joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7c0326ef
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x7c049290]
xor eax, dword [ebp + 4]
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
jle 0x7c032791
push edi
lea edi, [esi + 8]
mov dword [ebp + 8], ebx
mov eax, dword [esi + 4]
shr eax, 0xb
push 3
and eax, 7
push eax
push edi
call fcn.7c032542
mov eax, dword [esi + 4]
mov ecx, eax
and ecx, 0xfffff800
add ecx, 0x800
xor ecx, eax
and ecx, 0x3800
xor ecx, eax
add esp, 0xc
dec dword [ebp + 8]
mov dword [esi + 4], ecx
jne 0x7c032717
lea edi, [ebx + ebx*4]
shl edi, 1
lea eax, [esi + 0x1c]
push edi
push eax
lea eax, [ebp - 0x54]
push eax
call sym.MSVCR70.dll_memcpy
push 8
pop eax
sub eax, ebx
lea eax, [eax + eax*4]
shl eax, 1
push eax
lea eax, [edi + esi + 0x1c]
push eax
lea eax, [esi + 0x1c]
push eax
call sym.MSVCR70.dll_memmove
push edi
lea eax, [ebp - 0x54]
sub esi, edi
push eax
add esi, 0x6c
push esi
call sym.MSVCR70.dll_memcpy
add esp, 0x24
pop edi
jmp 0x7c0327cf
jge 0x7c0327cf
mov ecx, dword [esi + 4]
mov eax, ecx
shr eax, 0xb
dec eax
shl eax, 0xb
xor eax, ecx
and eax, 0x3800
xor eax, ecx
mov dword [esi + 4], eax
shr eax, 0xb
and eax, 7
push 0
push eax
lea eax, [esi + 8]
push eax
call fcn.7c032542
lea eax, [esi + 0x1c]
push 0x46
push eax
add esi, 0x26
push esi
call sym.MSVCR70.dll_memmove
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.7c00188c
leave
ret
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 4]
push eax
push 0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x401025
xor eax, eax
jmp 0x4010af
push esi
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x108]
push eax
call edi
push str.ShellOpenCommand
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x401080
xor eax, eax
jmp 0x4010ad
cmp byte [ebp - 0x208], 0
lea esi, [ebp - 0x208]
je 0x4010a4
movsx eax, byte [esi]
push eax
call dword [sym.imp.MSVCR70.dll_isspace]
test eax, eax
pop ecx
je 0x4010a4
inc esi
cmp byte [esi], 0
jne 0x40108f
push esi
push dword [ebp + 0xc]
call edi
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 8

Function at 0x4010e2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
imul eax, eax, 0x106
push ebx
lea ebx, [eax + 0x4032e0]
cmp byte [ebx], 0
jne 0x401194
push esi
push 0x5c
mov esi, 0x4031c0
push esi
call dword [sym.imp.MSVCR70.dll__mbsrchr]
test eax, eax
pop ecx
pop ecx
jne 0x40112a
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x40114a
push edi
mov edi, eax
sub edi, esi
push edi
lea eax, [ebp - 0x118]
push esi
push eax
call dword [sym.imp.MSVCR70.dll__mbsncpy]
add esp, 0xc
and byte [ebp + edi - 0x118], 0
pop edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x403028
lea eax, [ebp - 0x118]
push eax
call esi
push dword [ebp + 8]
call fcn.004010b3
push eax
lea eax, [ebp - 0x118]
push eax
call esi
lea eax, [ebp - 0x118]
push 0
push eax
call dword [sym.imp.MSVCR70.dll__access]
test eax, eax
pop ecx
pop ecx
pop esi
jne 0x401194
lea eax, [ebp - 0x118]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
leave
ret 4
Function at 0x401199
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
xor esi, esi
inc esi
push esi
mov eax, esi
call fcn.004010e2
cmp byte [0x4033e6], 0
jne 0x40126f
push ebx
push edi
mov ebx, 0x4033e6
push ebx
push str.VisualFoxProRuntime.7
call section..text
test eax, eax
mov edi, dword [sym.imp.MSVCR70.dll__access]
je 0x4011ee
push 0
push ebx
call edi
test eax, eax
pop ecx
pop ecx
je 0x4011ee
and byte [0x4033e6], 0
push esi
mov eax, esi
jmp 0x401268
cmp byte [0x4033e6], 0
jne 0x40126d
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40125b
add eax, 0xc
cmp eax, 0x105
jg 0x40125b
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x403028
lea eax, [ebp - 0x118]
push eax
call esi
push 1
call fcn.004010b3
push eax
lea eax, [ebp - 0x118]
push eax
call esi
lea eax, [ebp - 0x118]
push 0
push eax
call edi
test eax, eax
pop ecx
pop ecx
jne 0x40125b
lea eax, [ebp - 0x118]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [0x4033e6], 0
jne 0x40126d
xor eax, eax
inc eax
push eax
call fcn.004010e2
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x401720
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x6c
push 0x4020c0
call fcn.004019d4
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40175d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40175d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401775
cmp eax, 0x20b
je 0x401762
mov dword [ebp - 0x1c], ebx
jmp 0x401789
cmp dword [ecx + 0x84], 0xe
jbe 0x40175d
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x401783
cmp dword [ecx + 0x74], 0xe
jbe 0x40175d
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR70.dll___set_app_type]
pop ecx
or dword [0x4034f4], 0xffffffff
or dword [0x4034f8], 0xffffffff
call dword [sym.imp.MSVCR70.dll___p__fmode]
mov ecx, dword [0x4031b4]
mov dword [eax], ecx
call dword [sym.imp.MSVCR70.dll___p__commode]
mov ecx, dword [0x4031b0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR70.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4034f0], eax
call fcn.00401930
call fcn.004019d3
cmp dword [0x403080], ebx
jne 0x4017e9
push 0x4019d0
call dword [sym.imp.MSVCR70.dll___setusermatherr]
pop ecx
call fcn.004019be
push 0x40300c
push 0x403008
call sub.MSVCR70.dll__initterm
push 0x401974
call fcn.0040191e
mov eax, dword [0x4031ac]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x4031a8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCR70.dll___getmainargs]
push 0x403004
push section..data
call sub.MSVCR70.dll__initterm
add esp, 0x28
mov eax, dword [sym.imp.MSVCR70.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x30], esi
cmp byte [esi], 0x22
jne 0x401886
inc esi
mov dword [ebp - 0x30], esi
mov al, byte [esi]
cmp al, bl
je 0x40185a
cmp al, 0x22
jne 0x40184c
cmp byte [esi], 0x22
jne 0x401863
inc esi
mov dword [ebp - 0x30], esi
mov al, byte [esi]
cmp al, bl
je 0x40186d
cmp al, 0x20
jbe 0x40185f
mov dword [ebp - 0x48], ebx
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x48], 1
je 0x401891
movzx eax, word [ebp - 0x44]
jmp 0x401894
cmp byte [esi], 0x20
jbe 0x401863
inc esi
mov dword [ebp - 0x30], esi
jmp 0x401886
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00401498
mov esi, eax
mov dword [ebp - 0x78], esi
cmp dword [ebp - 0x1c], ebx
jne 0x4018b1
push esi
call dword [sym.imp.MSVCR70.dll_exit]
call dword [sym.imp.MSVCR70.dll__cexit]
jmp 0x4018e6
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00401a0d
ret
Function at 0xffa3c8
Capabilities:
Decompress data using aplib

Disassembly:
call 0xffa518
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xffa3ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xffa3da
add dl, dl
jne 0xffa3f9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xffa44c
xor eax, eax
add dl, dl
jne 0xffa406
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xffa4ed
add dl, dl
jne 0xffa415
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xffa420
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xffa42b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xffa436
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xffa442
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xffa3e5
mov eax, 1
add dl, dl
jne 0xffa45a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xffa465
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xffa451
sub eax, ebx
mov ebx, 1
jne 0xffa498
mov ecx, 1
add dl, dl
jne 0xffa47e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xffa489
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xffa475
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xffa3e5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xffa4af
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xffa4ba
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xffa4a6
cmp eax, 0x7d00
jae 0xffa4dd
cmp eax, 0x500
jb 0xffa4d8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xffa3e5
cmp eax, 0x7f
ja 0xffa4e0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xffa3e5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xffa50e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xffa3e5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
cmp byte [ebx], 0x22
jne 0x401027
inc ebx
cmp byte [ebx], 0
je 0x40101e
cmp byte [ebx], 0x22
jne 0x401013
cmp byte [ebx], 0x22
jne 0x40102f
inc ebx
jmp 0x40102f
inc ebx
cmp byte [ebx], 0x20
jg 0x401026
jmp 0x40102f
inc ebx
cmp byte [ebx], 0
je 0x401039
cmp byte [ebx], 0x20
jle 0x40102e
xor eax, eax
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x44]
push edx
call sub.KERNEL32.DLL_GetStartupInfoA
test byte [ebp - 0x18], 1
je 0x401053
movzx ecx, word [ebp - 0x14]
jmp 0x401058
mov ecx, 0xa
push ecx
push ebx
push 0
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push eax
call fcn.00401159
pop ebx
mov esp, ebp
pop ebp
push eax
call sub.KERNEL32.DLL_ExitProcess
nop

Function at 0x401099
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x40211c
push dword [ebp + 8]
push 0
call sub.KERNEL32.DLL_FindResourceA
mov ebx, eax
push ebx
push 0
call sub.KERNEL32.DLL_LoadResource
push eax
call sub.KERNEL32.DLL_LockResource
mov esi, eax
push ebx
push 0
call sub.KERNEL32.DLL_SizeofResource
mov ebx, eax
test esi, esi
je 0x4010d3
test ebx, ebx
jne 0x4010d7
xor eax, eax
jmp 0x40111a
push 0
push 0x100
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp eax, 0xffffffff
je 0x401118
push 0
lea edx, [ebp - 4]
push edx
push ebx
push esi
push edi
call sub.KERNEL32.DLL_WriteFile
push edi
call sub.KERNEL32.DLL_CloseHandle
cmp ebx, dword [ebp - 4]
jne 0x401118
mov eax, 1
jmp 0x40111a
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x401159
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
mov ecx, 0x41
push esi
push edi
lea edi, [ebp - 0x208]
mov esi, str.rundll32.exe_advpack.dll_LaunchINFSection_edxor.inf_DefaultInstall
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x230], 0x28
xor eax, eax
mov dword [ebp - 0x22c], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x228], edx
push str.InfoText
call fcn.00401120
pop ecx
mov dword [ebp - 0x224], eax
mov ecx, dword [str.EDXOR_Setup]
xor eax, eax
mov dword [ebp - 0x220], ecx
xor edx, edx
mov dword [ebp - 0x21c], 0x283
mov dword [ebp - 0x218], 0x40212f
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], edx
xor ecx, ecx
lea eax, [ebp - 0x230]
mov dword [ebp - 0x20c], ecx
push eax
call sub.USER32.DLL_MessageBoxIndirectA
cmp eax, 6
je 0x4011f2
xor eax, eax
jmp 0x40128d
lea edx, [ebp - 0x104]
push edx
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x401274
lea ecx, [ebp - 0x104]
push ecx
call sub.KERNEL32.DLL_SetCurrentDirectoryA
test eax, eax
je 0x401274
push str.edxor.exe
push str.ExeFile
call fcn.00401099
add esp, 8
test eax, eax
je 0x401274
push str.edxor.inf
push str.InfFile
call fcn.00401099
add esp, 8
test eax, eax
je 0x401274
call fcn.00401074
test eax, eax
jne 0x40125d
push 0x402159
lea eax, [ebp - 0x208]
push eax
call sub.KERNEL32.DLL_lstrcatA
push 1
lea edx, [ebp - 0x208]
push edx
call sub.KERNEL32.DLL_WinExec
cmp eax, 0x1f
jbe 0x401274
xor eax, eax
jmp 0x40128d
push 0x1010
push dword [0x402008]
push str.Installation_error
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0xad2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00ad21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xad207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xad206a
add dl, dl
jne 0xad2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xad20dc
xor eax, eax
add dl, dl
jne 0xad2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xad217d
add dl, dl
jne 0xad20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xad20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xad20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xad20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xad20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xad2075
mov eax, 1
add dl, dl
jne 0xad20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xad20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xad20e1
sub eax, ebx
mov ebx, 1
jne 0xad2128
mov ecx, 1
add dl, dl
jne 0xad210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xad2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xad2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xad2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xad213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xad214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xad2136
cmp eax, 0x7d00
jae 0xad216d
cmp eax, 0x500
jb 0xad2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xad2075
cmp eax, 0x7f
ja 0xad2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xad2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xad219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xad2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4048c0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
and dword [ebp - 4], 0
push esi
push edi
push dword [ebp + 8]
mov ebx, ecx
mov edi, edx
lea ecx, [ebp - 4]
push 0x2002
call fcn.00407eae
test al, al
jne 0x4048e7
xor bl, bl
jmp 0x40491d
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4048e3
push dword [ebp + 8]
push edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
push ebx
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4048e3
and dword [ebp - 4], 0
mov bl, 1
lea ecx, [ebp - 4]
call fcn.00407ecf
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x404e08
Capabilities:
Set file attributes

Disassembly:
test edx, 0xf0000000
je 0x404e16
and edx, 0x3fff
jmp fcn.00404d7a

Function at 0x404e1b
Capabilities:
Delete directory

Disassembly:
mov eax, 0x43dc58
call fcn.0043d180
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040754c
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x404e4a
push edi
call esi
test eax, eax
je 0x404e4a
mov al, 1
jmp 0x404e8e
test ebx, ebx
je 0x404e8c
lea ecx, [ebp - 0x18]
call fcn.004027c7
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.00407655
test al, al
push dword [ebp - 0x18]
je 0x404e86
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00402fca
test esi, esi
pop ecx
setne al
jmp 0x404e8e
call fcn.00402fca
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x404e9d
Capabilities:
Move file

Disassembly:
mov eax, 0x43dc74
call fcn.0043d180
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], ecx
call fcn.0040754c
mov ecx, dword [ebp - 0x10]
mov esi, eax
call fcn.0040754c
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 0x14], eax
push 1
pop ebx
cmp esi, ebx
je 0x404ee6
cmp eax, ebx
je 0x404ee6
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
test eax, eax
je 0x404ee6
mov al, bl
jmp 0x404f5d
test esi, esi
jne 0x404eef
cmp dword [ebp - 0x14], esi
je 0x404f5b
lea ecx, [ebp - 0x30]
call fcn.004027c7
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004027c7
cmp esi, ebx
mov byte [ebp - 4], bl
je 0x404f0f
cmp dword [ebp - 0x14], ebx
jne 0x404f11
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00407bc1
test al, al
push dword [ebp - 0x24]
je 0x404f4c
push dword [ebp - 0x30]
call edi
mov esi, eax
push dword [ebp - 0x24]
call fcn.00402fca
push dword [ebp - 0x30]
call fcn.00402fca
pop ecx
test esi, esi
pop ecx
setne al
jmp 0x404f5d
call fcn.00402fca
push dword [ebp - 0x30]
call fcn.00402fca
pop ecx
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x405068
Capabilities:
Create directory

Disassembly:
mov eax, 0x43dca4
call fcn.0043d180
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040754c
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x4050a6
push 0
push edi
call esi
test eax, eax
je 0x405099
mov al, 1
jmp 0x4050ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4050ed
test ebx, ebx
je 0x4050ed
lea ecx, [ebp - 0x18]
call fcn.004027c7
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.00407655
test al, al
je 0x4050e4
push 0
push dword [ebp - 0x18]
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00402fca
test esi, esi
pop ecx
setne al
jmp 0x4050ef
push dword [ebp - 0x18]
call fcn.00402fca
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40523f
Capabilities:
Create directory

Disassembly:
mov eax, 0x43dce7
call fcn.0043d180
sub esp, 0x7c
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040754c
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 1
je 0x405284
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x405277
mov al, 1
jmp 0x405367
call ebx
cmp eax, 0xb7
je 0x405318
test edi, edi
je 0x405318
lea ecx, [ebp - 0x18]
call fcn.004027c7
and dword [ebp - 4], 0
cmp edi, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, esi
call fcn.00407655
test al, al
je 0x40530b
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4052c0
mov bl, 1
jmp 0x405306
call ebx
cmp eax, 0xb7
je 0x4052cd
xor bl, bl
jmp 0x405306
lea ecx, [ebp - 0x50]
call fcn.00405cc5
lea ecx, [ebp - 0x28]
call fcn.004027c7
push dword [ebp - 0x18]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.00405d65
test al, al
jne 0x4052f4
xor bl, bl
jmp 0x4052fd
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.00402fca
pop ecx
push dword [ebp - 0x18]
jmp 0x40535f
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.00402fca
pop ecx
call ebx
cmp eax, 0xb7
je 0x405325
xor al, al
jmp 0x405367
lea ecx, [ebp - 0x88]
call fcn.00405cc5
lea ecx, [ebp - 0x60]
call fcn.004027c7
push esi
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], 2
call fcn.00405d65
test al, al
jne 0x405353
xor bl, bl
jmp 0x40535c
mov ebx, dword [ebp - 0x68]
shr ebx, 4
and bl, 1
push dword [ebp - 0x60]
call fcn.00402fca
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x405380
Capabilities:
Delete file

Disassembly:
mov eax, 0x43dcfc
call fcn.0043d180
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00405ce8
cmp eax, 0xffffffff
je 0x4053b4
test al, 0x10
jne 0x4053b4
test al, 1
je 0x4053b4
mov edx, eax
mov ecx, edi
and edx, 0xfffffffe
call fcn.00404d7a
test al, al
je 0x405415
mov ecx, edi
call fcn.0040754c
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
cmp ebx, 1
je 0x4053d3
push edi
call esi
test eax, eax
je 0x4053d3
mov al, 1
jmp 0x405417
test ebx, ebx
je 0x405415
lea ecx, [ebp - 0x18]
call fcn.004027c7
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.00407655
test al, al
push dword [ebp - 0x18]
je 0x40540f
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00402fca
test esi, esi
pop ecx
setne al
jmp 0x405417
call fcn.00402fca
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405ce8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x43ddb4
call fcn.0043d180
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040754c
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x405d14
push edi
call esi
cmp eax, 0xffffffff
jne 0x405d56
test ebx, ebx
je 0x405d53
lea ecx, [ebp - 0x18]
call fcn.004027c7
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.00407655
test al, al
push dword [ebp - 0x18]
je 0x405d4d
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00402fca
pop ecx
mov eax, esi
jmp 0x405d56
call fcn.00402fca
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40635d
Capabilities:
Get disk information

Disassembly:
mov eax, 0x43de58
call fcn.0043d180
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.0041d70f
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x40642b
mov eax, SysReAllocString
cmp ebx, eax
ja 0x406399
mov eax, ebx
add eax, eax
push eax
call fcn.00402fa3
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], ebx
je 0x406424
cmp ebx, dword [ebp - 0x14]
ja 0x406424
lea ecx, [ebp - 0x2c]
call fcn.004027c7
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
jbe 0x40640c
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x406401
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.00402906
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0040150c
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x10]
jb 0x4063d7
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00402fca
push esi
call fcn.00402fca
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
sete al
jmp 0x40642d
push esi
call fcn.00402fca
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret