joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402b33
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4014
call fcn.0046a300
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x4014]
push edi
mov edi, dword [ebp + 8]
mov ecx, 0x4000
and dword [ebp + 8], 0
mov dword [ebp - 0x14], ecx
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov esi, dword [esi + 4]
mov dword [ebp - 4], esi
call sub.KERNEL32.dll_GetTickCount
and dword [ebp - 0xc], 0
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ebx
jmp 0x402b7d
mov esi, dword [ebp - 4]
cmp ebx, esi
jge 0x402bc1
cmp dword [edi + 4], 0
ja 0x402bc1
lea eax, [ebp - 0x14]
sub esi, ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
call fcn.004018e2
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov esi, eax
push ebx
mov dword [edi + 4], esi
call fcn.0042afec
add ebx, esi
mov dword [edi], eax
mov eax, dword [ebp + 8]
cmp ebx, dword [ebp - 4]
push 3
pop ecx
cmovge eax, ecx
mov dword [ebp - 8], ebx
mov dword [ebp + 8], eax
jmp 0x402bc4
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.0046b620
mov esi, eax
pop ecx
pop ecx
cmp esi, 5
je 0x402c79
cmp esi, 7
je 0x402c79
cmp esi, 8
jle 0x402bef
cmp esi, 0xb
jle 0x402c79
cmp dword [edi + 0x14], 0
jbe 0x402bfa
cmp esi, 1
jne 0x402c32
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x4014]
mov ebx, 0x4000
sub ebx, dword [edi + 0x14]
push ebx
mov eax, dword [ecx]
push edx
mov eax, dword [eax]
call eax
test al, al
je 0x402c79
add dword [ebp - 0xc], ebx
lea eax, [ebp - 0x4014]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0x4000
cmp esi, 1
je 0x402c87
mov ebx, dword [ebp - 8]
cmp dword [ebp + 0x14], 0
mov esi, dword [ebp - 4]
je 0x402b7d
call sub.KERNEL32.dll_GetTickCount
mov esi, eax
push esi
push dword [ebp - 0x10]
call fcn.00457bcb
pop ecx
pop ecx
cmp eax, 0xc8
jbe 0x402b7a
mov eax, dword [ebp - 0xc]
shl eax, 3
push eax
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 4]
push esi
push ebx
call dword [ebp + 0x14]
add esp, 0xc
test al, al
je 0x402b7d
push edi
call fcn.0046b8d0
xor al, al
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push edi
call fcn.0046b8d0
mov al, 1
jmp 0x402c81

Function at 0x40307a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
je 0x4030d8
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], 0x70b
jne 0x4030d8
cmp dword [eax + 0xc], 0x202
jne 0x4030d8
push dword [eax + 0x1c]
push dword [eax + 0x18]
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.004037df
add esp, 0x10
mov eax, 0x49ab64
cmp dword [ebp - 0xc], 0
cmovne eax, dword [ebp - 0xc]
xor ecx, ecx
push 5
push ecx
push ecx
push eax
push 0x49af30
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0xc]
call fcn.00425c1b
leave
ret
Function at 0x409ae1
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x498bb3
call fcn.0046a2a4
sub esp, 0x7c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 4], edi
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x88]
push eax
call fcn.00429b97
add esp, 0xc
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x5c], 1
xor eax, eax
mov word [ebp - 0x58], ax
lea ecx, [ebp - 0x1c]
call fcn.004282a8
lea eax, [ebp - 0x34]
push eax
call fcn.00440c03
mov esi, 0x49ab64
mov ecx, esi
cmp dword [eax], edi
cmovne ecx, dword [eax]
push edi
push 0x49e0d0
push ecx
push 0x49e0d8
lea eax, [ebp - 0x1c]
push eax
call fcn.0042f13c
add esp, 0x18
lea ecx, [ebp - 0x34]
call fcn.00425c1b
lea ecx, [ebp - 0x28]
call fcn.004282a8
push dword [ebp + 8]
lea eax, [ebp - 0x34]
push eax
call fcn.00445703
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00424f5b
lea ecx, [ebp - 0x34]
call fcn.00425c1b
lea eax, [ebp - 0x28]
push eax
push 0x49e0dc
lea ecx, [ebp - 0x1c]
call fcn.00424003
push 0x200
lea ecx, [ebp - 0x1c]
call fcn.0042366c
cmp dword [ebp - 0x1c], edi
cmovne esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x88]
push eax
push edi
push edi
push 0x10
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x409beb
push dword [ebp - 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x44]
call esi
lea ecx, [ebp - 0x28]
call fcn.00425c1b
lea ecx, [ebp - 0x1c]
call fcn.00425c1b
mov al, 1
jmp 0x409c23
push edi
push edi
push edi
push dword [ebp + 8]
push 0x49af30
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setge bl
lea ecx, [ebp - 0x28]
call fcn.00425c1b
lea ecx, [ebp - 0x1c]
call fcn.00425c1b
mov al, bl
jmp 0x409c23
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40c13f
Capabilities:
Terminate process

Disassembly:
mov eax, 0x498bd1
call fcn.0046a2a4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 4], esi
call fcn.00409e22
mov eax, dword [0x4d9944]
test eax, eax
je 0x40c17f
push 6
push eax
call fcn.00462ee9
push dword [0x4d9944]
call fcn.004628a8
add esp, 0xc
mov dword [0x4d9944], esi
call fcn.0046329e
call fcn.0040e824
mov ecx, dword [0x4d99b0]
test ecx, ecx
je 0x40c1b7
push esi
push 1
call fcn.00467971
mov ecx, dword [0x4d99b0]
call fcn.00467d2b
mov ecx, dword [0x4d99b0]
call fcn.00466b70
mov dword [0x4d99b0], esi
call fcn.004124f0
call dword [sym.imp.ole32.dll_OleUninitialize]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4228a2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 4], edi
push dword [esi]
call fcn.004269b8
push dword [esi + 4]
mov ebx, eax
call fcn.004269b8
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
add edi, 0x44
mov dword [ebp - 8], 8
xor ebx, dword [edi]
lea edi, [edi - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
shr eax, 0x10
mov ecx, ebx
movzx eax, al
mov esi, dword [edi + 4]
shr ecx, 0x18
mov edx, dword [edx + eax*4 + 0x448]
mov eax, dword [ebp - 4]
add edx, dword [eax + ecx*4 + 0x48]
mov eax, ebx
mov ecx, dword [ebp - 4]
shr eax, 8
movzx eax, al
xor edx, dword [ecx + eax*4 + 0x848]
movzx eax, bl
add edx, dword [ecx + eax*4 + 0xc48]
mov ecx, dword [ebp + 0xc]
xor edx, esi
mov esi, dword [ebp - 4]
xor ecx, edx
mov eax, ecx
mov dword [ebp + 0xc], ecx
shr eax, 0x10
movzx eax, al
shr ecx, 0x18
mov edx, dword [esi + eax*4 + 0x448]
add edx, dword [esi + ecx*4 + 0x48]
mov ecx, dword [ebp + 0xc]
mov eax, ecx
shr eax, 8
movzx eax, al
xor edx, dword [esi + eax*4 + 0x848]
movzx eax, cl
add edx, dword [esi + eax*4 + 0xc48]
xor ebx, edx
sub dword [ebp - 8], 1
jne 0x4228d2
mov eax, dword [edi]
xor eax, ebx
push eax
call fcn.004269b8
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [edi - 4]
xor eax, dword [ebp + 0xc]
push eax
call fcn.004269b8
pop ecx
pop ecx
pop edi
mov dword [esi], eax
pop esi
pop ebx
leave
ret 8

Function at 0x422a0d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
push dword [esi]
call fcn.004269b8
push dword [esi + 4]
mov ebx, eax
call fcn.004269b8
pop ecx
lea edx, [edi + 0x48]
mov dword [ebp - 4], eax
pop ecx
mov dword [ebp + 0xc], edx
mov dword [ebp - 8], 8
xor ebx, dword [edi]
lea edi, [edi + 8]
mov esi, dword [edi - 4]
mov eax, ebx
shr eax, 0x10
mov ecx, ebx
movzx eax, al
shr ecx, 0x18
mov edx, dword [edx + eax*4 + 0x400]
mov eax, dword [ebp + 0xc]
add edx, dword [eax + ecx*4]
mov eax, ebx
mov ecx, dword [ebp + 0xc]
shr eax, 8
movzx eax, al
xor edx, dword [ecx + eax*4 + 0x800]
movzx eax, bl
add edx, dword [ecx + eax*4 + 0xc00]
mov ecx, dword [ebp - 4]
xor edx, esi
mov esi, dword [ebp + 0xc]
xor ecx, edx
mov eax, ecx
mov dword [ebp - 4], ecx
shr eax, 0x10
movzx eax, al
shr ecx, 0x18
mov edx, dword [esi + eax*4 + 0x400]
add edx, dword [esi + ecx*4]
mov ecx, dword [ebp - 4]
mov eax, ecx
shr eax, 8
movzx eax, al
xor edx, dword [esi + eax*4 + 0x800]
movzx eax, cl
add edx, dword [esi + eax*4 + 0xc00]
xor ebx, edx
sub dword [ebp - 8], 1
mov edx, esi
jne 0x422a3d
mov eax, dword [edi]
xor eax, ebx
push eax
call fcn.004269b8
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
xor eax, dword [ebp - 4]
push eax
call fcn.004269b8
pop ecx
pop ecx
pop edi
mov dword [esi], eax
pop esi
pop ebx
leave
ret 8
Function at 0x422b02
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push edi
call fcn.0042284d
pop ecx
test al, al
je 0x422bd2
push ebx
push 0x48
push 0x4a0b98
lea ebx, [esi + 0x48]
push esi
mov dword [ebp + 0xc], ebx
call fcn.00429b2e
push 0x1000
push 0x4a0be0
push ebx
call fcn.00429b2e
add esp, 0x18
sar edi, 5
xor ecx, ecx
mov eax, ecx
mov ebx, dword [ebp + 8]
cdq
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [esi + ecx*4], eax
inc ecx
cmp ecx, 0x12
jl 0x422b49
and dword [ebp - 4], 0
mov edi, esi
and dword [ebp - 8], 0
push 9
pop ebx
lea eax, [ebp - 8]
mov ecx, esi
push eax
push eax
call fcn.00422a0d
push dword [ebp - 8]
call fcn.004269b8
push dword [ebp - 4]
mov dword [edi], eax
call fcn.004269b8
mov dword [edi + 4], eax
lea edi, [edi + 8]
pop ecx
pop ecx
sub ebx, 1
jne 0x422b6a
mov ebx, dword [ebp + 0xc]
mov edi, 0x200
lea eax, [ebp - 8]
mov ecx, esi
push eax
push eax
call fcn.00422a0d
push dword [ebp - 8]
call fcn.004269b8
push dword [ebp - 4]
mov dword [ebx], eax
call fcn.004269b8
mov dword [ebx + 4], eax
lea ebx, [ebx + 8]
pop ecx
pop ecx
sub edi, 1
jne 0x422b9d
mov ecx, esi
call fcn.00422aee
mov al, 1
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x4311ce
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x431392
mov eax, dword [esi]
test eax, eax
je 0x431392
test byte [ebp + 0xc], 1
push edi
mov edi, eax
je 0x43120b
movzx eax, word [eax]
jmp 0x431200
add dword [esi], 2
mov edi, dword [esi]
movzx eax, word [edi]
push eax
call fcn.00424b05
pop ecx
test al, al
jne 0x4311f8
xor eax, eax
test byte [ebp + 0xc], 4
mov dword [ebp - 8], eax
mov byte [ebp + 0xb], al
mov eax, edi
mov dword [ebp - 4], eax
jne 0x431258
movzx ecx, word [edi]
mov dword [ebp - 4], eax
sub ecx, 0x2b
je 0x431233
dec ecx
sub ecx, 1
jne 0x431258
mov byte [ebp + 0xb], 1
add edi, 2
test byte [ebp + 0xc], 0x40
mov eax, edi
mov dword [esi], edi
mov dword [ebp - 4], eax
je 0x431258
push 0x20
pop ecx
cmp word [edi], cx
jmp 0x431253
add dword [esi], 2
mov eax, dword [esi]
cmp word [eax], cx
mov dword [ebp - 4], eax
je 0x43124b
xorps xmm1, xmm1
movsd qword [ebp - 0x1c], xmm1
movzx eax, word [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
push eax
mov dword [ebp - 0x10], ecx
mov edi, eax
call fcn.0042494d
pop ecx
test al, al
je 0x4312a5
movd xmm0, dword [ebp - 0xc]
movsd xmm1, qword [ebp - 0x1c]
mulsd xmm1, qword [0x4a2508]
mov byte [ebp - 8], 1
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
subsd xmm1, qword [0x4a2518]
movsd qword [ebp - 0x1c], xmm1
jmp 0x4312b8
push 0x2e
pop ecx
cmp di, cx
je 0x4312c5
cmp edi, 0x2c
jne 0x4312c9
test byte [ebp + 0xc], 0x20
je 0x4312c9
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov dword [esi], eax
jmp 0x431260
mov al, 1
jmp 0x4312cc
mov eax, dword [ebp - 8]
pop edi
test al, al
jne 0x4312f1
test byte [ebp + 0xc], 8
je 0x4312e1
movsd xmm0, qword [str.v_w0]
jmp 0x4312e4
xorps xmm0, xmm0
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
jmp 0x4313ad
cmp word [ebp - 0x10], cx
jne 0x43134f
mov eax, dword [ebp - 4]
movsd xmm0, qword [0x4a2508]
add eax, 2
movsd qword [ebp - 0x14], xmm0
jmp 0x43133f
mov ecx, dword [esi]
movsd xmm2, qword [ebp - 0x14]
movzx eax, word [ecx]
sub eax, 0x30
movd xmm0, eax
lea eax, [ecx + 2]
cvtdq2pd xmm0, xmm0
divsd xmm0, xmm2
mulsd xmm2, qword [0x4a2508]
addsd xmm0, qword [ebp - 0x1c]
movsd qword [ebp - 0x14], xmm2
movsd qword [ebp - 0x1c], xmm0
mov dword [esi], eax
movzx eax, word [eax]
push eax
call fcn.0042494d
pop ecx
test al, al
jne 0x43130c
test byte [ebp + 0xc], 2
je 0x43136a
jmp 0x43135a
add dword [esi], 2
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.00424b05
pop ecx
test al, al
jne 0x431357
cmp byte [ebp + 0xb], 0
je 0x431383
movsd xmm0, qword [ebp - 0x1c]
xorps xmm0, xmmword [0x4a1c10]
movsd qword [ebp - 0x1c], xmm0
jmp 0x43138d
movsd xmm1, qword [ebp - 0x1c]
movsd qword [ebp - 0x1c], xmm1
fld qword [ebp - 0x1c]
jmp 0x4313ad
test byte [ebp + 0xc], 8
je 0x4313a2
movsd xmm0, qword [str.v_w0]
jmp 0x4313a5
xorps xmm0, xmm0
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
pop esi
leave
ret
Function at 0x431eb1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebx + 4]
mov eax, edi
mov esi, dword [ebx]
cdq
and edx, 3
add eax, edx
sar eax, 2
test eax, eax
jle 0x431edd
xor dword [esi], ecx
add esi, 4
dec eax
test eax, eax
jg 0x431ed0
mov edi, dword [ebx + 4]
and edi, 3
sub edi, 1
je 0x431ef8
sub edi, 1
je 0x431ef5
sub edi, 1
jne 0x431efa
mov al, byte [ebp + 0xa]
xor byte [esi + 2], al
xor byte [esi + 1], ch
xor byte [esi], cl
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x433891
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x433916
mov ebx, dword [ebp + 0xc]
test bl, 1
je 0x433904
push 0x400
lea eax, [ebp - 0x404]
mov byte [ebp - 0x404], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.0047ea10
pop ecx
pop ecx
mov ecx, eax
lea eax, [ebp - 0x404]
cmp ecx, eax
jbe 0x433904
cmp byte [ecx - 1], 0x5c
je 0x4338ea
mov byte [ecx], 0x5c
inc ecx
lea eax, [ebp - 4]
push esi
sub eax, ecx
push eax
push ecx
call fcn.0048b888
add esp, 0xc
test eax, eax
jne 0x433916
lea esi, [ebp - 0x404]
and ebx, 4
shl ebx, 3
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x433918
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x4414d5
Capabilities:
Check if file exists
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
and eax, 0xfffffffe
push ebx
cmp eax, 6
jg 0x4414f8
push 0xa1
call fcn.00457a13
xor bl, bl
jmp 0x44159a
xor ebx, ebx
test byte [ebp + 0x14], 1
push esi
mov esi, 0x49ab64
jne 0x441568
cmp dword [ebp + 8], ebx
mov eax, esi
push str.thumbs.db
cmovne eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004444c6
mov ecx, esi
push ebx
cmp dword [eax], ebx
cmovne ecx, dword [eax]
push ecx
call fcn.004435cd
add esp, 0x14
lea ecx, [ebp - 0xc]
call fcn.00425c1b
cmp dword [ebp + 8], ebx
mov eax, esi
push str.desktop.ini
cmovne eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004444c6
mov ecx, esi
push ebx
cmp dword [eax], ebx
cmovne ecx, dword [eax]
push ecx
call fcn.004435cd
add esp, 0x14
lea ecx, [ebp - 0xc]
call fcn.00425c1b
push 0x5c
lea ecx, [ebp + 8]
call fcn.0042675d
cmp dword [ebp + 8], ebx
cmovne esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop esi
test eax, eax
je 0x441589
mov bl, 1
jmp 0x44159b
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jne 0x44159b
push 3
call fcn.00457a13
pop ecx
lea ecx, [ebp + 8]
call fcn.00425c1b
mov al, bl
pop ebx
leave
ret

Function at 0x4420a6
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 8]
movsx eax, byte [esi]
push eax
call fcn.00442060
pop ecx
test al, al
je 0x4421a0
mov al, byte [esi]
xor ebx, ebx
mov byte [ebp + 8], al
lea eax, [ebp - 4]
push eax
push str.GetDiskFreeSpaceExA
mov word [ebp + 9], 0x5c3a
mov byte [ebp + 0xb], bl
mov dword [ebp - 4], ebx
call fcn.00433804
push eax
call fcn.0043381c
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x442142
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp + 8]
push ecx
call eax
test eax, eax
je 0x442138
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x442120
mov ecx, dword [ebp - 0x18]
xor eax, eax
add eax, dword [ebp - 0x1c]
mov dword [edx], eax
adc ecx, ebx
mov dword [edx + 4], ecx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x44219c
mov ecx, dword [ebp - 0x20]
xor eax, eax
add eax, dword [ebp - 0x24]
mov dword [edx], eax
adc ecx, ebx
mov dword [edx + 4], ecx
jmp 0x44219c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x78
jne 0x4421a0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x4421a0
mov eax, dword [ebp - 8]
mul dword [ebp - 0xc]
mov esi, dword [ebp + 0xc]
mov ebx, edx
push edi
mov edi, eax
test esi, esi
je 0x442183
push ebx
push edi
push 0
push dword [ebp - 0x10]
call fcn.0046a650
mov dword [esi], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x44219b
push ebx
push edi
push 0
push dword [ebp - 0x14]
call fcn.0046a650
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
mov al, 1
jmp 0x4421a2
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x4422fd
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], ebx
movsx eax, byte [edi]
push eax
call fcn.00442060
pop ecx
test al, al
je 0x44239c
push esi
lea edx, [ebx + 0x1c]
mov word [ebp + 9], 0x5c3a
lea ecx, [ebx + 0x20]
mov dword [edx], 0xff
and dword [ecx], 0
lea esi, [ebx + 0xc]
and dword [esi], 0
mov al, byte [edi]
mov edi, 0x3ff
mov byte [ebp + 8], al
xor eax, eax
push edi
mov byte [ebp + 0xb], al
mov byte [ebp - 0x404], al
mov byte [ebp - 0x804], al
lea eax, [ebp - 0x804]
push eax
push ecx
push edx
push esi
push edi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov esi, dword [ebp - 4]
test eax, eax
push edi
lea eax, [ebp - 0x404]
mov ecx, esi
push eax
setne bl
call fcn.0042f09c
push edi
lea eax, [ebp - 0x804]
push eax
lea ecx, [esi + 0x10]
call fcn.0042f09c
mov al, bl
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x442765
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.004319c9
pop ecx
test al, al
je 0x44277a
or eax, 0xffffffff
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop ebp
ret

Function at 0x44285a
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.004319de
pop ecx
test al, al
je 0x44286e
xor al, al
pop ebp
ret
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x442a19
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
and eax, 1
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x442a37
xor al, al
pop ebp
ret
test byte [ebp + 0x10], 0x80
je 0x442a4a
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045e97e
pop ecx
pop ecx
test dword [ebp + 0x10], 0x200
je 0x442a63
push 5
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004432e7
add esp, 0xc
mov al, 1
pop ebp
ret
Function at 0x4435cd
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.004319c9
pop ecx
test al, al
jne 0x44366b
mov ebx, dword [ebp + 0xc]
xor edi, edi
test ebx, 0x100
je 0x443600
push esi
call fcn.00443fe7
or eax, edx
pop ecx
jne 0x443670
test bl, 1
jne 0x44360e
push edi
push esi
call fcn.0044279e
pop ecx
pop ecx
test bl, 2
jne 0x4436de
test bl, bl
js 0x443677
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x443799
test ebx, 0x800
je 0x443649
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x443799
cmp eax, 3
je 0x443799
test bl, 0x10
je 0x443670
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x443670
cmp eax, 3
je 0x443670
push esi
or ebx, 2
call fcn.004319c9
pop ecx
test al, al
je 0x4435ed
call fcn.00457a21
xor al, al
pop edi
pop esi
pop ebx
leave
ret
lea ecx, [ebp - 0x10]
call fcn.004282a8
push closesocket
push esi
lea ecx, [ebp - 0x10]
call fcn.0042f491
push edi
lea ecx, [ebp - 0x10]
call fcn.004240d6
push edi
lea eax, [ebp - 0x3c]
push 0x1e
push eax
call fcn.00429b97
add esp, 0xc
mov dword [ebp - 0x38], 3
cmp dword [ebp - 0x10], edi
mov eax, 0x49ab64
cmovne eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, 0x454
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, eax
lea ecx, [ebp - 0x10]
neg ebx
sbb bl, bl
inc bl
jmp 0x4437d5
call fcn.004567b6
test al, al
je 0x4437ae
mov eax, dword [0x4db2a4]
test eax, eax
je 0x443702
push 4
push edi
push esi
call eax
test eax, eax
jne 0x443799
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00457cbf
mov edi, 0x49ab60
mov dword [esp], str.wininit.exe
mov ecx, edi
cmp dword [eax], 0
cmovne ecx, dword [eax]
lea eax, [ebp - 0x10]
push ecx
push eax
call fcn.0044440c
mov ecx, edi
cmp dword [eax], 0
cmovne ecx, dword [eax]
push ecx
call fcn.00443832
add esp, 0x10
lea ecx, [ebp - 0x10]
mov bl, al
call fcn.00425c1b
lea ecx, [ebp - 0x1c]
call fcn.00425c1b
test bl, bl
je 0x4437a0
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00445703
push 0
push 0x49ae48
lea eax, [ebp - 0x10]
push 0
push eax
push eax
call fcn.00458769
cmp dword [ebp - 0x10], 0
cmovne edi, dword [ebp - 0x10]
push edi
push 0x4a5824
call fcn.00447d35
add esp, 0x24
lea ecx, [ebp - 0x10]
mov bl, al
call fcn.00425c1b
test bl, bl
je 0x4437a0
mov al, 1
jmp 0x443672
push dword [ebp - 4]
call fcn.00457a13
pop ecx
jmp 0x443670
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.00445703
mov ecx, 0x49ab60
cmp dword [eax], edi
cmovne ecx, dword [eax]
push ecx
push 0x4a5824
call fcn.00447d35
add esp, 0x10
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.00425c1b
mov al, bl
jmp 0x443672
Function at 0x4476b2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
cmp byte [esi + 0x6b], 0
jne 0x4476da
push closesocket
push str.Read_access_denied
lea ecx, [esi + 0x44]
call fcn.0042ef3b
xor al, al
jmp 0x447777
cmp byte [esi + 0x68], 0
push ebx
push edi
je 0x4476f7
push dword [ebp + 0xc]
lea ecx, [esi + 0x2c]
mov eax, dword [ecx]
push dword [ebp + 8]
mov eax, dword [eax]
call eax
test al, al
jne 0x447752
jmp 0x447761
xor edi, edi
cmp dword [esi + 0xc], edi
jne 0x44770a
push closesocket
push str.File_not_open
jmp 0x44776b
call fcn.00447415
push edi
mov ebx, eax
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
mov dword [ebp - 8], edx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44774d
lea eax, [ebp - 0x14]
push eax
call fcn.004577c2
pop ecx
push eax
lea ecx, [esi + 0x44]
call fcn.0040887d
lea ecx, [ebp - 0x14]
call fcn.00425c1b
jmp 0x447773
cmp edi, dword [ebp - 4]
jne 0x447756
mov al, 1
jmp 0x447775
push dword [ebp - 8]
mov ecx, esi
push ebx
call fcn.0044754e
push closesocket
push str.Read_past_end_of_file
lea ecx, [esi + 0x44]
call fcn.0042ef3b
xor al, al
pop edi
pop ebx
pop esi
leave
ret 8

Function at 0x447bc9
Capabilities:
Clear file content

Disassembly:
cmp byte [ecx + 0x6c], 0
je 0x447bf5
cmp byte [ecx + 0x68], 0
je 0x447be0
add ecx, 0x2c
call fcn.00424c32
mov al, 1
ret
cmp dword [ecx + 0xc], 0
je 0x447bf5
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
ret
xor al, al
ret