joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4056c5
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [0x4403fc]
test eax, eax
je 0x4057c5
push ebx
push ebp
push esi
xor edx, edx
mov dword [0x4403fc], 0
xor eax, eax
push edi
movzx esi, byte [eax + 0x438058]
push 0x1f
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
or edx, esi
inc eax
cmp eax, 0xe
jl 0x4056e5
xor ecx, ecx
push 8
mov eax, ecx
pop esi
test al, 1
je 0x40570f
shr eax, 1
xor eax, edx
jmp 0x405711
shr eax, 1
dec esi
jne 0x405705
mov dword [ecx*4 + 0x441b68], eax
inc ecx
cmp ecx, 0x100
jl 0x405700
mov edi, 0x442b68
mov ecx, 0xff00
mov eax, dword [edi - 0x1000]
mov esi, eax
and esi, ecx
mov ebx, eax
shl ebx, 0x10
add esi, ebx
mov edx, eax
shr edx, 8
shl esi, 8
mov ebx, edx
and ebx, ecx
add esi, ebx
mov ebx, eax
shr ebx, 0x18
add esi, ebx
mov dword [edi], esi
lea esi, [edi + 0x400]
mov dword [esp + 0x10], 3
and eax, 0xff
mov eax, dword [eax*4 + 0x441b68]
xor eax, edx
mov ebx, eax
and ebx, ecx
mov ebp, eax
shl ebp, 0x10
add ebx, ebp
mov edx, eax
shr edx, 8
shl ebx, 8
mov ebp, edx
and ebp, ecx
add ebx, ebp
mov ebp, eax
shr ebp, 0x18
add ebx, ebp
mov dword [esi - 0x1000], eax
mov dword [esi], ebx
add esi, 0x400
dec dword [esp + 0x10]
jne 0x405764
add edi, 4
cmp edi, 0x442f68
jl 0x40572e
pop edi
pop esi
pop ebp
mov dword [0x4403c4], 0
pop ebx
pop ecx
ret
mov eax, dword [0x4403c4]
test eax, eax
jne 0x4057c5
pop ecx
ret
Function at 0x406846
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea edi, [eax + 0x1c]
shr eax, 2
mov esi, eax
shr esi, 1
add esi, 3
mov dword [ecx], esi
add ecx, 0x10
xor esi, esi
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], eax
test eax, eax
jbe 0x40687d
mov ebx, dword [edx]
mov dword [ecx + esi*4], ebx
inc esi
add edx, 4
cmp esi, eax
jb 0x406870
cmp esi, edi
jae 0x406960
mov edx, esi
sub edx, eax
lea eax, [ecx + edx*4]
mov dword [ebp - 4], eax
xor edx, edx
mov eax, esi
div dword [ebp + 8]
mov edi, dword [ecx + esi*4 - 4]
mov dword [ebp - 8], eax
test edx, edx
jne 0x4068f6
mov eax, edi
mov edx, 0xff
and eax, edx
movzx eax, byte [eax + str.cw]
mov ebx, edi
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
shl eax, 8
or eax, ebx
mov ebx, edi
shr edi, 8
and edi, edx
shr ebx, 0x10
and ebx, edx
movzx edx, byte [edi + str.cw]
movzx ebx, byte [ebx + str.cw]
mov edi, dword [ebp - 8]
movzx edi, byte [edi + 0x4373cc]
shl eax, 8
or eax, ebx
xor edx, edi
shl eax, 8
or eax, edx
mov edi, eax
jmp 0x406948
cmp dword [ebp + 8], 6
jbe 0x406948
cmp edx, 4
jne 0x406948
mov edx, edi
shr edx, 0x10
mov ebx, edi
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
mov eax, 0xff
and edx, eax
movzx edx, byte [edx + str.cw]
shl ebx, 8
or edx, ebx
mov ebx, edi
shr ebx, 8
and ebx, eax
movzx ebx, byte [ebx + str.cw]
shl edx, 8
and edi, eax
movzx eax, byte [edi + str.cw]
or edx, ebx
shl edx, 8
or edx, eax
mov edi, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add dword [ebp - 4], 4
xor eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x40688f
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40836c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
push edi
xor edi, edi
and edx, 7
cmp ecx, 5
jae 0x408388
xor eax, eax
jmp 0x40849c
mov eax, dword [ebp + 8]
add dword [ebp + 0xc], 5
sub ecx, 4
add ecx, eax
push ebx
mov dword [ebp - 4], ecx
push esi
lea esi, [edi + eax]
jmp 0x4083a9
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x4083ae
inc esi
cmp esi, dword [ebp - 4]
jb 0x40839e
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, eax
sub edi, eax
cmp esi, dword [ebp - 4]
jae 0x408486
cmp ecx, 2
jbe 0x408403
xor edx, edx
movzx ecx, byte [esi + 4]
lea ebx, [ecx + 1]
test bl, 0xfe
jne 0x408422
movzx eax, byte [esi + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 0xc]
add eax, edi
add edi, 5
cmp dword [ebp + 0x14], 0
mov ebx, ecx
je 0x40842d
add ebx, eax
jmp 0x40842f
shr edx, cl
test edx, edx
je 0x4083c8
cmp edx, 4
ja 0x408422
cmp edx, 3
je 0x408422
mov ecx, edx
shr ecx, 1
movzx ecx, byte [ecx + esi + 1]
inc ecx
test cl, 0xfe
jne 0x4083c8
or edx, 8
shr edx, 1
inc edi
jmp 0x408399
sub ebx, eax
test edx, edx
je 0x408460
and edx, 6
shl edx, 2
mov ecx, edx
mov edx, ebx
shr edx, cl
mov dword [ebp - 8], ecx
inc edx
test dl, 0xfe
jne 0x40845e
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
cmp dword [ebp + 0x14], 0
je 0x40845c
add ebx, eax
jmp 0x40845e
sub ebx, eax
xor edx, edx
mov eax, ebx
shr eax, 8
mov byte [esi + 2], al
mov eax, ebx
mov byte [esi + 1], bl
shr ebx, 0x18
shr eax, 0x10
and bl, 1
neg bl
mov byte [esi + 3], al
mov eax, dword [ebp + 8]
mov byte [esi + 4], bl
jmp 0x408399
push 2
pop eax
shr edx, cl
cmp eax, ecx
mov ecx, dword [ebp + 0x10]
sbb eax, eax
not eax
and eax, edx
pop esi
mov dword [ecx], eax
mov eax, edi
pop ebx
pop edi
leave
ret

Function at 0x40bf2d
Capabilities:
Hash data using sha256

Disassembly:
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret

Function at 0x40ca79
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [ecx + 0x20]
and esi, 0x3f
push edi
mov edi, eax
mov byte [esi + ecx + 0x28], 0x80
jmp 0x40ca99
and esi, 0x3f
jne 0x40ca94
call fcn.0040bf6d
mov byte [ecx + esi + 0x28], 0
inc esi
cmp esi, 0x38
jne 0x40ca8a
mov eax, dword [ecx + 0x20]
mov edx, dword [ecx + 0x24]
shld edx, eax, 3
shl eax, 3
bswap edx
bswap eax
mov dword [ecx + 0x60], edx
mov dword [ecx + 0x64], eax
call fcn.0040bf6d
xor edx, edx
mov eax, dword [ecx + edx*4 + 4]
mov esi, dword [ecx + edx*4]
bswap esi
bswap eax
mov dword [edi], esi
mov dword [edi + 4], eax
add edi, 8
inc edx
inc edx
cmp edx, 8
jb 0x40cabd
pop edi
mov eax, ecx
pop esi
jmp fcn.0040bf2d
Function at 0x40cb6f
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax], ecx
dec ecx
je 0x40cb8f
sub ecx, 3
je 0x40cb86
sub ecx, 6
jne 0x40cb93
add eax, 0x10
jmp fcn.0040bf2d
or dword [eax + 8], 0xffffffff
or dword [eax + 0xc], 0xffffffff
ret
or dword [eax + 4], 0xffffffff
ret
Function at 0x413de2
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
mov edx, dword [ecx + 8]
push ebx
mov ebx, eax
mov eax, dword [ecx]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
push esi
mov esi, dword [ecx + 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
je 0x413e6c
push edi
mov edi, 0xff
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, byte [ebx]
mov ebx, dword [ebp - 4]
shr ebx, 8
movzx edx, al
xor edx, dword [ebp - 4]
and edx, edi
xor ebx, dword [esi + edx*4]
movzx edx, bl
add edx, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0xc]
imul edx, edx, 0x8088405
inc edx
mov dword [ebp - 8], edx
shr edx, 0x18
xor edx, dword [ebp - 0xc]
shr ebx, 8
and edx, edi
xor ebx, dword [esi + edx*4]
dec dword [ebp + 8]
mov edx, ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], al
inc ebx
cmp dword [ebp + 8], 0
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ebx
jne 0x413e0f
pop edi
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
pop esi
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
pop ebx
leave
ret 4

Function at 0x413e80
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [eax]
movzx edx, dl
xor edx, ecx
push esi
mov esi, dword [eax + 0xc]
push edi
mov edi, 0xff
and edx, edi
mov edx, dword [esi + edx*4]
shr ecx, 8
xor edx, ecx
mov ecx, dword [eax + 8]
mov dword [eax], edx
movzx edx, dl
add edx, dword [eax + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [eax + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, edi
shr ecx, 8
xor ecx, dword [esi + edx*4]
pop edi
mov dword [eax + 8], ecx
pop esi
ret

Function at 0x413ec3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43f050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
mov cx, word [eax + 8]
or cx, 2
movzx ecx, cx
mov ebx, ecx
xor ebx, 1
imul ebx, ecx
lea edi, [ebp + esi - 0x10]
sar ebx, 8
xor bl, byte [edi]
mov dl, bl
call fcn.00413e80
inc esi
cmp esi, 0xb
mov byte [edi], bl
jl 0x413ee3
mov cx, word [eax + 8]
or cx, 2
movzx ecx, cx
mov byte [ebp - 0x11], bl
mov ebx, ecx
xor ebx, 1
imul ebx, ecx
sar ebx, 8
xor bl, byte [ebp + esi - 0x10]
mov dl, bl
call fcn.00413e80
cmp bl, byte [ebp + 0x10]
pop edi
pop esi
pop ebx
jne 0x413f4d
mov dl, byte [ebp - 0x11]
xor ecx, ecx
cmp dl, byte [ebp + 0xc]
setne cl
mov dword [eax + 0x10], ecx
xor eax, eax
inc eax
jmp 0x413f4f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fc9d
leave
ret 0xc

Function at 0x41486f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x414881
xor eax, eax
ret
not al
movzx eax, al
shr eax, 4
and eax, 1
ret
Function at 0x41488d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
push dword [esp + 0x10]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4148d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x4148b3
cmp eax, 2
jne 0x4148d3
mov eax, dword [esp + 0x10]
call fcn.00414ef3
mov edi, eax
test edi, edi
je 0x4148d3
push edi
call esi
push edi
mov ebx, eax
call fcn.004200e6
pop ecx
cmp ebx, 0xffffffff
jne 0x4148d7
xor eax, eax
jmp 0x4148e2
not bl
movzx eax, bl
shr eax, 4
and eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x414e8a
Capabilities:
Set file attributes

Disassembly:
push esi
test edi, edi
je 0x414eef
cmp word [edi], 0
je 0x414eef
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 4]
push eax
call fcn.004201c3
mov esi, eax
pop ecx
test esi, esi
je 0x414eef
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
call fcn.00414e5d
push dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push esi
call fcn.00414a0c
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x414ee3
test byte [esp + 0xc], 7
je 0x414ee3
push dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call fcn.004200e6
pop ecx
mov eax, ebx
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x415fff
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x432ca4
call fcn.0042e975
mov ebx, ecx
push dword [ebp + 8]
call fcn.00414938
mov edi, eax
xor esi, esi
pop ecx
mov dword [ebp + 8], edi
cmp edi, esi
jne 0x41602b
xor eax, eax
call fcn.0042ea14
ret 0x10
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], esi
cmp dword [ebx + 0x68], 0xffffffff
je 0x41603f
mov eax, dword [ebx]
push esi
mov ecx, ebx
call dword [eax + 0x20]
cmp dword [ebp + 0x10], esi
je 0x416055
push 0xffffffffffffffff
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0042028d
add esp, 0x10
push dword [ebp + 0xc]
mov esi, ebx
call fcn.0041610f
test eax, eax
jne 0x416095
mov eax, dword [ebx + 0x88]
push dword [eax + 0x1c]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push edi
call fcn.00414a0c
pop ecx
pop ecx
test eax, eax
jne 0x416087
push edi
call fcn.004200e6
pop ecx
jmp 0x416021
push dword [ebp + 0xc]
mov esi, ebx
call fcn.0041610f
test eax, eax
je 0x41607e
push dword [ebp + 8]
xor esi, esi
mov dword [ebx + 0x90], esi
mov dword [ebx + 0x94], esi
call fcn.004211b6
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], esi
pop ecx
lea esi, [ebx + 0x5c]
mov edi, 0x8000
mov dword [ebx + 0x6c], eax
call fcn.00411636
test eax, eax
jne 0x4160e8
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x58], 8
mov dword [eax], 0xa0000063
xor esi, esi
push dword [ebp + 8]
call fcn.004200e6
pop ecx
mov eax, esi
jmp 0x416023
xor eax, eax
cmp dword [ebx + 0xc], eax
jne 0x41610a
lea ecx, [ebp + 0xc]
push ecx
push eax
push ebx
push 0x41649a
push eax
push eax
mov dword [ebp + 0xc], eax
call fcn.00421520
add esp, 0x18
mov dword [ebx + 0xc], eax
xor esi, esi
inc esi
jmp 0x4160d8

Function at 0x41610f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x43f050]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [esi + 0x88]
push dword [ecx + 0x1c]
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.00418cf4
add esp, 0xc
mov dword [esi + 0x68], eax
cmp eax, 0xffffffff
je 0x416186
test edi, edi
je 0x416186
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x416186
cmp word [edi + 2], 0x3a
jne 0x416186
cmp word [edi + 4], 0x5c
jne 0x416186
mov ax, word [edi]
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [esi + 0x98], eax
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [esi + 0x68], 0xffffffff
setne al
xor ecx, ebp
call fcn.0041fc9d
leave
ret 4
Function at 0x41619d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x54], 1
jne 0x4161b2
xor eax, eax
jmp 0x4162e4
push esi
push edi
call fcn.00418c2f
mov edi, dword [ebp + 0xc]
cmp edi, eax
jbe 0x416201
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
test eax, eax
je 0x4162e0
xor esi, esi
push esi
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
mov dword [ebp + 0xc], esi
push dword [ebx + 0x68]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4162e0
add ebx, 0x90
add dword [ebx], edi
adc dword [ebx + 4], esi
xor eax, eax
inc eax
jmp 0x4162e2
and dword [ebp - 4], 0
lea eax, [ebx + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 8]
lea esi, [ebx + 0x18]
call fcn.0040db6c
test eax, eax
jne 0x416227
mov dword [ebx + 0x54], 1
jmp 0x416247
push dword [ebx + 0x48]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [ebx + 0x2c]
call fcn.00418c2f
cmp esi, eax
jbe 0x416243
mov dword [ebp - 4], 1
and dword [ebx + 0x14], 0
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edi, [ebx + 0x30]
push edi
call esi
and dword [ebp - 8], 0
mov dword [ebp + 8], 0xbb8
jmp 0x4162bb
cmp dword [ebp + 8], 0
je 0x4162c1
cmp dword [ebp - 4], 0
je 0x416277
push 0xa
push dword [ebx + 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebx + 0x54], 0
jne 0x4162c1
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 4], eax
call fcn.00418c2f
cmp dword [ebp - 4], eax
jbe 0x4162b4
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 4], 1
cmp dword [ebp - 8], eax
jne 0x4162a8
dec dword [ebp + 8]
jmp 0x4162b8
mov dword [ebp - 8], eax
mov dword [ebp + 8], 0xbb8
jmp 0x4162b8
and dword [ebp - 4], 0
push edi
call esi
cmp dword [ebp - 4], 0
jne 0x416260
xor eax, eax
inc eax
cmp dword [ebx + 0x54], eax
je 0x4162e0
cmp dword [ebp + 8], 0
jle 0x4162e0
mov ecx, dword [ebp + 0xc]
add ebx, 0x90
add dword [ebx], ecx
adc dword [ebx + 4], 0
jmp 0x4162e2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x41634f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x6c]
xor ebx, ebx
push edi
mov dword [esi + 0x58], ebx
mov dword [ebp - 0x10], 0x436014
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
cmp eax, ebx
je 0x416386
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004158cb
push dword [esi + 0x6c]
call fcn.004200e6
pop ecx
cmp dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x6c], ebx
jne 0x4163a3
xor edi, edi
inc edi
lea esi, [ebp - 0x10]
call fcn.00415921
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
call fcn.00416450
xor eax, eax
inc eax
mov dword [ebp - 4], eax
cmp dword [esi + 0x54], eax
jne 0x4163b6
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 0x68]
mov dword [esi + 0x54], ebx
cmp ecx, 0xffffffff
je 0x4163d9
cmp dword [ebp - 4], ebx
je 0x4163d0
lea eax, [esi + 0x70]
push ecx
call fcn.004150b7
pop ecx
push dword [esi + 0x68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x68], 0xffffffff
push 6
xor eax, eax
pop ecx
lea edi, [esi + 0x70]
mov dword [esi + 0x98], ebx
rep stosd dword es:[edi], eax
cmp dword [ebp + 8], ebx
je 0x416400
cmp dword [ebp - 0xc], ebx
je 0x416400
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp - 4]
jmp 0x416392

Function at 0x41643d
Capabilities:
Set file attributes

Disassembly:
push dword [esp + 4]
mov eax, dword [ecx]
call dword [eax + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x4164aa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebx + 0x60]
and dword [ebp - 8], 0
push esi
push edi
mov dword [ebp - 4], eax
lea esi, [ebx + 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x14]
mov edi, dword [ebx + 0x2c]
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x4164ed
test eax, eax
jne 0x4164ed
mov eax, 0x8000
cmp edi, eax
sbb edi, edi
and edi, 0xffff8000
add edi, eax
jmp 0x4164fa
cmp edi, 0x8000
jb 0x4164fa
mov edi, 0x8000
test edi, edi
jne 0x41650b
test ecx, ecx
je 0x416521
mov dword [ebp - 8], 1
jmp 0x416521
push 1
push dword [ebp - 4]
lea esi, [ebx + 0x18]
call fcn.0040dc03
push dword [ebx + 0x50]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebx + 0x2c]
lea esi, [ebx + 0x30]
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x416563
push 0
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 4]
push dword [ebx + 0x68]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x416551
cmp dword [ebp - 0xc], edi
je 0x41656e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x54], 1
jmp 0x41656e
push 2
push dword [ebx + 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edi, edi
cmp dword [ebp - 0x10], edi
je 0x41658b
cmp dword [ebx + 0x54], edi
jne 0x41657f
cmp dword [ebp - 0x14], edi
jne 0x41658b
push dword [ebx + 0x4c]
mov dword [ebx + 0x14], edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [ebp - 8], edi
je 0x4164bf
pop edi
pop esi
leave
ret
Function at 0x418cf4
Capabilities:
Delete file
Set file attributes

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
xor eax, eax
push eax
push eax
push 2
push eax
push 5
mov edi, 0x40000000
push edi
push ebp
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x418dbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp eax, 5
je 0x418d65
cmp eax, 0x7b
je 0x418d65
cmp eax, 3
jne 0x418da6
cmp dword [esp + 0x20], 0
je 0x418db2
mov eax, ebp
call fcn.00414ef3
mov ebp, eax
xor eax, eax
cmp ebp, eax
je 0x418db2
push eax
push eax
push 2
push eax
push 1
push edi
push ebp
call esi
push ebp
mov ebx, eax
call fcn.004200e6
pop ecx
jmp 0x418da1
push ebp
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x418da6
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
push eax
push eax
push 2
push eax
push 1
push edi
push ebp
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x418dbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp ebx, 0xffffffff
jne 0x418dbc
cmp dword [esp + 0x10], 0
mov eax, 0xa0000031
je 0x418db6
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x418fdd
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x43f050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x44]
and dword [edi], 0
cmp dword [esi + 0xc], 0xffffffff
je 0x419002
mov eax, dword [esi]
call dword [eax + 0x28]
push edi
push dword [ebp + 8]
push ebx
call fcn.00418dc4
add esp, 0xc
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
jne 0x41901b
xor eax, eax
jmp 0x41906f
call fcn.004195ce
push ebx
call fcn.00419597
test ebx, ebx
je 0x41906c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x41906c
cmp word [ebx + 2], 0x3a
jne 0x41906c
cmp word [ebx + 4], 0x5c
jne 0x41906c
mov ax, word [ebx]
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [esi + 0x10], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041fc9d
leave
ret 4
Function at 0x4190fa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x419293
push edi
mov edi, dword [esi + 0x1c]
sub edi, dword [esi + 0x20]
mov dword [ebp - 4], eax
jns 0x419124
mov dword [esi + 0x44], 0xa0000047
jmp 0x419259
cmp dword [esi + 0x14], 0
jne 0x419143
mov eax, dword [esi + 0x18]
test eax, eax
je 0x419143
push eax
call fcn.004201c3
pop ecx
mov dword [esi + 0x14], eax
test eax, eax
je 0x419259
cmp ebx, edi
ja 0x419174
mov eax, dword [esi + 0x14]
test eax, eax
je 0x419174
mov ecx, dword [esi + 0x20]
push ebx
add ecx, eax
push ecx
push dword [ebp + 8]
call fcn.004230c0
add dword [esi + 0x20], ebx
mov eax, dword [ebp + 0xc]
add esp, 0xc
add dword [esi + 0x28], ebx
adc dword [esi + 0x2c], 0
mov dword [eax], ebx
jmp 0x41928f
mov eax, dword [ebp + 0xc]
and dword [eax], 0
test edi, edi
jle 0x4191b7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4191b7
mov ecx, dword [esi + 0x20]
push edi
add ecx, eax
push ecx
push dword [ebp + 8]
call fcn.004230c0
and dword [esi + 0x1c], 0
and dword [esi + 0x20], 0
mov eax, dword [ebp + 0xc]
add dword [eax], edi
mov eax, dword [ebp + 8]
add eax, edi
mov dword [ebp - 4], eax
mov eax, edi
cdq
add esp, 0xc
sub ebx, edi
add dword [esi + 0x28], eax
adc dword [esi + 0x2c], edx
mov eax, dword [esi + 0x18]
cmp ebx, eax
jb 0x4191ed
and dword [ebp + 8], 0
push 0
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp - 4]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419250
mov eax, dword [ebp + 8]
add dword [esi + 0x28], eax
mov ecx, dword [ebp + 0xc]
adc dword [esi + 0x2c], 0
add dword [ecx], eax
jmp 0x41928f
mov edx, eax
shr edx, 1
lea ecx, [ebx + 0x1000]
cmp ecx, edx
ja 0x419205
shr eax, 2
mov dword [ebp + 8], edx
cmp ecx, eax
ja 0x419208
mov dword [ebp + 8], eax
push 0
mov edi, 0x1000
push edi
push dword [esi + 0x2c]
push dword [esi + 0x28]
call fcn.00428da0
mov ecx, eax
or ecx, edx
je 0x419231
mov ecx, dword [ebp + 8]
cmp ecx, edi
jbe 0x41922a
sub ecx, eax
cmp ecx, ebx
jb 0x419231
mov dword [ebp + 8], ecx
xor eax, eax
push eax
lea edi, [esi + 0x1c]
push edi
push dword [ebp + 8]
mov dword [edi], eax
push dword [esi + 0x14]
mov dword [esi + 0x20], eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41925d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x44], eax
xor eax, eax
jmp 0x419292
mov edi, dword [edi]
test edi, edi
je 0x41928f
cmp ebx, edi
jb 0x419269
mov ebx, edi
test ebx, ebx
je 0x41928f
mov eax, dword [esi + 0x14]
add eax, dword [esi + 0x20]
push ebx
push eax
push dword [ebp - 4]
call fcn.004230c0
add dword [esi + 0x20], ebx
mov eax, dword [ebp + 0xc]
add esp, 0xc
add dword [esi + 0x28], ebx
adc dword [esi + 0x2c], 0
add dword [eax], ebx
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 8