joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496aec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
xor ecx, ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x496bbf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404bc0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x105
lea eax, [ebp - 0x115]
push eax
lea eax, [ebp - 0x11c]
mov dl, byte [ebp - 1]
call fcn.00404da8
lea eax, [ebp - 0x11c]
mov edx, 0x496bd4
call fcn.00404e88
mov eax, dword [ebp - 0x11c]
call fcn.00405080
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea eax, [ebp - 0x115]
call fcn.00409c0c
mov ecx, eax
lea edx, [ebp - 0x115]
mov eax, dword [ebp - 8]
call fcn.00404cb0
lea edx, [ebp - 0x120]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00408fb0
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp - 8]
call fcn.00404c14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496bc6
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.00404be4
ret

Function at 0x496bd8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x496ca6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x496994]
call fcn.0042aa14
mov dword [ebp - 0x14], eax
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0x41
cmp dword [ebp - 8], 0
jbe 0x496c7d
test byte [ebp - 8], 1
je 0x496c71
lea eax, [ebp - 0x1c]
mov dl, byte [ebp - 9]
call fcn.00404da8
lea eax, [ebp - 0x1c]
mov edx, 0x496cbc
call fcn.00404e88
mov eax, dword [ebp - 0x1c]
call fcn.00405080
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x496c71
lea edx, [ebp - 0x10]
mov al, byte [ebp - 9]
call fcn.00496aec
mov eax, dword [ebp - 0x10]
push eax
mov cl, byte [ebp - 9]
mov dl, 1
mov eax, dword [0x496924]
call fcn.00496a04
mov edx, eax
mov eax, dword [ebp - 0x14]
call fcn.00496ad0
shr dword [ebp - 8], 1
inc byte [ebp - 9]
cmp dword [ebp - 8], 0
ja 0x496c18
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496cad
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404be4
lea eax, [ebp - 0x10]
call fcn.00404bc0
ret
Function at 0x49d9f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov dl, byte [ebp - 5]
xor dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
call fcn.004529f0
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x318]
call fcn.004529f0
cmp byte [ebp - 5], 0
je 0x49da4e
mov eax, dword [0x4c80c8]
mov eax, dword [eax]
mov byte [eax + 0x5b], 1
push 5
mov eax, dword [0x4c80c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
call fcn.0045dc3c
jmp 0x49da73
mov eax, dword [0x4c80c8]
mov eax, dword [eax]
mov byte [eax + 0x5b], 0
push 0
mov eax, dword [0x4c80c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
call fcn.0045dc34
pop ecx
pop ecx
pop ebp
ret
Function at 0x4a1314
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
xor edx, edx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a1500
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x60]
mov al, 0xc
call fcn.0049ce78
mov edx, dword [ebp - 0x5f]
lea eax, [ebp - 0xc]
call fcn.00404c58
mov edx, 0x46a0
mov eax, dword [ebp - 0xc]
call fcn.0040965c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0x64
mov dword [ebp - 0x14], eax
mov ax, word [ebp - 0x10]
call fcn.0049dc84
call fcn.0049dd30
test al, al
jne 0x4a1385
inc dword [ebp - 0x10]
call fcn.0049dd30
test al, al
jne 0x4a1396
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jle 0x4a1370
call fcn.0049dd30
test al, al
je 0x4a14ac
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004094e4
lea ecx, [ebp - 0x68]
mov edx, dword [ebp - 0xc]
mov al, 0xc
call fcn.0049ce98
call fcn.0049dd30
call fcn.004a1220
mov byte [ebp - 5], 0
mov al, 0x12
call fcn.0049ce58
test al, al
je 0x4a143c
call fcn.0049dce0
movzx eax, ax
lea edx, [ebp - 0x6c]
call fcn.004094e4
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0xc]
mov edx, 0x4a1518
call fcn.00404ecc
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403650
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x40
mov eax, dword [ebp - 4]
mov dword [ebp - 0x48], eax
mov eax, 0x4a152c
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xc]
call fcn.00405080
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 1
lea eax, [ebp - 0x50]
push eax
call sub.shell32.dll_ShellExecuteExA
jmp 0x4a149a
call fcn.0049dce0
movzx eax, ax
lea edx, [ebp - 0x70]
call fcn.004094e4
mov ecx, dword [ebp - 0x70]
lea eax, [ebp - 0xc]
mov edx, 0x4a1518
call fcn.00404ecc
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403650
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x40
mov eax, dword [ebp - 4]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xc]
call fcn.00405080
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], 1
lea eax, [ebp - 0x50]
push eax
call sub.shell32.dll_ShellExecuteExA
call fcn.0049dce0
mov edx, eax
xor ecx, ecx
mov al, 1
call fcn.00496464
jmp 0x4a14c1
push 0
push 0x4a1538
push 0x4a1540
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1507
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.00404be4
lea eax, [ebp - 0x68]
mov edx, dword [0x475d80]
call fcn.0040564c
lea eax, [ebp - 0x60]
mov edx, dword [0x475d80]
call fcn.0040564c
lea eax, [ebp - 0xc]
call fcn.00404bc0
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
popal
nop
nop
nop
nop
nop
jmp loc.00401219

Function at 0x40a2d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg byte [esi], cl
les ebp, [edi - 0x5c]
lcall 0x908b, 0x48bcf45

Function at 0x40a329
Capabilities:
Resolve function by parsing pe exports

Disassembly:
arpl word [ebx + 0x6e], di
mov byte [0xe9e0ff51], bl
or dword [eax], eax
add byte [eax], al
cdq
mov byte [0x1a6ecdc5], al
xor ch, dl
stosb byte es:[edi], al

Function at 0x4014aa
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
enter 4, 0
push eax
mov cl, byte [ebp - 8]
mov edx, dword [0x40f050]
mov ebx, eax
mov eax, 0x40f054
shl edx, cl
call fcn.004013e6
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
or dl, 0x40
mov esi, 0x401ec4
push edx
sub esi, fcn.0040168f
push esi
xor eax, eax
push fcn.0040168f
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x401518
mov ebx, dword [ebp - 8]
mov eax, fcn.0040168f
mov edx, esi
call fcn.004013e6
mov ebx, dword [ebp - 8]
mov edx, 0x1b600
mov eax, 0x40f054
call fcn.004012f1
leave
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x4015d7
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebx
push ecx
push edx
enter 0x13c, 0
xor eax, eax
push eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push 0x7f00
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x1c], 6
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.DLL_LoadCursorA]
push 0x7f00
push 0
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.DLL_LoadIconA]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.DLL_RegisterClassW]
push 0
push 0
call dword [sym.imp.USER32.DLL_LoadAcceleratorsA]
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 1
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x13c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x10]
lea ebx, [eax - 0x47]
call dword [sym.imp.OLE32.DLL_CoUninitialize]
mov eax, dword [ebp - 4]
add eax, ebx
leave
pop edx
pop ecx
pop ebx
ret
Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x6fda617f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x4bac5d23
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401230
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
dec eax
sbb edi, 0x48
dec edi
mov eax, 0x15
inc edi
neg esi
neg ebx
and edx, 0x2e
dec edi
neg edi
imul edi
and edx, 0xdf
imul edx
rcr edi, 0xd
or ebx, 0x99
neg eax
mov ebx, 0x2a
mov esi, 0x55
sbb ebx, 0x36
rol ebx, 0x16
mov edx, 0xad
rol ebx, 0x92
rcr ebx, 0x75
rcl edi, 0x3c
sbb esi, 0xb3
mov ebx, 0x38
imul ebx
not eax
ror edx, 0xa8
ror esi, 0xb9
imul edx
mov ebx, 0x48
bswap ebx
rcr eax, 0x41
rcl edi, 0x4d
or esi, 0x46
not esi
and esi, 0x74
not eax
rol esi, 0xc
rcl eax, 0xc0
add edx, 0xe
or edx, 0x3b
dec ebx
bswap edi
neg ebx
mov edi, 0x6d
add edx, 0x74
mov ebx, 0x61
rcl ebx, 0x85
xor ecx, ecx
xor edi, edi
add esi, 0x47
and eax, 0x71
sbb edi, 0xb7
inc edx
rcl esi, 0x36
imul edx
bswap edx
rcl eax, 9
and edx, 0xed
dec edi
imul edi
ror ebx, 0xde
dec eax
rol edi, 0xb1
imul ebx
mov ebx, 0xb8
ror eax, 0x65
mov esi, 0x94
imul edi
sbb edi, 0xcb
add edi, 0xcd
rcl ebx, 0x28
rcr edx, 0x82
rol edx, 0x8e
sbb edx, 0x5f
imul edi
bswap edx
and esi, 0xdc
imul ebx
add edi, 0xb5
bswap edi
bswap ebx
sub ebx, 0xde
imul esi
mov esi, 0xd1
not eax
inc esi
mov eax, 0x53
or edi, 0xd1
rol eax, 0xf4
rcl eax, 0x48
rol eax, 9
neg edi
sub ebx, 0xa1
dec esi
or ebx, 0x2f
sbb eax, 0x36
rcr eax, 0xaf
imul esi
sub edx, 0x6b
mov ecx, dword [ebp + 0xc]
mov eax, 0xa5
sub ebx, 0xd4
dec edi
bswap eax
imul ebx
neg ebx
inc ebx
sub ebx, 0xa2
inc eax
add ebx, 0xf0
bswap ebx
neg eax
inc edx
or esi, 0x4d
not ebx
add esi, 6
rol ebx, 0x31
rol ebx, 0x2b
sub esi, 5
ror esi, 0x26
and edx, 0x45
imul eax
neg ebx
inc edx
rcr eax, 0xba
and ebx, 0xd3
dec esi
inc ebx
or ebx, 0x2b
not eax
bswap edx
rcl esi, 0xf8
not esi
inc edi
and eax, 0xe7
bswap eax
bswap eax
rcr eax, 0x12
ror esi, 0x9f
rcl ebx, 0x96
bswap eax
sbb ebx, 0x6e
bswap edi
neg esi
add ebx, 0x37
rcr eax, 0x41
rol edx, 0x95
ror edi, 0xbc
sbb ebx, 2
imul esi
mov edi, dword [ebp + 8]
xor esi, ebx
mov esi, esi
mov ebx, esi
not byte [edi]
xor ebx, eax
mov ebx, ebx
xor ebx, eax
xor esi, ebx
mov ebx, eax
xor ebx, ebx
xor ebx, esi
mov esi, ebx
mov esi, ebx
add byte [edi], 0x26
xor ebx, esi
mov eax, eax
xor ebx, esi
xor ebx, eax
mov eax, ebx
mov esi, esi
xor esi, ebx
xor esi, ebx
mov esi, esi
sub byte [edi], 0x87
xor esi, eax
xor esi, eax
mov eax, eax
xor ebx, ebx
xor eax, esi
xor esi, eax
mov ebx, esi
mov ebx, eax
mov ebx, ebx
imul byte [edi]
inc edi
loop 0x401403
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x406224
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43225c]
jne 0x40622e
repz ret
jmp fcn.00407f25
Function at 0x401491
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4b80f0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x401526
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x4014e3
cmp dword [ebp + 0x10], ebx
jne 0x40151a
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00401491
test eax, eax
jne 0x4014f5
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014ca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.004056fd
cmp eax, ebx
je 0x40152d
push ebx
push dword [0x4b80f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x401526
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x4b80f0], ebx
jne 0x401523
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x401523
jmp 0x401526
Function at 0x4052e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x4aae00
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x4aae00], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405323
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x40546a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405487
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x40548a
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4054b9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4054fd
test edi, edi
jne 0x4054c4
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4054f7

Function at 0x405501
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405572
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x2000
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405561
cmp dword [ebp + 0x14], 1
je 0x405563
cmp dword [ebp + 0x14], 2
je 0x405563
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x4057bb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x4aae48
push esi
call fcn.0040561a
push esi
call fcn.004053f3
mov edi, eax
test edi, edi
jne 0x4057dc
xor eax, eax
jmp 0x405834
push edi
call fcn.0040563c
test byte [0x4b8068], 0x80
je 0x4057f5
mov al, byte [edi]
test al, al
je 0x4057d8
cmp al, 0x5c
je 0x4057d8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x405815
push esi
call fcn.004056d6
test eax, eax
je 0x40580f
test byte [eax], 0x10
je 0x405839
push esi
call fcn.00405794
push esi
call ebx
cmp eax, edi
jg 0x405800
push esi
call fcn.00405767
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x405833
Function at 0x405aed
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.004056fd
mov esi, dword [esp + 0x18]
test eax, eax
je 0x405b11
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405c4a
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x4ace48], 0x4c554e
mov edi, 0x400
mov ebp, 0x4ace48
test esi, esi
je 0x405b55
push 1
push 0
push esi
call fcn.0040548a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405c50
cmp eax, edi
jg 0x405c50
push edi
mov esi, 0x4ad788
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405c50
cmp eax, edi
jg 0x405c50
push esi
push ebp
push str._s_s_r_n
push 0x4ad248
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x4b800c]
push dword [eax + 0x128]
push esi
call fcn.00405893
push 4
push 0xc0000000
push esi
call fcn.0040548a
mov ebp, eax
mov dword [esp + 0x14], ebp
cmp ebp, 0xffffffff
je 0x405c4a
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405c43
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405c43
cmp edi, dword [esp + 0x18]
jne 0x405c43
push str._Rename__r_n
push esi
call fcn.0040583d
test eax, eax
jne 0x405c57
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call fcn.0040561a
add edi, 0xa
mov eax, edi
push ebx
push 0x4ad248
add eax, esi
push eax
call fcn.00405446
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x4b80d0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x4074cc
add eax, 0xa
push eax
call fcn.0040583d
test eax, eax
je 0x405c0e
inc eax
lea ecx, [esi + edi]
mov ebp, eax
cmp eax, ecx
jae 0x405c7e
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405c73
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405c10
Function at 0x405c86
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.004057bb
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x405cbb
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4b80c8], eax
jmp 0x405e4d
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x405cd6
test eax, eax
je 0x405df8
test cl, 2
je 0x405df8
push edi
push ebx
mov esi, 0x4adb88
push esi
call fcn.0040561a
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x405cf9
push 0x4074d8
push esi
call edi
jmp 0x405cff
push ebx
call fcn.00405794
cmp byte [ebx], 0
jne 0x405d0d
cmp byte [0x4adb88], 0x5c
jne 0x405d15
push 0x40729c
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x405ded
lea esi, [ebp - 0x11c]
push 0x3f
mov eax, esi
push eax
call fcn.004053af
cmp byte [eax], 0
je 0x405d58
cmp byte [ebp - 0x18], 0
je 0x405d58
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405d6e
mov al, byte [esi + 1]
test al, al
je 0x405dcc
cmp al, 0x2e
jne 0x405d6e
cmp byte [esi + 2], 0
je 0x405dcc
push esi
push edi
call fcn.0040561a
test byte [ebp - 0x148], 0x10
je 0x405d93
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405dcc
push dword [ebp + 0xc]
push ebx
call fcn.00405c86
jmp 0x405dcc
push ebx
call fcn.0040546a
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405dc4
test byte [ebp + 0xc], 4
je 0x405dbc
push ebx
push 0xfffffffffffffff1
call fcn.004046ac
push 0
push ebx
call fcn.00405aed
jmp 0x405dcc
inc dword [0x4b80c8]
jmp 0x405dcc
push ebx
push 0xfffffffffffffff2
call fcn.004046ac
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405d3a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405df7
mov byte [edi - 1], 0
pop edi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405e4c
cmp dword [ebp - 8], esi
je 0x405e3c
push ebx
call fcn.004056d6
test eax, eax
je 0x405e4c
push ebx
call fcn.00405767
push ebx
call fcn.0040546a
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405e44
test byte [ebp + 0xc], 4
je 0x405e3c
push ebx
push 0xfffffffffffffff1
call fcn.004046ac
push esi
push ebx
call fcn.00405aed
jmp 0x405e4c
inc dword [0x4b80c8]
jmp 0x405e4c
push ebx
push 0xffffffffffffffe5
call fcn.004046ac
pop esi
pop ebx
leave
ret 8