joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001eb3e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x100399f0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1001eb84
cmp word [ebx], dx
jne 0x1001eb84
or byte [eax + edi + 0x28], 4
jmp 0x1001eb89
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1001ecec
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1001eccc
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1001ebca
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1001ec00
cmp eax, edx
jae 0x1001ec0e
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x1001eba5
jmp 0x1001ecec
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001ecc7
cmp dword [ebp - 0x18], 0
je 0x1001ecc7
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x100399f0]
test byte [eax + edi + 0x28], 0x48
je 0x1001ec9d
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x1001ec61
mov word [esi], cx
jmp 0x1001ec98
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x100399f0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x100399f0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x100399f0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1001ecec
pop eax
cmp word [ebp - 4], ax
jne 0x1001ecad
cmp esi, ebx
jne 0x1001ecad
mov word [esi], ax
jmp 0x1001ece9
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1001f577
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1001ecec
push 0xd
pop eax
jmp 0x1001eca8
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x100399f0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x1001ece6
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1001ecec
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10021c62
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10021cff
push ebx
push esi
call fcn.10021c2b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10020a00
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10021cac
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10021cfe
push edi
push eax
call fcn.1001c79a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10021ccc
call fcn.1001af56
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10021cfd
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10020a00
add esp, 0x20
test eax, eax
jne 0x10021ceb
push edi
call fcn.1001af56
jmp 0x10021cf3
push ebx
call fcn.1001af56
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10025382
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10019357
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100253f1
cmp esi, dword [ebp - 4]
je 0x100253ec
cmp dword [ebp + 0xc], 0
je 0x100253ec
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100253c9
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10024ed4
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x100253f3
xor eax, eax
inc eax
jmp 0x100253f3
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10025458
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10038080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10019357
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10019357
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x100254cf
cmp word [ecx], dx
je 0x100254cf
mov eax, dword [0x10030944]
push edi
dec eax
push eax
push 0x10030830
call fcn.100253f7
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10025542
cmp word [eax], dx
je 0x10025542
mov eax, dword [edi]
test eax, eax
je 0x100254f3
cmp word [eax], dx
je 0x100254f3
lea eax, [ebp - 0x10]
push eax
call fcn.10024dda
jmp 0x100254fc
lea eax, [ebp - 0x10]
push eax
call fcn.10024e75
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1002556c
mov eax, dword [0x1003082c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10030520
call fcn.100253f7
add esp, 0xc
test al, al
je 0x1002556c
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10025537
cmp word [eax], di
je 0x10025537
lea eax, [ebp - 0x10]
push eax
call fcn.10024dda
pop ecx
jmp 0x1002556e
lea eax, [ebp - 0x10]
push eax
call fcn.10024e75
jmp 0x10025534
mov eax, dword [edi]
test eax, eax
je 0x10025559
cmp word [eax], dx
je 0x10025559
lea eax, [ebp - 0x10]
push eax
call fcn.10024d8f
pop ecx
jmp 0x1002556c
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10025637
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1002527c
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10025637
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10025637
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10025637
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100255c4
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1001b5c7
test ebx, ebx
je 0x10025632
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1001b5c7
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10025637
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10025637
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1002883c
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10025639
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000ca72
leave
ret
Function at 0x10028571
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100284ed
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100286e0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100286e0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10028695
jg 0x100285cd
test eax, eax
je 0x1002868b
push 1
push 0x1000
call fcn.1001aef9
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100285f0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10028682
push 0x8000
push ebx
call fcn.1002841e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10028619
jg 0x10028614
cmp ecx, 0x1000
jb 0x10028619
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1001c214
add esp, 0x10
cmp eax, 0xffffffff
je 0x1002865e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10028614
jl 0x10028645
test ecx, ecx
jne 0x10028606
push dword [ebp - 0xc]
push ebx
call fcn.1002841e
push esi
call fcn.1001af56
add esp, 0xc
xor ebx, ebx
jmp 0x100286ee
cmp byte [edi + 0x24], 0
je 0x10028675
cmp dword [edi + 0x20], 5
jne 0x10028675
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10028680
mov ebx, dword [edi + 0x18]
jmp 0x10028682
xor ebx, ebx
push esi
call fcn.1001af56
pop ecx
jmp 0x100286ee
test ecx, ecx
jg 0x10028657
jl 0x10028695
test eax, eax
jae 0x10028657
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1001f577
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100286b5
cmp byte [edi + 0x1c], 0
je 0x10028657
jmp 0x100286e6
push ebx
call fcn.10023221
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10028657
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100286ee
cmp byte [edi + 0x1c], 0
je 0x100286eb
mov ebx, dword [edi + 0x18]
jmp 0x100286ee
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1001f577
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002a490
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002a4bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002a4bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x44b143
Capabilities:
Encode data using xor

Disassembly:
jae 0x44b1b7
jb 0x44b179
cmpsd dword [esi], dword es:[edi]
lodsd eax, dword [esi]
cmp bh, ch
mov dh, 0xab
stosd dword es:[edi], eax
sub al, 0xc4
inc edi
cmp esi, edx
and al, 0xce
pushal
stosb byte es:[edi], al
and al, 0x38
xor al, 0xd4
jae 0x44b17c
int 0xaf
movsd dword es:[edi], dword [esi]
push ebx
adc eax, dword gs:[0x3d92cb51]
int3
sub dword [ecx + 0x17], ecx
neg byte [esi]
mov dl, 0x79
pop esi
mov bh, 0xad
push 0xfffffffffffffffa
push edi
add dl, al
pop esp
push es
add eax, dword [ebx]
fnsave dword [edi + 0x46aed763]
ror bl, 0xbb
ja 0x44b1c4
lcall 0xda86, 0x5c7e6dc
mov edx, 0x6d971608
retf
Function at 0x4018bf
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
shr edi, 2
xor ebx, ebx
mov eax, edi
mov dword [ebp - 4], 1
shr eax, 1
mov ecx, ebx
add eax, 3
mov dword [esi], eax
add esi, 0x10
test edi, edi
je 0x4018f6
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, edi
jb 0x4018e9
mov edx, dword [esi + edi*4 - 4]
imul eax, edi, 0xc
add eax, 0x70
add eax, esi
mov dword [ebp + 8], eax
test ebx, ebx
jne 0x401964
movzx eax, dl
mov ebx, dword [ebp - 4]
push 0x1b
movzx ecx, byte [eax + 0x10945c0]
mov eax, edx
shr eax, 0x18
shl ecx, 8
movzx eax, byte [eax + 0x10945c0]
or ecx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
shr edx, 8
shl ecx, 8
movzx eax, byte [eax + 0x10945c0]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + 0x10945c0]
xor edx, ebx
add ebx, ebx
or edx, ecx
test ebx, 0x100
pop eax
cmovne ebx, eax
mov dword [ebp - 4], ebx
mov ebx, edi
jmp 0x4019b1
cmp ebx, 4
jne 0x4019b4
cmp edi, 6
jbe 0x4019b4
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + 0x10945c0]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + 0x10945c0]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x10945c0]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + 0x10945c0]
or edx, ecx
mov eax, dword [ebp + 8]
xor edx, dword [esi]
dec ebx
mov dword [esi + edi*4], edx
add esi, 4
cmp esi, eax
jne 0x401905
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402b17
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [0x10e306c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x368]
mov dword [ebp - 0x368], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x402b57
cmp dword [ebp - 0x364], 6
jne 0x402b57
cmp dword [ebp - 0x360], 0
je 0x402b81
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402b81
push 0xc00
call eax
test eax, eax
jne 0x402c16
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402c16
cmp eax, 0x104
ja 0x402c16
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d6], cx
je 0x402bc1
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [str.UXTHEME], 0
push esi
mov esi, str.UXTHEME
je 0x402c15
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + eax*2]
mov edx, edi
mov cl, byte [esi]
inc esi
movzx eax, cl
mov word [edx], ax
lea edx, [edx + 2]
test cl, cl
jne 0x402bdc
push str..dll
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
push 0
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x402bda
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01018f77
leave
ret
Function at 0x408e03
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.0106e226
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x408e2f
call fcn.00408d15
mov esi, eax
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x40aee8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [ebp + 0x10]
xor ebx, ebx
lea ecx, [ebp - 4]
push 0x2002
mov dword [ebp - 4], ebx
call fcn.0040d996
test al, al
je 0x40af41
push esi
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x40af40
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.0106a6a0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x40af40
mov dword [ebp - 4], ebx
mov bl, 1
pop esi
lea ecx, [ebp - 4]
call fcn.0040d9b9
mov al, bl
pop ebx
leave
ret 0xc

Function at 0x40af50
Capabilities:
Open clipboard

Disassembly:
push 0x18
mov eax, 0x1090542
call fcn.0101921a
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
setne al
mov byte [ebp + 0xb], al
test al, al
je 0x40b011
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x40b00e
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
lea eax, [eax*2 + 2]
push eax
push dword [esi]
push 0xd
call fcn.0040aee8
push 0
mov bl, al
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.0040a4c9
mov ecx, dword [ebp - 0x14]
xor eax, eax
inc eax
inc ecx
push ecx
push dword [ebp - 0x18]
mov byte [ebp - 4], al
push eax
call fcn.0040aee8
push 1
pop edi
push edi
test al, al
movzx ebx, bl
push esi
lea eax, [ebp - 0x24]
cmovne ebx, edi
push eax
call fcn.0040a4c9
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00409521
push dword [ebp - 0x24]
call fcn.010191d5
mov eax, dword [ebp - 0x14]
pop ecx
inc eax
push eax
push dword [ebp - 0x18]
push 7
call fcn.0040aee8
push dword [ebp - 0x18]
test al, al
movzx ebx, bl
cmovne ebx, edi
call fcn.010191d5
pop ecx
jmp 0x40b017
mov al, byte [ebp + 0xb]
xor bl, bl
test al, al
je 0x40b01d
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
call fcn.010191e8
ret 8
Function at 0x40bbe5
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x109063a
call fcn.0101921a
cmp byte [0x10e74d4], 0
mov edi, dword [ebp + 8]
jne 0x40bc21
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.0040a299
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.010191d5
pop ecx
test esi, esi
jmp 0x40bc2d
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40bc33
mov al, 1
jmp 0x40bc79
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40bc44
xor al, al
jmp 0x40bc79
lea ecx, [ebp - 0x50]
call fcn.0040c07e
lea ecx, [ebp - 0x28]
call fcn.004094fd
push ebx
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.0040c2e8
test al, al
je 0x40bc6e
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.010191d5
pop ecx
mov al, bl
call fcn.010191e8
ret 4

Function at 0x40bc81
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10e74d4], 0
jne 0x40bcb7
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.010191d5
pop ecx
test esi, esi
pop esi
jmp 0x40bcc4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40bcca
mov al, 1
jmp 0x40bccc
xor al, al
leave
ret 4

Function at 0x40bcd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040c91e
cmp eax, 0xffffffff
je 0x40bcfd
mov ecx, eax
and cl, 0x11
cmp cl, 1
jne 0x40bcfd
and eax, 0xfffffffe
push eax
push esi
call fcn.0040bf9e
test al, al
je 0x40bd35
cmp byte [0x10e74d4], 0
push esi
jne 0x40bd27
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.010191d5
pop ecx
test esi, esi
jmp 0x40bd2f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40bd35
mov al, 1
jmp 0x40bd37
xor al, al
pop esi
leave
ret 4

Function at 0x40bef3
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10e74d4], 0
jne 0x40bf27
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.010191d5
pop ecx
test esi, esi
pop esi
jmp 0x40bf32
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40bf38
mov al, 1
jmp 0x40bf3a
xor al, al
leave
ret 4
Function at 0x40bf9e
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10e74d4], 0
jne 0x40bfd5
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.010191d5
pop ecx
test esi, esi
pop esi
jmp 0x40bfe3
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40bfe9
mov al, 1
jmp 0x40bfeb
xor al, al
leave
ret 8

Function at 0x40c91e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10e74d4], 0
jne 0x40c952
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.010191d5
pop ecx
mov eax, esi
pop esi
jmp 0x40c965
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
leave
ret 4
Function at 0x40c9f0
Capabilities:
Get disk information

Disassembly:
push 0x2c
mov eax, 0x109075c
call fcn.0101921a
mov ecx, dword [ebp + 8]
call fcn.00408f10
cmp byte [0x10e74d4], 0
jne 0x40cadd
mov ecx, dword [ebp + 8]
call fcn.00408f10
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x40caf0
push edi
call fcn.010191cc
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x40cb92
cmp edi, dword [ebp - 0x18]
ja 0x40cb92
lea ecx, [ebp - 0x2c]
call fcn.0040933c
mov byte [ebp - 4], 1
test edi, edi
je 0x40cad3
xor eax, eax
mov dword [ebp - 0x14], edi
inc eax
mov ecx, edi
mov dword [ebp - 0x10], eax
cmp byte [esi + eax - 1], 0
jne 0x40cac4
lea eax, [ebx + esi]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00409571
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0040a257
mov edi, eax
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 2
call fcn.00408f92
mov ecx, dword [ebp + 8]
push edi
call fcn.00408ecc
push dword [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.010191d5
pop ecx
mov ecx, dword [ebp - 0x14]
mov eax, ebx
inc eax
sub ecx, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
jne 0x40ca78
mov edi, dword [ebp - 0x1c]
push dword [ebp - 0x2c]
cmp ebx, edi
jmp 0x40cb89
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x40caf7
xor al, al
jmp 0x40cb9b
push edi
lea ecx, [ebp - 0x1c]
call fcn.0040c013
mov esi, dword [ebp - 0x1c]
push esi
push edi
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x40cb92
cmp edi, dword [ebp - 0x18]
ja 0x40cb92
lea ecx, [ebp - 0x38]
call fcn.004094fd
mov byte [ebp - 4], 4
mov edx, ebx
mov dword [ebp - 0x18], edx
mov eax, ebx
mov dword [ebp - 0x10], eax
test edi, edi
je 0x40cb84
push 2
pop ecx
mov dword [ebp - 0x14], ecx
cmp word [esi + ecx - 2], bx
jne 0x40cb73
lea eax, [edx + esi]
push eax
lea ecx, [ebp - 0x38]
call fcn.004096a8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
inc eax
mov dword [ebp - 0x18], eax
call fcn.00408f92
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x38]
push eax
call fcn.00408ecc
mov ecx, dword [ebp - 0x14]
mov edx, ecx
mov eax, dword [ebp - 0x10]
inc eax
add ecx, 2
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, edi
jb 0x40cb3d
mov edx, dword [ebp - 0x18]
push dword [ebp - 0x38]
cmp edx, edi
sete bl
call fcn.010191d5
pop ecx
push esi
call fcn.010191d5
mov al, bl
pop ecx
call fcn.010191e8
ret 4