joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5421d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
xor ecx, 3
lock cmpxchg dword [esi], ecx
jne 0x5421e0
test al, 1
je 0x542298
test al, 2
jne 0x5422ac
test al, 8
jne 0x542215
lea ecx, [esi + 0x18]
mov dword [esp + 0x40], 2
lea edx, [esp + 0x40]
call sym.tokio::runtime::task::core::Core_LT_T_C_S_GT_::set_stage::h865339e5fdbd4577
jmp 0x54222f
test al, 0x10
je 0x54222f
mov eax, dword [esi + 0x60]
test eax, eax
je 0x54231a
mov eax, dword [eax + 8]
push dword [esi + 0x64]
call eax
add esp, 4
mov eax, dword [esi + 0x68]
test eax, eax
je 0x54225d
mov ecx, dword [esi + 0x6c]
movsd xmm0, qword [esi + 0x20]
mov edx, dword [ecx + 8]
movsd qword [esp + 0x20], xmm0
mov ecx, dword [ecx + 0x14]
dec edx
and edx, 0xfffffff8
lea eax, [eax + edx + 8]
lea edx, [esp + 0x20]
push edx
push eax
call ecx
add esp, 8
mov dword [esp + 8], 1
mov eax, 0xffffffc0
lock xadd dword [esi], eax
shr eax, 6
cmp eax, dword [esp + 8]
jb 0x5422c0
jne 0x542290
mov ecx, esi
call sym.__ZN4core3ptr293drop_in_place_LT_tokio..runtime..task..core..Cell_LT_tokio..runtime..blocking..task..BlockingTask_LT__LT_tokio
push dword [esi - 4]
push 0
push dword [0x5e1120]
call sub.kernel32.dll_HeapFree
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.assertion_failed:_prev.is_running__
mov edx, 0x23
push 0x5b5c74
call sym.core::panicking::panic::hf6244c8fb5815825
mov ecx, 0x5b5c84
mov edx, 0x25
push 0x5b5cac
call sym.core::panicking::panic::hf6244c8fb5815825
lea esi, [esp + 0xc]
lea edi, [esp + 8]
mov dword [esp + 0x28], 0x5b5ccc
mov dword [esp + 0x2c], 2
mov dword [esp + 0xc], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], esi
lea esi, [esp + 0x10]
mov dword [esp + 0x14], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u32_GT_::fmt::h8917667e5366c09f
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u32_GT_::fmt::h8917667e5366c09f
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 2
lea ecx, [esp + 0x28]
mov edx, 0x5b5cdc
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
mov dword [esp + 0x40], str.waker_missing
mov dword [esp + 0x44], 1
mov dword [esp + 0x50], 0
mov dword [esp + 0x48], 4
mov dword [esp + 0x4c], 0
lea ecx, [esp + 0x40]
mov edx, 0x5b5940
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
ud2

Function at 0x542880
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
lea esi, [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, 1
push 0x5b3ea0
push eax
push 0x5b3aac
push esi
push 0x5b3aac
call sym.core::panicking::assert_failed_inner::ha88f2a696e3dfa33
nop word cs:[eax + eax]
nop dword [eax + eax]
Function at 0x543b30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x5750f4]
test esi, esi
je 0x543be6
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x543bde
je 0x543bdc
movzx eax, byte [0x5e1184]
xor ecx, ecx
mov edx, 0x14
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
test eax, eax
je 0x543c03
movsd xmm0, qword [0x576e50]
mov edi, eax
movups xmmword [eax], xmm0
mov byte [eax + 0x10], 0
movzx eax, byte [0x5e1184]
xor ecx, ecx
mov edx, 8
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
test eax, eax
je 0x543c12
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x543bd7
mov eax, dword [edi]
lock dec dword [eax]
jne 0x543bc9
mov ecx, dword [edi]
call sym.alloc::sync::Arc_LT_T_C_A_GT_::drop_slow::h0754165c44328bdb
push edi
push 0
push dword [0x5e1120]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
jmp 0x543bde
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x5750f4
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x543b55
jmp 0x543bde
mov ecx, 4
mov edx, 0x14
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
mov ecx, 4
mov edx, 8
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
ud2
Function at 0x547d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [ebp - 0x10], edx
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub ecx, eax
cmp ecx, 0x100
mov dword [ebp - 0x1c], ecx
jne 0x547ea3
lea ebx, [eax + 0x80]
mov edx, eax
mov ecx, ebx
lock cmpxchg8b qword [esi + 8]
jne 0x547e23
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0x14]
mov esi, 1
movzx edx, cl
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [eax + edx*4]
xor edx, edx
mov edi, ebx
nop word cs:[eax + eax]
nop
mov ecx, dword [ebp - 0x14]
mov eax, edi
mov edi, dword [ebp - 0x18]
add ecx, esi
add esi, 1
movzx ecx, cl
adc edx, 0
mov edi, dword [edi + ecx*4]
mov ecx, esi
xor ecx, 0x80
or ecx, edx
mov dword [eax + 4], edi
jne 0x547d90
mov edx, dword [ebp - 0x10]
mov cl, 1
xor eax, eax
mov dword [edi + 4], edx
mov edi, dword [ebp + 0x10]
lock cmpxchg byte [edi + 0x94], cl
lea esi, [edi + 0x94]
jne 0x547e28
cmp byte [edi + 0xac], 1
jne 0x547e3b
xor ecx, ecx
mov al, 1
lock cmpxchg byte [esi], cl
je 0x547dfa
mov ecx, esi
call sym.parking_lot::raw_mutex::RawMutex::unlock_slow::hbfa53ea6d3774a41
jmp 0x547dfa
test esi, esi
mov ebx, esi
je 0x547e7c
mov eax, 0xffffffc0
mov esi, dword [ebx + 4]
lock xadd dword [ebx], eax
cmp eax, 0x3f
jbe 0x547e8f
and eax, 0xffffffc0
cmp eax, 0x40
jne 0x547df0
mov eax, dword [ebx + 8]
push ebx
call dword [eax + 8]
add esp, 4
jmp 0x547df0
mov eax, dword [ebp - 0x10]
jmp 0x547e7e
mov ecx, esi
call sym.parking_lot::raw_mutex::RawMutex::lock_slow::h63e89a5c0a375d8b
mov edx, dword [ebp - 0x10]
cmp byte [edi + 0xac], 1
je 0x547ddb
mov ecx, dword [edi + 0xa8]
lea eax, [edi + 0xa4]
test ecx, ecx
lea ecx, [ecx + 4]
cmove ecx, eax
mov dword [ecx], ebx
mov dword [edi + 0xa8], edx
mov eax, dword [edi + 0x90]
add eax, 0x81
jb 0x547efa
mov dword [edi + 0x90], eax
xor ecx, ecx
mov al, 1
lock cmpxchg byte [edi + 0x94], cl
jne 0x547e86
xor eax, eax
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call sym.parking_lot::raw_mutex::RawMutex::unlock_slow::hbfa53ea6d3774a41
jmp 0x547e7c
mov ecx, str.assertion_failed:_prev.ref_count_____1
mov edx, 0x27
push 0x5b5e24
call sym.core::panicking::panic::hf6244c8fb5815825
lea eax, [ebp + 0xc]
mov dword [ebp - 0x44], 0x5b4d28
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x28], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u32_GT_::fmt::h8917667e5366c09f
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x20], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u32_GT_::fmt::h8917667e5366c09f
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x44]
mov edx, 0x5b4c78
lea ecx, [ebp - 0x1c]
push 0x5b4d38
push eax
call sym.core::panicking::assert_failed::hf519872ab949980e
add esp, 8
jmp 0x547f04
mov ecx, 0x5b4ae8
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
ud2
Function at 0x5615f0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x561650
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x5e11e4]
test esi, esi
jle 0x561770
mov eax, dword [0x5e11e8]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x561684
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x561707
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x561670
mov dword [esp], ebx
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x561797
mov eax, dword [0x5e11e8]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x5e11e8]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x561777
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x561700
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x561710
add dword [0x5e11e4], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x5e11e8]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x561700
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x56168e
mov eax, dword [0x5e11e8]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
lea esi, [esi]
nop
Function at 0x561cb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x5e1200
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x5e11f8]
sub esp, 4
test ebx, ebx
je 0x561d05
mov ebp, dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x561cfe
test esi, esi
je 0x561cfe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x561ce0
mov dword [esp], 0x5e1200
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x562040
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x562065
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x562070
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x562065
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x5620b8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x5620ae
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x5620ba
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x5620a0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x403f30
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x5684dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0
jne 0x403ff1
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004a4120
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x403fdb
push edi
push 0x104
lea edi, [ebx + 4]
push 0
push edi
call fcn.004a4120
add esp, 0xc
lea eax, [ebp - 0x108]
push edi
push 0
push 0x526940
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x526944
push edi
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 4
push 0
push 7
push 0xc01200a0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx], eax
pop edi
cmp dword [ebx], 0
jne 0x403ff1
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004774d8
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.004a4120
add esp, 0xc
mov dword [ebp - 0x314], 0
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x310]
push 0x207
push eax
call fcn.004040c0
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004bf081
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x404051
cmp eax, 0x207
ja 0x404051
jne 0x404058
mov byte [ebp - 0x109], 0
lea ecx, [ebp - 0x310]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404061
push 0
lea eax, [ebp - 0x314]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x310]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004774d8
mov esp, ebp
pop ebp
ret
Function at 0x404b20
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.00477900
mov eax, dword [0x5684dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x404b50
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004774d8
mov esp, ebp
pop ebp
ret
push 0x2000
xorps xmm0, xmm0
mov dword [ebp - 0x200c], 0
lea eax, [ebp - 0x2004]
movq qword [ebp - 0x2014], xmm0
push 0
movups xmmword [ebp - 0x2024], xmm0
push eax
mov word [ebp - 0x2008], 0
mov dword [ebp - 0x2020], 3
call fcn.004a4120
push 0x1000
lea eax, [ebp - 0x2004]
push esi
push eax
call fcn.004c009a
lea eax, [ebp - 0x2004]
add esp, 0x18
mov dword [ebp - 0x201c], eax
mov eax, 0x614
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2024]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.004774d8
mov esp, ebp
pop ebp
ret
Function at 0x404be0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x5684dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x404df3
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404df3
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404c13
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x404df3
push ebx
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, 1
push 0
push eax
call fcn.004a4120
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004a4120
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
add esp, 0x18
push esi
push eax
call ebx
push 0x5269fc
lea eax, [ebp - 0x414]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404c94
test al, 1
je 0x404c94
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp eax, 0xffffffff
je 0x404dd9
lea ecx, [ebp - 0x664]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x404dcd
nop dword [eax]
test byte [ebp - 0x664], 0x10
je 0x404d48
cmp word [ebp - 0x638], 0x2e
jne 0x404d07
mov ax, word [ebp - 0x636]
test ax, ax
je 0x404db2
cmp ax, 0x2e
jne 0x404d07
cmp word [ebp - 0x634], 0
je 0x404db2
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004a4120
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.00404be0
add esp, 4
jmp 0x404db0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004a4120
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404d9f
test al, 1
je 0x404d9f
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
and edi, eax
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404cd0
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
and eax, edi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004774d8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004774d8
mov esp, ebp
pop ebp
ret
Function at 0x404e10
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x404e68
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404e68
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x404e48
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x404e68
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404e63
test al, 0x10
je 0x404e63
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x404e68
xor eax, eax
pop esi
pop ebp
ret
mov eax, 1
pop esi
pop ebp
ret

Function at 0x405950
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40597f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.delete__s_failed__error_d
call fcn.00429350
add esp, 0xc
mov eax, 1
pop esi
pop ebp
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405977
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4059a5
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x405962
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4059c0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x516c86
mov eax, dword fs:[0]
push eax
sub esp, 0x880
mov eax, dword [0x5684dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4059fc
xor eax, eax
jmp 0x405c02
cmp word [ebx], 0
je 0x4059f5
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405a07
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jge 0x4059f5
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004a4120
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x526a7c
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405a62
test al, 1
je 0x405a62
and eax, 0xfffffffe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 0x5c
mov dword [ebp - 0x428], 0
mov word [ebp - 0x42c], ax
mov dword [ebp - 0x424], 0
lea eax, [ebp - 0x420]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x884]
call fcn.00404e70
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
je 0x405bb2
cmp dword [ebp - 0x424], 0
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
je 0x405b11
mov eax, dword [ebp - 0x884]
shr eax, 4
and eax, 1
je 0x405b11
cmp word [ebp - 0x858], 0x2e
jne 0x405b11
mov ax, word [ebp - 0x856]
test ax, ax
je 0x405aec
cmp ax, 0x2e
jne 0x405b11
cmp word [ebp - 0x854], 0
jne 0x405b11
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x405c1e
lea ecx, [ebp - 0x884]
push ecx
push eax
call edi
mov edi, eax
mov dword [ebp - 0x424], edi
jmp 0x405ba4
lea eax, [ebp - 0x888]
push eax
lea ecx, [ebp - 0x884]
call fcn.00405110
cmp dword [ebp - 0x424], 0
mov byte [ebp - 4], 1
je 0x405b4c
mov eax, dword [ebp - 0x884]
shr eax, 4
and eax, 1
je 0x405b4c
mov esi, dword [ebp - 0x888]
push esi
call fcn.004059c0
jmp 0x405b58
mov esi, dword [ebp - 0x888]
push esi
call fcn.00405950
mov eax, dword [ebp - 0x428]
add esp, 4
test eax, eax
jne 0x405b69
xor edi, edi
jmp 0x405b88
cmp dword [ebp - 0x424], 0
jne 0x405b76
xor edi, edi
jmp 0x405b88
lea ecx, [ebp - 0x884]
push ecx
push eax
call edi
mov edi, eax
mov dword [ebp - 0x424], edi
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x405ba4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x405aa9
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x424], 0
test eax, eax
je 0x405bd8
cmp eax, 0xffffffff
je 0x405bd8
push eax
call esi
mov dword [ebp - 0x428], 0
push ebx
call fcn.00404b20
mov eax, dword [ebp - 0x428]
add esp, 4
mov dword [ebp - 0x424], 0
test eax, eax
je 0x405bfd
cmp eax, 0xffffffff
je 0x405bfd
push eax
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004774d8
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x424], 0
jmp 0x405bd8
Function at 0x405cc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x405d19
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405d19
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x405d0a
cmp esi, edx
jae 0x405d19
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x405cf8
cmp esi, edx
jae 0x405d19
cmp word [esi], 0
je 0x405d19
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x407300
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x5684dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x800
lea eax, [ebp - 0x804]
mov ebx, ecx
push 0
push eax
call fcn.004a4120
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push str.AICleaner_631B7643_EDBB_4FFC_B8E3_BC00F0C77AE3
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x808], esi
test esi, esi
je 0x4073e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4073b4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x526b08
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x4073a2
push 0
push 0
push 0x1400
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004774d8
mov esp, ebp
pop ebp
ret
push edi
lea edi, [ebx + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 8]
lea ecx, [ebx + 4]
cmp dword [ecx + 8], eax
je 0x4073d2
mov dword [eax], esi
add dword [ecx + 4], 4
jmp 0x4073df
lea edx, [ebp - 0x808]
push edx
push eax
call fcn.00406df0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.004774d8
mov esp, ebp
pop ebp
ret