe63c9
mov ecx, dword [eax + 0x78]
test sp, bx
mov dword [ebp - 4], ecx
cmp ebx, eax
stc
clc
test ecx, ecx
jmp 0xfbdd3a

Function at 0xfe63ab
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esi, 2
and dx, ax
not dx
mov word [esi], dx
call fcn.00feb2ae
mov edi, dword [ebp]
mov edx, 0x61ae903f
movzx dx, byte ss:[edx + edi - 0x61ae903f]
call fcn.00c731e2

Function at 0x101476e
Capabilities:
Encode data using xor

Disassembly:
inc bp
mov dword [ebx], edi
not dword [esp + 7]
dec eax
lea esp, [esp + 0x10]
jmp fcn.00c9d2f7
inc ecx
movzx edi, byte [edx]
dec esp
mov dword [esp], edi
inc ebp
and edi, edi
dec ecx
adc edx, 1
dec eax
not dword [esp]
inc eax
xor bh, dh
inc eax
sub bh, 0x3e
dec ebp
and edi, edi
inc eax
ror bh, 1
inc esp
xchg byte [esp + 2], bh
inc ecx
inc bh
inc eax
xor bh, 0xa8
inc ecx
shr bh, 0x87
inc eax
ror bh, 1
inc esp
mov dword [esp + 4], edi
inc eax
dec bh
inc eax
not bh
inc cx
rol edi, 0x44
sar word [esp + 3], 0x8c
inc eax
xor dh, bh
inc sp
and edi, dword [esp]
dec ecx
shl edi, 0x81
dec eax
lea edi, [esp + edi + 8]
inc ebp
and bh, bh
jbe fcn.0101476e
dec dword [esp + 3]
inc sp
mov edi, dword [edi]
dec ecx
sbb ebx, 2
push 0xf9384213
jmp 0xf506c5
Function at 0x406b36
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00406693
mov dword [ebp - 8], eax
test bl, 8
je 0x406b74
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x439e08], eax
jmp 0x406cf6
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
push esi
je 0x406b8f
test eax, eax
je 0x406ca2
test bl, 2
je 0x406ca2
push edi
mov esi, 0x4368a8
push esi
call fcn.00406335
cmp dword [ebp + 8], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406bb1
push 0x4089a8
push esi
call ebx
jmp 0x406bb7
push edi
call fcn.0040661f
cmp word [edi], 0
jne 0x406bc7
cmp word [0x4368a8], 0x5c
jne 0x406bcf
push 0x4082b0
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406c96
cmp word [ebp - 0x22c], 0x2e
jne 0x406c1a
cmp word [ebp - 0x22a], 0
je 0x406c79
cmp word [ebp - 0x22a], 0x2e
jne 0x406c1a
cmp word [ebp - 0x228], 0
je 0x406c79
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406335
test byte [ebp - 0x258], 0x10
je 0x406c45
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x406c79
push dword [ebp + 0xc]
push edi
call fcn.00406b36
jmp 0x406c79
push dword [ebp - 4]
push edi
call fcn.004065a8
test eax, eax
jne 0x406c71
cmp dword [ebp - 4], eax
je 0x406c69
push edi
push 0xfffffffffffffff1
call fcn.00405093
push 0
push edi
call fcn.00406b0a
jmp 0x406c79
inc dword [0x439e08]
jmp 0x406c79
push edi
push 0xfffffffffffffff2
call fcn.00405093
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x406bf2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x406ca2
xor eax, eax
mov word [ebx - 2], ax
xor esi, esi
cmp dword [ebp + 8], esi
je 0x406cf5
cmp dword [ebp - 8], esi
je 0x406ce5
push edi
call fcn.00406408
test eax, eax
je 0x406cf5
push edi
call fcn.004065f0
mov eax, dword [ebp - 4]
or eax, 1
push eax
push edi
call fcn.004065a8
test eax, eax
jne 0x406ced
cmp dword [ebp - 4], esi
je 0x406ce5
push edi
push 0xfffffffffffffff1
call fcn.00405093
push esi
push edi
call fcn.00406b0a
jmp 0x406cf5
inc dword [0x439e08]
jmp 0x406cf5
push edi
push 0xffffffffffffffe5
call fcn.00405093
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x4ad024ed
Capabilities:
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x4ad02506
cmp dword [0x4ad240b4], 0
je 0x4ad07499
leave
ret 4
cmp dword [0x4ad240e4], 0
jne 0x4ad02506
push edi
push 0x20c
call fcn.4ad01896
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x4ad07558
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
test eax, eax
je 0x4ad07558
mov ecx, dword [ebp + 8]
push esi
lea esi, [ecx + 2]
mov dx, word [ecx]
inc ecx
inc ecx
test dx, dx
jne 0x4ad074d9
mov edx, dword [0x4ad24158]
sub ecx, esi
sar ecx, 1
add edx, ecx
lea esi, [edx + eax + 0xa]
lea eax, [esi + esi]
push eax
push edi
call fcn.4ad02536
mov edi, eax
test edi, edi
je 0x4ad0754f
cmp byte [0x4ad24083], 0
mov dword [ebp - 4], edi
jne 0x4ad19d8e
push 0x4ad07560
push esi
push edi
call fcn.4ad020a9
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad07524
push dword [ebp + 8]
sub eax, edx
push esi
sar eax, 1
push edi
mov dword [0x4ad24158], eax
call fcn.4ad020a9
mov byte [0x4ad24083], 1
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push dword [ebp - 4]
call fcn.4ad0142e
pop esi
pop edi
jmp 0x4ad02506
mov eax, dword [0x4ad24158]
push dword [ebp + 8]
sub esi, eax
push esi
lea eax, [edi + eax*2]
push eax
call fcn.4ad0185a
jmp 0x4ad07548

Function at 0x4ad02b68
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [ebp + 8]
mov word [ebp - 0xc], ax
push 0x3a
pop eax
mov word [ebp - 0xa], ax
mov ax, word [0x4ad40664]
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.4ad013a9
leave
ret 4

Function at 0x4ad02c56
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [ebp + 0x10], 0
push esi
mov esi, dword [ebp + 8]
jne 0x4ad0bed1
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.4ad013a9
leave
ret 0xc
push edi
mov edi, dword [sym.imp.msvcrt.dll_towupper]
push 0x3d
pop eax
push dword [ebp + 0x10]
mov word [ebp - 0xc], ax
call edi
pop ecx
mov word [ebp - 0xa], ax
push 0x3a
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call fcn.4ad02070
test eax, eax
je 0x4ad19e98
push eax
push dword [ebp + 0xc]
push esi
call fcn.4ad0185a
xor eax, eax
pop edi
jmp 0x4ad02c83
push dword [ebp + 0x10]
call edi
mov word [esi], ax
pop ecx
inc esi
push 0x3a
inc esi
pop eax
mov word [esi], ax
inc esi
inc esi
push 0x5c
pop eax
mov word [esi], ax
xor eax, eax
mov word [esi + 2], ax
inc eax
jmp 0x4ad0bf13