joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408880
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
or ebx, 0xffffffff
cmp dword [0x433908], 0
push edi
jne 0x408938
xor ecx, ecx
xor eax, eax
lea esp, [esp]
test al, 1
je 0x4088ad
shr eax, 1
xor eax, 0xedb88320
jmp 0x4088af
shr eax, 1
test al, 1
je 0x4088bc
shr eax, 1
xor eax, 0xedb88320
jmp 0x4088be
shr eax, 1
test al, 1
je 0x4088cb
shr eax, 1
xor eax, 0xedb88320
jmp 0x4088cd
shr eax, 1
test al, 1
je 0x4088da
shr eax, 1
xor eax, 0xedb88320
jmp 0x4088dc
shr eax, 1
test al, 1
je 0x4088e9
shr eax, 1
xor eax, 0xedb88320
jmp 0x4088eb
shr eax, 1
test al, 1
je 0x4088f8
shr eax, 1
xor eax, 0xedb88320
jmp 0x4088fa
shr eax, 1
test al, 1
je 0x408907
shr eax, 1
xor eax, 0xedb88320
jmp 0x408909
shr eax, 1
test al, 1
je 0x408916
shr eax, 1
xor eax, 0xedb88320
jmp 0x408918
shr eax, 1
mov dword [ecx*4 + 0x4350c0], eax
inc ecx
mov eax, ecx
cmp ecx, 0x100
jl 0x4088a0
mov dword [0x433908], 1
mov ebp, dword [esp + 0x18]
push 0
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea esp, [esp]
push 0
lea eax, [esp + 0x14]
push eax
push 0x1000
push 0x433910
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4089c5
mov ebp, dword [esp + 0x10]
mov edx, 0x433910
xor ecx, ecx
xor esi, esi
lea eax, [ebp + 0x433910]
mov edi, eax
sub edi, edx
cmp eax, edx
cmovb edi, ecx
test edi, edi
je 0x4089aa
lea esp, [esp]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
inc esi
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4350c0]
cmp esi, edi
jb 0x408990
test ebp, ebp
mov ebp, dword [esp + 0x18]
jne 0x408950
mov eax, dword [esp + 0x1c]
not ebx
pop edi
pop esi
pop ebp
mov dword [eax], ebx
mov eax, 1
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x408bd0
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
mov ebx, dword [edi]
test esi, esi
je 0x408c2f
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x408bf0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
mov eax, 0x80000000
cmp esi, eax
cmovb eax, esi
push eax
push ebx
push dword [edi + 8]
call ebp
mov ecx, dword [esp + 0x14]
neg eax
sbb eax, eax
add dword [edi + 0x14], ecx
and eax, 0xfffffffe
add ebx, ecx
sub esi, ecx
add eax, 2
jne 0x408c31
test ecx, ecx
je 0x408c36
test esi, esi
jne 0x408bf0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
ret
Function at 0x408c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
xor edi, edi
mov esi, dword [ebx]
and esi, 7
cmp eax, 5
jae 0x408c5d
pop edi
pop esi
xor eax, eax
pop ebx
ret
add dword [esp + 0x18], 5
mov edx, dword [esp + 0x10]
push ebp
lea ebp, [eax - 4]
add ebp, edx
lea esp, [esp]
lea eax, [edi + edx]
cmp eax, ebp
jae 0x408c86
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x408c86
inc eax
cmp eax, ebp
jb 0x408c77
mov ecx, eax
sub ecx, edi
mov edi, eax
sub ecx, edx
sub edi, edx
cmp eax, ebp
jae 0x408d64
cmp ecx, 2
jbe 0x408cde
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x408cfd
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
mov ecx, dword [esp + 0x1c]
add ecx, edi
add edi, 5
cmp dword [esp + 0x24], 0
mov dword [esp + 0x18], ecx
je 0x408d08
add ebx, ecx
jmp 0x408d0a
shr esi, cl
test esi, esi
je 0x408c9f
cmp esi, 4
ja 0x408cfd
cmp esi, 3
je 0x408cfd
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x408c9f
or esi, 8
shr esi, 1
inc edi
jmp 0x408c70
sub ebx, ecx
test esi, esi
je 0x408d41
and esi, 6
mov edx, ebx
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x408d3b
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
cmp dword [esp + 0x24], 0
je 0x408d37
add ebx, dword [esp + 0x18]
jmp 0x408d3b
sub ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
shr ecx, 0x10
and bl, 1
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
jmp 0x408c70
pop ebp
cmp ecx, 2
jbe 0x408d78
mov eax, dword [esp + 0x1c]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0x1c]
shr esi, cl
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x408d90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x434914], 0
push esi
jne 0x408e5d
xor esi, esi
mov eax, esi
and al, 1
movzx ecx, al
mov eax, esi
neg ecx
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
mov dword [esi*4 + 0x434910], eax
inc esi
cmp esi, 0x100
jl 0x408da0
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x10]
not eax
test edx, edx
je 0x408e8b
mov esi, dword [esp + 0xc]
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x434910]
dec edx
jne 0x408e70
not eax
pop esi
ret 0xc
Function at 0x7ffe53e5
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
cld
and bh, 0xff
cld
lea esp, [esp]
nop
add eax, 0
nop
lea esp, [esp]
cld
lea esp, [esp]
cld
and bh, 0xff
cld
lea esp, [esp]
cld
pushal
inc eax
popal
clc
pushal
inc eax
popal
cld
pushal
inc eax
popal
cld
add eax, 0
cld
push edx
cdq
pop edx
nop
add eax, 0
clc
add eax, 0
cld
lea esp, [esp]
cld
push edx
cdq
pop edx
clc
add eax, 0
stc
and bh, 0xff
cld
and bh, 0xff
and bh, 0xff
call 0x7ffe543f
pop edx
stc
nop
xor dx, dx
and al, 0xff
cld
add edx, 0xd5e0
cld
nop
xor ecx, ecx
clc
nop
mov cl, 0x1e
xor byte [ecx + edx], 0x28
loop 0x7ffe5456
and bh, 0xff
and al, 0xff
cld
push dword fs:[0x24]
nop
cld
clc
pop dword [edx + 0xa]
pushal
inc eax
popal
cld
lea esp, [esp]
cld
mov cl, 0xff
add eax, 0
clc
push es
pop ds
stc
push edx
loop 0x7ffe5480
pushal
inc eax
popal
clc
nop
cld
nop
mov dword [edx + 0x11], 0xffffacbb
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x1b], ecx
cld
pushal
inc eax
popal
cld
nop
clc
mov dword [edx + 0x100], ecx
push es
pop ds
cld
mov dword [eax + 0x2c], esp
lea esp, [esp]
add eax, 0
push 0
nop
push 0
cld
push 0
push eax
pop eax
clc
push 0
and bh, 0xff
stc
nop
push 0x30
pushal
inc eax
popal
push 0x20
cld
clc
cld
push 0
nop
add eax, 0
stc
push 0
and bh, 0xff
cld
nop
add edx, 0xffff7f30
push edx
stc
clc
stc
push edx
and bh, 0xff
stc
lea esp, [esp]
cld
push 0
push es
pop ds
cld
call dword [edx + 0x8213]
inc esi
dec esi
cld
add esp, 0x3f8
xor eax, eax
inc eax
add al, 0
cld
ret 0xc
Function at 0x4078d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44dba8
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0xaa
je 0x4078fb
push 0
call fcn.004058a0
add esp, 4
lea ecx, [esp + 4]
call fcn.00406c80
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x38], 0
call fcn.00406500
test al, al
jne 0x407943
lea ecx, [esp + 4]
mov dword [esp + 0x34], 0xffffffff
call fcn.00406f80
xor al, al
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 4
push ebx
mov ecx, esi
call fcn.00405ae0
lea ecx, [esp + 8]
call fcn.004057e0
push eax
lea ecx, [esp + 0xc]
call fcn.00427680
push eax
mov ecx, esi
call fcn.00406730
lea ecx, [esp + 8]
mov bl, al
mov dword [esp + 0x38], 0xffffffff
call fcn.00406f80
mov ecx, dword [esp + 0x30]
mov al, bl
pop ebx
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x40bb40
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44e1db
push eax
mov eax, 0x18a0
mov dword fs:[0], esp
call fcn.00429300
lea ecx, [esp]
call fcn.00425490
lea ecx, [esp]
mov dword [esp + 0x18a8], 0
call fcn.004254e0
test al, al
je 0x40bba9
lea eax, [esp + 0x98]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x18b4]
call fcn.00409d90
jmp 0x40bbfd
lea edx, [esp + 0x89c]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x40bbe9
lea eax, [esp + 0x98]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x18b4]
call fcn.00409d90
jmp 0x40bbfd
mov ecx, dword [esp + 0x18b0]
lea edx, [esp + 0x89c]
push edx
call fcn.00409fe0
lea ecx, [esp]
mov dword [esp + 0x18a8], 0xffffffff
call fcn.004254d0
mov ecx, dword [esp + 0x18a0]
mov dword fs:[0], ecx
add esp, 0x18ac
ret

Function at 0x40bc30
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44e1fb
push eax
mov eax, 0x20a4
mov dword fs:[0], esp
call fcn.00429300
lea ecx, [esp]
call fcn.00425490
lea ecx, [esp]
mov dword [esp + 0x20ac], 0
call fcn.004254e0
test al, al
je 0x40bc99
lea eax, [esp + 0x89c]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x89c]
push ecx
mov ecx, dword [esp + 0x20b8]
call fcn.00409d90
jmp 0x40bcf8
lea edx, [esp + 0x10a0]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40bce4
lea eax, [esp + 0x98]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40bcce
mov byte [esp + 0x98], al
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x20b8]
call fcn.00409d90
jmp 0x40bcf8
mov ecx, dword [esp + 0x20b4]
lea edx, [esp + 0x10a0]
push edx
call fcn.00409fe0
lea ecx, [esp]
mov dword [esp + 0x20ac], 0xffffffff
call fcn.004254d0
mov ecx, dword [esp + 0x20a4]
mov dword fs:[0], ecx
add esp, 0x20b0
ret
Function at 0x40bf30
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x44e27c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
push ebx
push esi
lea ecx, [esp + 8]
call fcn.00409ba0
mov eax, dword [esp + 0x248]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x244], 0
call fcn.0040ab50
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.0040b050
lea ecx, [esp + 0x118]
call fcn.00425490
lea ecx, [esp + 0x118]
mov byte [esp + 0x240], 1
call fcn.004254e0
test al, al
lea ecx, [esp + 8]
je 0x40bfbd
call fcn.0040a490
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne bl
jmp 0x40c08a
call fcn.00409ce0
cmp eax, 0x104
jle 0x40c0cb
lea ecx, [esp + 0x1b0]
call fcn.00409ba0
lea ecx, [esp + 0x1b0]
lea edx, [esp + 8]
push ecx
push edx
mov byte [esp + 0x248], 2
call fcn.0040ba30
add esp, 8
lea ecx, [esp + 0x90]
call fcn.00409ba0
push 0x45b8a0
lea ecx, [esp + 0x94]
mov byte [esp + 0x244], 3
call fcn.0040a830
lea ecx, [esp + 0x1b0]
call fcn.0040a900
push eax
lea ecx, [esp + 0x94]
call fcn.0040a830
lea ecx, [esp + 0x90]
call fcn.0040a060
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x40c05f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40c05d
mov esi, 1
test esi, esi
lea ecx, [esp + 0x90]
mov byte [esp + 0x240], 2
setne bl
call fcn.00409c70
lea ecx, [esp + 0x1b0]
mov byte [esp + 0x240], 1
call fcn.00409c70
lea ecx, [esp + 0x118]
mov byte [esp + 0x240], 0
call fcn.004254d0
lea ecx, [esp + 8]
mov dword [esp + 0x240], 0xffffffff
call fcn.00409c70
mov al, bl
pop esi
pop ebx
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
add esp, 0x23c
ret
push edi
lea ecx, [esp + 0xc]
call fcn.0040a060
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test edi, edi
jne 0x40c121
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x250]
mov ebx, eax
test esi, esi
je 0x40c115
push ebp
push ebx
mov ecx, esi
call fcn.0041e240
mov ebp, dword [esi]
lea ecx, [esp + 0x10]
call fcn.0040a900
push eax
push str.failedToDeleteFilepath
mov ecx, esi
call dword [ebp + 0x2c]
pop ebp
cmp ebx, 2
jne 0x40c11f
mov edi, 1
test edi, edi
lea ecx, [esp + 0x11c]
mov byte [esp + 0x244], 0
setne bl
call fcn.004254d0
lea ecx, [esp + 0xc]
mov dword [esp + 0x244], 0xffffffff
call fcn.00409c70
mov ecx, dword [esp + 0x23c]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x23c
ret
Function at 0x40ce80
Capabilities:
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44e331
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
push ebp
mov ebp, dword [esp + 0x1c4]
push esi
mov esi, dword [esp + 0x1c4]
push edi
mov edi, dword [esp + 0x1c4]
mov dword [ebp], 0
mov ecx, edi
mov dword [esi], 0xffffffff
call fcn.00409ce0
test eax, eax
jne 0x40cee7
mov ecx, dword [esp + 0x1d0]
test ecx, ecx
je 0x40cee0
mov eax, dword [ecx]
push str.GetAttributes:_filename_is_empty
call dword [eax + 0x14]
xor al, al
jmp 0x40d01b
push ebx
lea ecx, [esp + 0x10]
call fcn.00409ba0
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c4], 0
call fcn.0040ab50
push 0x5c
push 0x2f
lea ecx, [esp + 0x18]
call fcn.0040b050
lea ecx, [esp + 0x10]
call fcn.00409ce0
lea ecx, [esp + 0x120]
mov edi, eax
call fcn.00425490
mov bl, 1
cmp edi, 0x104
mov byte [esp + 0x1c0], bl
jge 0x40cf73
lea ecx, [esp + 0x10]
call fcn.0040a230
test al, al
jne 0x40cf58
lea ecx, [esp + 0x120]
call fcn.004254e0
test al, al
je 0x40cf73
lea ecx, [esp + 0x10]
call fcn.0040a490
push eax
call fcn.0040ecf0
add esp, 4
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x40cfea
jmp 0x40cfe1
test edi, edi
jle 0x40cfca
lea ecx, [esp + 0x98]
call fcn.00409ba0
lea ecx, [esp + 0x98]
lea edx, [esp + 0x10]
push ecx
push edx
mov byte [esp + 0x1c8], 2
call fcn.0040be20
add esp, 8
lea ecx, [esp + 0x98]
call fcn.0040a070
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x98]
mov dword [esi], eax
mov byte [esp + 0x1c0], bl
call fcn.00409c70
jmp 0x40cfdc
lea ecx, [esp + 0x10]
call fcn.0040a070
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x40cfed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp], eax
cmp dword [esi], 0xffffffff
lea ecx, [esp + 0x120]
mov byte [esp + 0x1c0], 0
setne bl
call fcn.004254d0
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c0], 0xffffffff
call fcn.00409c70
mov al, bl
pop ebx
mov ecx, dword [esp + 0x1b4]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1b4
ret
Function at 0x40d550
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x44e3cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1d0
push ebx
push esi
push edi
lea ecx, [esp + 0x34]
call fcn.00409ba0
mov eax, dword [esp + 0x1ec]
lea ecx, [esp + 0x34]
push eax
mov dword [esp + 0x1e8], 0
call fcn.0040ab50
push 0x5c
push 0x2f
lea ecx, [esp + 0x3c]
call fcn.0040b050
lea ecx, [esp + 0x144]
call fcn.00425490
mov bl, 1
lea ecx, [esp + 0x144]
mov byte [esp + 0x1e4], bl
call fcn.004254e0
test al, al
je 0x40d5db
push 0
lea ecx, [esp + 0x38]
call fcn.0040a490
push eax
call fcn.0040ecb0
add esp, 8
jmp 0x40d64f
lea ecx, [esp + 0x34]
call fcn.00409ce0
test eax, eax
jle 0x40d63d
lea ecx, [esp + 0xbc]
call fcn.00409ba0
lea ecx, [esp + 0xbc]
lea edx, [esp + 0x34]
push ecx
push edx
mov byte [esp + 0x1ec], 2
call fcn.0040be20
add esp, 8
lea ecx, [esp + 0xbc]
push 0
call fcn.0040a060
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 0xbc]
mov esi, eax
mov byte [esp + 0x1e4], bl
call fcn.00409c70
jmp 0x40d651
push 0
lea ecx, [esp + 0x38]
call fcn.0040a060
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x40d6a4
mov edi, dword [esp + 0x1f0]
test edi, edi
je 0x40d6a2
push ebp
lea ecx, [esp + 0x10]
call fcn.00406c80
lea ecx, [esp + 0x10]
mov byte [esp + 0x1e8], 3
call fcn.00407c20
mov ebp, dword [edi]
lea ecx, [esp + 0x10]
call fcn.00427680
push eax
push str.errorMsg
mov ecx, edi
call dword [ebp + 0x2c]
lea ecx, [esp + 0x10]
mov byte [esp + 0x1e8], bl
call fcn.00406f80
pop ebp
test esi, esi
lea ecx, [esp + 0x144]
mov byte [esp + 0x1e4], 0
setne bl
call fcn.004254d0
lea ecx, [esp + 0x34]
mov dword [esp + 0x1e4], 0xffffffff
call fcn.00409c70
mov ecx, dword [esp + 0x1dc]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1dc
ret
Function at 0x40d6f0
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x44e401
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
push ebx
push esi
lea ecx, [esp + 8]
call fcn.00409ba0
mov eax, dword [esp + 0x1c0]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x1bc], 0
call fcn.0040ab50
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.0040b050
lea ecx, [esp + 0x118]
call fcn.00425490
mov bl, 1
lea ecx, [esp + 0x118]
mov byte [esp + 0x1b8], bl
call fcn.004254e0
test al, al
lea ecx, [esp + 8]
je 0x40d776
call fcn.0040a490
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x40d7e2
call fcn.00409ce0
test eax, eax
jle 0x40d7d2
lea ecx, [esp + 0x90]
call fcn.00409ba0
lea ecx, [esp + 0x90]
lea edx, [esp + 8]
push ecx
push edx
mov byte [esp + 0x1c0], 2
call fcn.0040be20
add esp, 8
lea ecx, [esp + 0x90]
call fcn.0040a060
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [esp + 0x90]
mov esi, eax
mov byte [esp + 0x1b8], bl
call fcn.00409c70
jmp 0x40d7e4
lea ecx, [esp + 8]
call fcn.0040a060
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, eax
test esi, esi
lea ecx, [esp + 0x118]
mov byte [esp + 0x1b8], 0
setne bl
call fcn.004254d0
lea ecx, [esp + 8]
mov dword [esp + 0x1b8], 0xffffffff
call fcn.00409c70
mov ecx, dword [esp + 0x1b0]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1b4
ret

Function at 0x40d890
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x44e431
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
push ebx
push esi
lea ecx, [esp + 8]
call fcn.00409ba0
mov eax, dword [esp + 0x1c0]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x1bc], 0
call fcn.0040ab50
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.0040b050
mov ebx, 1
push 0
lea ecx, [esp + 0xc]
push ebx
push ecx
call fcn.0040c170
add esp, 0xc
lea ecx, [esp + 0x118]
call fcn.00425490
lea ecx, [esp + 0x118]
mov byte [esp + 0x1b8], bl
call fcn.004254e0
test al, al
je 0x40d93b
mov edx, dword [esp + 0x1c4]
lea ecx, [esp + 8]
push edx
call fcn.0040a490
push eax
call fcn.0040ecd0
add esp, 8
and eax, 0xff
jmp 0x40d9bb
lea ecx, [esp + 8]
call fcn.00409ce0
test eax, eax
jle 0x40d9a3
lea ecx, [esp + 0x90]
call fcn.00409ba0
lea eax, [esp + 0x90]
lea ecx, [esp + 8]
push eax
push ecx
mov byte [esp + 0x1c0], 2
call fcn.0040be20
mov edx, dword [esp + 0x1cc]
add esp, 8
lea ecx, [esp + 0x90]
push edx
call fcn.0040a060
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x90]
mov esi, eax
mov byte [esp + 0x1b8], bl
call fcn.00409c70
jmp 0x40d9bd
mov eax, dword [esp + 0x1c4]
lea ecx, [esp + 8]
push eax
call fcn.0040a060
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
test esi, esi
lea ecx, [esp + 0x118]
mov byte [esp + 0x1b8], 0
setne bl
call fcn.004254d0
lea ecx, [esp + 8]
mov dword [esp + 0x1b8], 0xffffffff
call fcn.00409c70
mov ecx, dword [esp + 0x1b0]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1b4
ret
Function at 0x40df60
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x44e4e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push esi
lea ecx, [esp + 4]
call fcn.00409ba0
mov eax, dword [esp + 0x124]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x120], 0
call fcn.0040ab50
push 0x5c
push 0x2f
lea ecx, [esp + 0xc]
call fcn.0040b050
lea ecx, [esp + 4]
call fcn.00409ce0
test eax, eax
jle 0x40e00f
lea ecx, [esp + 0x8c]
call fcn.00409ba0
lea ecx, [esp + 0x8c]
lea edx, [esp + 4]
push ecx
push edx
mov byte [esp + 0x124], 1
call fcn.0040be20
add esp, 8
lea ecx, [esp + 0x8c]
call fcn.0040a060
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0x8c]
mov esi, eax
mov byte [esp + 0x11c], 0
call fcn.00409c70
jmp 0x40e021
lea ecx, [esp + 4]
call fcn.0040a060
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test esi, esi
pop esi
jne 0x40e061
mov ecx, dword [esp + 0x124]
test ecx, ecx
je 0x40e036
call fcn.0041e1b0
lea ecx, [esp]
mov dword [esp + 0x118], 0xffffffff
call fcn.00409c70
xor al, al
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
add esp, 0x11c
ret
lea ecx, [esp]
mov dword [esp + 0x118], 0xffffffff
call fcn.00409c70
mov ecx, dword [esp + 0x110]
mov al, 1
mov dword fs:[0], ecx
add esp, 0x11c
ret

Function at 0x40ecd0
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret

Function at 0x40ecf0
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret
Function at 0x41d820
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
test ebp, ebp
push edi
je 0x41d9e3
mov ebx, dword [esp + 0x120]
test ebx, ebx
je 0x41d9e3
push ebp
push ebp
call fcn.0041d7c0
mov edi, dword [esp + 0x134]
add esp, 8
mov ecx, edi
push 0x3f0
push eax
call fcn.004062b0
mov eax, 0x55555556
xor esi, esi
imul ebp
mov ebp, dword [esp + 0x128]
mov eax, edx
shr eax, 0x1f
add edx, eax
xor ecx, ecx
test edx, edx
jle 0x41d942
mov dword [esp + 0x10], edx
jmp 0x41d894
mov ebx, dword [esp + 0x120]
xor eax, eax
xor edx, edx
mov al, byte [esi + ebx]
mov dl, byte [esi + ebx + 1]
inc esi
mov edi, edx
inc esi
xor edx, edx
mov dl, byte [esi + ebx]
mov ebx, eax
sar ebx, 2
and ebx, 0x3f
and eax, 3
shl eax, 4
mov bl, byte [ebx + ebp]
inc esi
mov byte [esp + ecx + 0x14], bl
mov ebx, edi
sar ebx, 4
and ebx, 0xf
inc ecx
or ebx, eax
and edi, 0xf
shl edi, 2
mov al, byte [ebx + ebp]
mov byte [esp + ecx + 0x14], al
mov eax, edx
sar eax, 6
and eax, 3
inc ecx
or eax, edi
and edx, 0x3f
inc ecx
mov al, byte [eax + ebp]
mov byte [esp + ecx + 0x13], al
mov dl, byte [edx + ebp]
mov byte [esp + ecx + 0x14], dl
inc ecx
cmp ecx, 0x100
jl 0x41d914
mov edi, dword [esp + 0x12c]
lea eax, [esp + 0x14]
push ecx
push eax
mov ecx, edi
call fcn.00406730
xor ecx, ecx
jmp 0x41d91b
mov edi, dword [esp + 0x12c]
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x41d88d
test ecx, ecx
je 0x41d93b
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
call fcn.00406730
mov ebx, dword [esp + 0x120]
mov eax, dword [esp + 0x124]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x41d9a6
dec edx
jne 0x41d9e3
xor eax, eax
xor edx, edx
mov al, byte [esi + ebx]
mov dl, byte [esi + ebx + 1]
mov dword [esp + 0x10], eax
mov ecx, edi
sar eax, 2
and eax, 0x3f
mov esi, edx
mov al, byte [eax + ebp]
push eax
call fcn.00405c00
mov eax, dword [esp + 0x10]
mov ecx, esi
sar ecx, 4
and eax, 3
and ecx, 0xf
shl eax, 4
or ecx, eax
mov dl, byte [ecx + ebp]
mov ecx, edi
push edx
call fcn.00405c00
and esi, 0xf
mov al, byte [ebp + esi*4]
push eax
jmp 0x41d9d3
xor ecx, ecx
mov cl, byte [esi + ebx]
mov esi, ecx
mov ecx, edi
mov edx, esi
sar edx, 2
and edx, 0x3f
mov al, byte [edx + ebp]
push eax
call fcn.00405c00
and esi, 3
shl esi, 4
mov cl, byte [esi + ebp]
push ecx
mov ecx, edi
call fcn.00405c00
push 0x3d
mov ecx, edi
call fcn.00405c00
push 0x3d
mov ecx, edi
call fcn.00405c00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret