joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424c7f
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xa7c2172
jl 0x424c8e
and dword [ebp + 0x44], edx
push 0xfffffffffffffff2
mov dh, 0x26
xor byte [edi - 0x2d], 0xcf
sal dword [esi + 0x74e14a5d], 1
iretd
dec edx
loope 0x424d09
ficomp word [edi + 0x6f]
jge 0x424c82
rcl edi, cl
ror dword [ebp - 0xe], 1
jnp 0x424cd3
xchg dword [edi - 0x17], ebx
cmp eax, 0xb28dcec0
jg 0x424d19
in al, dx
invalid
jbe 0x424c92
or dword [edi + 0x14], esp
jo 0x424d20
lodsb al, byte [esi]
push 0xb74cf9f4
pop edi
cli
adc esp, esp
xchg ecx, eax
xchg esi, eax
jmp 0x72f11b80
iretd
ljmp 0x2f81:0x12deebd4
ja 0x424ce2
insb byte es:[edi], dx
mov ss, word [edx - 0x556f79]
insb byte es:[edi], dx
nop
dec edx
inc edi
stosb byte es:[edi], al
sbb byte [edi - 0x45846c69], ch
pop edx
stosb byte es:[edi], al
rep stosb byte es:[edi], al
std
stc
inc ebp
ret 0xc955

Function at 0x44ea0a
Capabilities:
Encode data using xor

Disassembly:
cmp edi, dword [edi + 0x3a]
jg 0x44e9d1
dec edx
push edx
jnp 0x44e9fc
ja 0x44ea0c
mov esp, 0x8fa9be70
fisub dword [0xf7adac9]
test eax, 0xc925da8f
fidivr dword [edx + 0xf]
aad 0x12
invalid
mov dh, byte [edx + 0x6a95db15]
xlatb
jge 0x44e9a0
mov ecx, dword [0xb73ee26a]
mov esp, 0xe72d52c6
xchg ch, dl
push es
mov ecx, 0xd4f90caa
inc eax
fisubr dword [ebp + 0x42f6ad44]
adc eax, 0xbbf3498d
test eax, 0x8d2a4684
jg 0x44e994
lcall 0x648a, 0x39dafa4d
and al, 0x41
dec ebp
cli
fidivr dword [ecx]
mov ah, byte [esp + 0x41]
cwde
jecxz 0x44e995
mov dl, 0x6a
mov edi, 0xed759f5b
jne 0x44e9f9
jne 0x44e9f9
out 0xf3, eax
inc edx
or dword [edx - 0x46], edi
js 0x44e9cb
cli
dec ebp
jnp 0x44ea5d
jb 0x44ea56
or ebx, dword [ebx + edi*4]
xor eax, 0x32cb317c
bswap esp
xor ecx, 0x7bf4cf10
dec ecx
xor dword [eax + 0x176fe8c2], 0x20764b7b
outsd dx, dword [esi]
dec edx
rol byte [edx + 0x20], 0x4b
or dword [edx + 0x7d], edi
sbb eax, 0x600e1a4c
xchg esp, eax
test eax, 0x7c48afbc
xor bl, al
xor eax, 0xbbc90cec
sbb dword [ecx + 2], ebp
sbb byte [esi], dh
aad 0x5d
dec eax
jl 0x44ea7a
ret
pop ebp
cmpsb byte [esi], byte es:[edi]
loopne 0x44ea1a
or dh, byte [esi]
adc al, 0x7a
xor cl, byte [edx]
xchg byte [edi - 0x65], dh
std
scasb al, byte es:[edi]
jp 0x44ea91
or al, byte [esi - 0x51026489]
jge 0x44ea47
pop edi
sbb al, 0xba
fld xword [edx - 0x303f6f58]
sti
jnp 0x44ea03
int1
js 0x44ea75
dec dword [edx - 0x12e1abaa]
mov dl, byte [esi + 0x54]
push ds
in eax, dx
xchg esi, eax
sub edi, esi
or edi, ebp
jae 0x44ea88
sub cl, byte [edi + 0x1ba41cdb]
fistp qword [0x453bb59]
lahf
invalid
push edi
adc ebp, dword [ecx - 0x46]
xor byte [ecx], bh
adc byte [ebx + 8], bl
call 0x4f29960e
invalid
Function at 0x44f3ea
Capabilities:
Encode data using xor

Disassembly:
bound ebp, qword [edi]
test eax, 0xafc90d4c
cmpsb byte [esi], byte es:[edi]
xchg byte [edx], bl
jl 0x44f458
xchg byte [ebx], bl
lodsd eax, dword [esi]
int1
xchg ecx, eax
xlatb
jne 0x44f478
int1
or byte [ecx + 1], cl
into
pop eax
and dword [ebp - 0x57], esi
invalid
sub byte [esi - 0x3ff2f04a], 0x6c
or eax, 0x63fa6cc0
fdivr st(7), st(0)
and edx, dword [eax + edi*2]
cli
arpl sp, bx
mul dword [ebx]
adc al, 0x78
call 0x34e4846a
mov ebx, 0xaa581183
add al, 0x1a
mov ds, word [edi - 0x1f]
clc
aad 0xd
sub ch, byte [ebx + 0x25]
imul edi, dword [esi - 0x9fb704a], 0x3161647b
push 0x43c3c427
xor eax, 0x209add0d
mov esi, 0x39bd4b22
pop ss
pop es
cmp byte [edx], cl
xor dword [ebx + 0x37], 0x42c852c4
arpl word [edx + 0x7590aff0], ax
add al, 0xf6
jnp 0x44f4e0
popal
xor dword [eax + 0x27], ebp
invalid
push esi
popfd
dec edx
cmp bh, byte [0xfefdc4af]
jae 0x44f455
and dword fs:[edx + 0x250a33bf], esi
inc ebp
in al, dx
sbb bh, byte [ecx + 0x6d]
rol dword [esi - 0x7272adf6], cl
xchg byte [edx + 0x1a], al
jbe 0x44f451
xor eax, 0xdaf0ec4b
mov edx, fs
shl dword [esi], 1
cmp eax, 0x6219e097
iretd
jle 0x44f49e
dec ecx
sbb al, 0xbe
add ah, byte [edi]
sti
mov dl, byte [edi + 0x6650d3b5]
out 0xe3, eax
inc edi
neg eax
push cs
mov es, eax
pop ebp
pop ds
enter 0x3bdc, 0xffffffffffffffa7
lahf
add dword [edx + 0xa7854d3], edx
mov edi, ebx
nop
invalid

Function at 0x4807e0
Capabilities:
Encode data using xor

Disassembly:
inc ecx
xor al, 0xc8
inc edx
aam 0x35
mov eax, dword [0xf5306770]
invalid
push 0x7720c082
loope 0x4807aa
and dl, byte [ecx + esi*8]
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0x6b124ef7]
xor eax, 0xd3225150
add al, byte [esi]
xor esp, esi
add eax, 0x91b25e4
imul esi, ebp, 0xcdbf5cd2
nop
adc eax, 0x95932177
xor eax, 0xd0c44a97
and byte [edi + 0x52], ah
mov byte [0x9514424e], al
fldenv [edx - 0x1e]
push edx
add dword [ecx - 0x2b114e10], eax
jnp 0x4807f9
invalid

Function at 0x4ae24a
Capabilities:
Encode data using xor

Disassembly:
add bh, byte [ebp + 0x69f687a9]
jecxz 0x4ae1ed
imul edx, dword [ecx + ecx], 0x20ebc1e1
push edi
sbb byte [edx + 0x74], 0xec
pop edx
je 0x4ae1bf
js 0x4ae22f
push esp
int1
adc dword [eax + eax*4 + 0x7c], edi
mul dword [eax - 0x5de68dbe]
aam 0xc3
jno 0x4ae21b
mov esi, 0xe8a9f9f
dec ebx
sub al, 0xa8
cmpsw word [esi], word es:[edi]
test al, 0x66
cmpsd dword [esi], dword es:[edi]
retf 0xc39a
push 0xffffffffffffffa9
sbb dh, byte [ecx]
mov dword [0x61faf456], eax
jp 0x4ae247
cmp byte [ebp - 0x26], bl
ret
add bl, byte [edi + 6]
sbb dh, byte [ebx + 0x4d]
loop 0x4ae1d0
bound ecx, qword [ecx + edx*4]
fcomi st(6)
fld xword [ecx]
arpl word [esi + ecx*4 + 0x34], si
mov edi, dword gs:[ecx + 0x4176db16]
bts dword [ebx], esi
push cs
xor eax, 0xdeac462a
sbb byte [edx + 0x32da10e1], ch
Function at 0x4b3597
Capabilities:
Encode data using xor

Disassembly:
pushfd
lea sp, [eax + 0xe]
pop ds
out 0xf0, al
daa
xor bl, al
pop ss
bound esp, qword [ecx]
pop ebp
push 0x621a3367
test al, 0x36
and eax, dword [esp + ebp*8]
in al, dx
in al, dx
inc ecx
das
jl 0x4b357e
int1
movsd dword es:[edi], dword [esi]
cwde
add dword [eax + 0x4f405a9e], ebx
or al, 0x34
push 0xffffffffffffffe7
pushal
loopne 0x4b35eb
xor eax, 0xfe2a1a95
and ecx, dword [ebp - 0xa]
das
mov bl, 0xf
aas
and esp, dword [edi]
xor al, 0xd0
aam 0x25
lea eax, [edi + ebx*2 + 0x63a1ea6]
or dword [esi + 0x17], edx
inc esi
or al, 0x88
pop esi
leave
fstp qword [edi + 0x7efb056d]
out dx, al
dec esi
insd dword es:[edi], dx
add eax, 0x4eee7efb
mov esi, 0x62dd8e9a
leave
mov gs, word [ebx + esi*2]
invalid
mov byte [0xe645220f], al
pop esp
mov esp, 0xa22f0e65
xchg byte [eax + 0x6c67b9ae], cl
cmpsb byte [esi], byte es:[edi]
sub al, 0xcf
stosb byte es:[edi], al
adc dword [esi + 0x47c6fe64], ebx
in al, dx
jnp 0x4b35d0
ljmp 0x31ac:0x65091529

Function at 0x4bb36d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3338
cmp edx, dword [eax]
je 0x4bb38f
add eax, 8
inc ecx
cmp eax, 0x4c33c8
jl 0x4bb380
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3338]
jne 0x4bb4bd
mov eax, dword [0x4c7cbc]
cmp eax, 1
je 0x4bb497
test eax, eax
jne 0x4bb3c0
cmp dword [0x4c3264], 1
je 0x4bb497
cmp edx, 0xfc
je 0x4bb4bd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb3f7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bbd50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc1e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb43a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc1e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c088c
push edi
call fcn.004be0b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bbd50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbd60
lea eax, [ebp - 0xa0]
push 0x4c086c
push eax
call fcn.004bbd60
push dword [esi + 0x4c333c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbd60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be024
add esp, 0x2c
pop edi
jmp 0x4bb4bd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c333c]
push 0
push eax
push dword [esi]
call fcn.004bc1e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10008880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x10028164]
xor eax, ebp
mov dword [ebp + 0x398], eax
mov edx, dword [ebp + 0x3a8]
mov eax, dword [ebp + 0x3a4]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x70], edx
mov edx, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x6c], esi
push edi
test eax, eax
je 0x10008a43
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100088d1
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov ecx, 2
imul ecx
mov edi, eax
test edx, edx
jg 0x10008977
jl 0x100088fe
cmp edi, 0x7fffffff
ja 0x10008977
cmp edx, 0xffffffff
jl 0x10008977
jg 0x1000890d
cmp edi, 0x80000000
jb 0x10008977
cmp edi, 0x400
jg 0x1000892d
push edi
call fcn.10015c92
add esp, 4
test al, al
je 0x1000892d
mov eax, edi
call fcn.1000bf00
mov ebx, esp
jmp 0x10008951
mov eax, edi
not eax
cmp eax, 8
jb 0x10008a91
lea eax, [edi + 8]
push eax
call fcn.10015c92
add esp, 4
test eax, eax
je 0x10008977
mov dword [eax], esi
lea ebx, [eax + 8]
mov esi, eax
test ebx, ebx
je 0x10008977
push 0
push 0
push edi
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x74]
mov byte [ebx], 0
push 0
push 3
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov edi, eax
neg edi
sbb edi, edi
and edi, ebx
jmp 0x10008979
xor edi, edi
test edi, edi
je 0x10008a43
push 0x60
push 0
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
jne 0x100089ae
push 2
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
jne 0x100089ae
call fcn.10003920
mov edi, eax
jmp 0x10008a48
push dword [ebp - 0x78]
push dword [ebp - 0x70]
push ebx
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x100089c8
call fcn.10003920
jmp 0x10008a34
push edi
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x70], eax
test eax, eax
jne 0x100089de
call fcn.10003920
jmp 0x10008a34
push edi
push ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
jae 0x100089f6
mov edi, 0x8007000e
jmp 0x10008a36
push eax
lea ecx, [ebp - 0x6c]
call fcn.100033c0
cmp dword [ebp - 0x6c], 0
jne 0x10008a0c
mov edi, 0x8007000e
jmp 0x10008a36
push edi
push dword [ebp - 0x70]
push edi
push dword [ebp - 0x6c]
call fcn.1000aa30
mov eax, dword [ebp - 0x6c]
lea ecx, [ebp - 0x80]
add esp, 0x10
mov byte [eax + edi], 0
push dword [ebp + 0x3b0]
push dword [ebp - 0x6c]
call fcn.100086f0
mov edi, eax
test ebx, ebx
je 0x10008a48
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
jmp 0x10008a48
mov edi, 0x8007000e
lea eax, [ebp - 0x68]
cmp dword [ebp - 0x6c], eax
je 0x10008a58
lea ecx, [ebp - 0x6c]
call fcn.10005750
test esi, esi
je 0x10008a6f
nop dword [eax]
push esi
mov esi, dword [esi]
call fcn.10015c92
add esp, 4
test esi, esi
jne 0x10008a60
mov eax, edi
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x398]
xor ecx, ebp
call fcn.1000bc54
lea esp, [ebp + 0x39c]
pop ebp
ret 0x10
push 0x80070216
call fcn.100013a0
int3
Function at 0x1000aeb0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x1000aeb9
ret
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
ret

Function at 0x10015c92
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x10015ca1
pop dword [ebp - 4]
mov eax, 0x10015ca1
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x39c5a
push 0
mov eax, 0xb3925a93
sub eax, 0xa3907937
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0xbb5343f4
sub ecx, 0xbb53007b
xor edi, edi
add edi, eax
mov ebx, 0x1002e200
add ebx, dword [ebp - 4]
mov esi, 0x363d92cc
sub esi, 0x4e2b4f72
mov edx, dword [ebx]
xor edx, esi
mov dword [edi], edx
add edi, 0x55e64b08
add edi, 0xaa19b4fc
add ebx, 0x86283df2
add ebx, 0x79d7c212
loop 0x10015cf7
add eax, 0x100b7
xor ebx, ebx
add ebx, eax
add eax, 0xc1d0ec17
add eax, 0x3e2f13ee
mov ecx, 0x6fac17c4
sub ecx, 0x5fac17c4
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x4010f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a004]
jne 0x4010fe
repz ret
jmp fcn.004014d0

Function at 0x408cfc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404ac6
and dword [ebp - 0x14], 0
cmp dword [0x43cc74], 0
mov dword [ebp - 0x18], eax
jne 0x408daf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408e57
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408e57
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x43cc74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43cc78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43cc7c], eax
call edi
push eax
call esi
mov dword [0x43cc84], eax
test eax, eax
je 0x408daf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x43cc80], eax
mov eax, dword [0x43cc80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408e08
cmp dword [0x43cc84], ecx
je 0x408e08
push eax
call esi
push dword [0x43cc84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408e08
test ebx, ebx
je 0x408e08
call edi
test eax, eax
je 0x408dff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408dff
test byte [ebp - 8], 1
jne 0x408e08
or dword [ebp + 0x10], 0x200000
jmp 0x408e3b
mov eax, dword [0x43cc78]
cmp eax, dword [ebp - 0x18]
je 0x408e3b
push eax
call esi
test eax, eax
je 0x408e3b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408e3b
mov eax, dword [0x43cc7c]
cmp eax, dword [ebp - 0x18]
je 0x408e3b
push eax
call esi
test eax, eax
je 0x408e3b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43cc74]
call esi
test eax, eax
je 0x408e57
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408e59
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010f4
leave
ret
Function at 0x42e360
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x43a004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x43adb0]
push ebx
mov ebx, dword [0x2be0234]
push edi
mov edi, dword [0x2be26b4]
call fcn.0042e2d0
cmp dword [0x2be26b4], 0x2f
jne 0x42e3cd
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.0042e300
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.004010f4
add esp, 0x24
ret
Function at 0x42e660
Capabilities:
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
jmp 0x42e678
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x42e6c1
mov dword [0x2be231c], 0x8e46a6f0
cmp dword [0x2be26b4], 0x3dc
jne 0x42e6bf
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x42e66f
mov dword [ebp - 0x10], 0
jmp 0x42e6d3
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x42e776
cmp dword [0x2be26b4], 0xa5f
jne 0x42e6fc
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x10], 0x84620b
jne 0x42e721
mov eax, dword [0x43bbd0]
mov dword [0x2be26b4], eax
mov ecx, dword [0x2be26b4]
add ecx, 0xa231
mov dword [0x2be26b4], ecx
cmp dword [0x2be26b4], 0x141
jne 0x42e771
xor edx, edx
mov word [ebp - 0x24], dx
xor eax, eax
mov word [ebp - 0x22], ax
xor ecx, ecx
mov word [ebp - 0x20], cx
xor edx, edx
mov word [ebp - 0x1e], dx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
mov dword [0x43d1a0], 0xec58acac
mov dword [0x43d1a4], 0xffffffff
jmp 0x42e6ca
call fcn.0042e3f0
jmp dword [0x2be0234]
Function at 0x404da8
Capabilities:
Set file attributes

Disassembly:
test edx, 0xf0000000
je 0x404db6
and edx, 0x3fff
jmp fcn.00404d1a

Function at 0x404dbb
Capabilities:
Delete directory

Disassembly:
mov eax, 0x434464
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_RemoveDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x404dea
push edi
call esi
test eax, eax
je 0x404dea
mov al, 1
jmp 0x404e2e
test ebx, ebx
je 0x404e2c
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
push dword [ebp - 0x18]
je 0x404e26
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
test esi, esi
pop ecx
setne al
jmp 0x404e2e
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x404e3d
Capabilities:
Move file

Disassembly:
mov eax, 0x434480
call fcn.004339e0
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], ecx
call fcn.00407553
mov ecx, dword [ebp - 0x10]
mov esi, eax
call fcn.00407553
mov edi, dword [sym.imp.kernel32.dll_MoveFileW]
mov dword [ebp - 0x14], eax
push 1
pop ebx
cmp esi, ebx
je 0x404e86
cmp eax, ebx
je 0x404e86
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
test eax, eax
je 0x404e86
mov al, bl
jmp 0x404efd
test esi, esi
jne 0x404e8f
cmp dword [ebp - 0x14], esi
je 0x404efb
lea ecx, [ebp - 0x30]
call fcn.004028e9
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004028e9
cmp esi, ebx
mov byte [ebp - 4], bl
je 0x404eaf
cmp dword [ebp - 0x14], ebx
jne 0x404eb1
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004239f6
test al, al
push dword [ebp - 0x24]
je 0x404eec
push dword [ebp - 0x30]
call edi
mov esi, eax
push dword [ebp - 0x24]
call fcn.00401abd
push dword [ebp - 0x30]
call fcn.00401abd
pop ecx
test esi, esi
pop ecx
setne al
jmp 0x404efd
call fcn.00401abd
push dword [ebp - 0x30]
call fcn.00401abd
pop ecx
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405008
Capabilities:
Create directory

Disassembly:
mov eax, 0x4344b0
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_CreateDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x405046
push 0
push edi
call esi
test eax, eax
je 0x405039
mov al, 1
jmp 0x40508f
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x40508d
test ebx, ebx
je 0x40508d
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
je 0x405084
push 0
push dword [ebp - 0x18]
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
test esi, esi
pop ecx
setne al
jmp 0x40508f
push dword [ebp - 0x18]
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x405c83
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x4345c0
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x405caf
push edi
call esi
cmp eax, 0xffffffff
jne 0x405cf1
test ebx, ebx
je 0x405cee
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
push dword [ebp - 0x18]
je 0x405ce8
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
pop ecx
mov eax, esi
jmp 0x405cf1
call fcn.00401abd
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x406306
Capabilities:
Get disk information

Disassembly:
mov eax, 0x434664
call fcn.004339e0
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.0041c900
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x4063d4
mov eax, SysReAllocString
cmp ebx, eax
ja 0x406342
mov eax, ebx
add eax, eax
push eax
call fcn.004239f6
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], ebx
je 0x4063cd
cmp ebx, dword [ebp - 0x14]
ja 0x4063cd
lea ecx, [ebp - 0x2c]
call fcn.004028e9
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
jbe 0x4063b5
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4063aa
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.004239f6
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0040150c
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x10]
jb 0x406380
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00401abd
push esi
call fcn.00401abd
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
sete al
jmp 0x4063d6
push esi
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret