joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ce80
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, ecx
push ecx
mov dword [ebp - 4], eax
call fcn.0040cc30
mov esi, eax
add esp, 4
xor ebx, ebx
mov dword [ebp - 8], esi
lea edi, [esi*4]
test edi, edi
jle 0x40cef8
mov eax, dword [ebp - 4]
lea esi, [eax + 8]
lea esi, [esi + edi*4]
lea ecx, [eax + 8]
mov edx, dword [ecx - 8]
lea ecx, [ecx + 0x10]
mov eax, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [ecx - 0x18], eax
add ebx, 4
mov eax, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [ecx - 0x14]
mov dword [ecx - 0x14], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [ecx - 0x10]
mov dword [ecx - 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [ecx - 0xc]
mov dword [ecx - 0xc], eax
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x40ceb5
mov esi, dword [ebp - 8]
cmp esi, 1
jle 0x40d07a
mov edi, dword [ebp - 4]
lea ebx, [esi - 1]
add edi, 4
nop word [eax + eax]
mov edx, dword [edi + 0xc]
lea edi, [edi + 0x10]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [edi - 3]
mov ecx, dword [ecx*4 + 0x469e80]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x469280]
movzx eax, dl
mov edx, dword [edi]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x46aef0]
movzx eax, byte [edi - 2]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x469680]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [edi - 4], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x469680]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x469280]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x469e80]
movzx eax, dl
mov edx, dword [edi + 4]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x46aef0]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [edi], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x469680]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x469280]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x469e80]
movzx eax, dl
mov edx, dword [edi + 8]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x46aef0]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [edi + 4], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x469680]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x469280]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x469e80]
movzx eax, dl
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x46aef0]
mov dword [edi + 8], ecx
sub ebx, 1
jne 0x40cf10
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d7a0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [edi + 0x214]
test eax, eax
je 0x40d7ea
push 0
lea ecx, [ebp + 0xc]
push ecx
push 0x10
push ebx
push 0
push 0
push 0
push 0x10
push esi
push eax
call dword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
jns 0x40d821
push eax
push str.BCryptDecrypt_x_n
call fcn.0041cf20
add esp, 8
mov ecx, edi
call fcn.0040d740
lea eax, [esi + 0x10]
mov dword [ebp + 0xc], eax
cmp esi, eax
jae 0x40d821
lea ecx, [edi + 0xf0]
sub ebx, esi
nop dword [eax]
mov edx, dword [edi + 0x1e0]
lea eax, [ebx + esi]
push eax
push esi
call fcn.0040d090
add esi, 0x10
lea ecx, [edi + 0xf0]
add esp, 8
cmp esi, dword [ebp + 0xc]
jb 0x40d800
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40d830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x47f06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
add eax, 0xfffffff1
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
add eax, edi
mov dword [ebp - 0x18], eax
cmp edi, eax
jae 0x40d8b9
nop word [eax + eax]
movups xmm0, xmmword [edi]
push ecx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
push edi
movups xmmword [ebp - 0x28], xmm0
call fcn.0040d7a0
mov ecx, dword [ebx + 0x1e4]
add edi, 0x10
mov eax, dword [ebx + 0x1e8]
xor ecx, dword [ebp - 0x14]
xor eax, dword [ebp - 0x10]
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov ecx, dword [ebx + 0x1ec]
mov eax, dword [ebx + 0x1f0]
xor ecx, dword [ebp - 0xc]
xor eax, dword [ebp - 8]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
add esi, 0x10
movups xmmword [ebx + 0x1e4], xmm0
cmp edi, dword [ebp - 0x18]
jb 0x40d860
movzx ecx, byte [esi - 1]
mov eax, dword [ebp + 0x10]
sub eax, ecx
pop edi
lea edx, [ecx - 1]
mov ecx, dword [ebp - 4]
cmp edx, 0xf
pop esi
cmova eax, dword [ebp + 0x10]
xor ecx, ebp
pop ebx
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40ecc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x47f06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0x23
mov ebx, ecx
mov esi, edx
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push ecx
push 0x4716d0
xor edx, edx
mov ecx, ebx
call fcn.0041d370
add esp, 8
xorps xmm0, xmm0
movups xmmword [ebp - 0x220], xmm0
cmp esi, 4
je 0x40ed2c
cmp esi, 2
jne 0x40ed1a
lea ecx, [ebp - 0x220]
call fcn.0041eb90
jmp 0x40ed37
cmp esi, 3
jne 0x40ed2c
lea ecx, [ebp - 0x220]
call fcn.0041ed60
jmp 0x40ed37
lea ecx, [ebp - 0x220]
call fcn.0041ef00
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0043f640
add esp, 0xc
lea eax, [ebp - 0x210]
lea ecx, [ebp - 0x220]
push eax
call fcn.0041d470
add esp, 4
cmp esi, 4
jne 0x40ed83
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x40ed70
mov eax, dword [str.fsbfb]
jmp 0x40edd1
cmp esi, 1
jne 0x40eda4
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x40ed91
mov eax, dword [0x471700]
jmp 0x40edd1
cmp esi, 2
je 0x40edae
cmp esi, 3
jne 0x40edd3
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
nop word [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x40edc0
mov eax, dword [0x471704]
mov dword [edi], eax
push ecx
lea eax, [ebp - 0x210]
xor edx, edx
push eax
mov ecx, ebx
call fcn.0041d370
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret

Function at 0x40f0c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x47f06c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x214]
call fcn.0040ecc0
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x40f120
cmp esi, 0xffffffff
je 0x40f120
push 0
push edi
push dword [edi]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
jmp 0x40f122
xor edi, edi
test esi, esi
je 0x40f132
cmp esi, 0xffffffff
je 0x40f132
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret
Function at 0x410c80
Capabilities:
Accept command line arguments
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push 0x472184
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
call fcn.00420c00
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
call fcn.00420870
test eax, eax
jne 0x410d08
call fcn.004208e0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
push 0x472188
push esi
call fcn.0043d76e
add esp, 8
test eax, eax
jne 0x410d08
push 0x47219c
push esi
call fcn.0043d76e
add esp, 8
test eax, eax
jne 0x410d08
push 0x4721ac
push esi
call fcn.0043d76e
add esp, 8
test eax, eax
jne 0x410d08
push 0x4721bc
push esi
call fcn.0043d76e
add esp, 8
test eax, eax
jne 0x410d08
call fcn.0041c4d0
pop esi
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp + 0x14]
lea ecx, [ebp - 0x2c]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00410d40
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00410da0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x411a30
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45abab
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x47f06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x80000001
lea ecx, [ebp - 0x2a0]
call fcn.004216d0
push ecx
push 0x472830
lea ecx, [ebp - 0x2a0]
mov dword [ebp - 4], 0
call fcn.00421890
test eax, eax
je 0x411b03
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0043f640
add esp, 8
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x2a0]
push eax
push 0x472878
call fcn.00421be0
lea eax, [ebp - 0x218]
push eax
call fcn.0044695a
mov dword [esi + 0x48], eax
lea ecx, [ebp - 0x2a0]
lea eax, [ebp - 0x218]
push eax
push 0x472884
call fcn.00421be0
lea eax, [ebp - 0x218]
push eax
call fcn.0044695a
add esp, 4
mov dword [esi + 0x4c], eax
lea ecx, [ebp - 0x2a0]
call fcn.004219b0
mov esi, 1
jmp 0x411b05
xor esi, esi
lea ecx, [ebp - 0x2a0]
call fcn.00421710
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret

Function at 0x411c90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45abab
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x47f06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0043f640
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x28
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x411d07
push ecx
push 0x4728a0
lea ecx, [esi + 0x1fc]
lea edx, [ebp - 0x218]
call fcn.0041d370
add esp, 8
jmp 0x411d81
push 1
push 0x80000002
lea ecx, [ebp - 0x2a0]
call fcn.004216d0
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersion
lea ecx, [ebp - 0x2a0]
mov dword [ebp - 4], 0
call fcn.00421890
test eax, eax
je 0x411d76
push ecx
lea eax, [ebp - 0x218]
push eax
push str.ProgramFilesDir
lea ecx, [ebp - 0x2a0]
call fcn.00421be0
test eax, eax
je 0x411d6b
push ecx
push 0x4728f0
lea ecx, [esi + 0x1fc]
lea edx, [ebp - 0x218]
call fcn.0041d370
add esp, 8
lea ecx, [ebp - 0x2a0]
call fcn.004219b0
lea ecx, [ebp - 0x2a0]
call fcn.00421710
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret
Function at 0x4123d0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x624
mov eax, dword [0x47f06c]
xor eax, esp
mov dword [esp + 0x620], eax
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x610], 0
je 0x41241b
mov eax, dword [esi + 0x650]
test eax, eax
jns 0x412419
mov ecx, dword [esi + 0x64c]
test ecx, ecx
je 0x41241b
call fcn.0040fe00
mov dword [esi + 0x650], eax
test eax, eax
jne 0x41243a
cmp dword [esi + 0x1c8], 0
je 0x41243a
push str.no_contents_n
call fcn.0041d0d0
add esp, 4
mov ecx, esi
push 0xffffffffffffffff
call fcn.00414670
mov eax, dword [0x472a04]
mov dword [esp + 0x10], eax
mov eax, dword [0x472a08]
push 0x200
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0043f640
add esp, 0xc
cmp dword [esi + 0x1c8], 0
je 0x4124a4
mov ecx, dword [esi + 0x1dc]
test ecx, ecx
je 0x412492
lea edx, [esp + 0x10]
sub edx, ecx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x412480
jmp 0x41250d
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x41250d
push 0
push 0x10
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push 0x485
call fcn.00425000
lea eax, [esi + 0x1d0]
mov ecx, 0xe
push eax
call fcn.0041feb0
push eax
mov edx, 0x485
mov ecx, esi
call fcn.00414d70
add esp, 8
test eax, eax
je 0x41261e
push 0x104
lea eax, [esp + 0x14]
mov ecx, esi
push eax
push 0x485
call fcn.00424fc0
test eax, eax
je 0x41261e
cmp dword [esi + 0x1d4], 0
je 0x412561
mov eax, dword [esi + 0x64c]
mov ecx, 0x478d08
test eax, eax
mov edx, 0x472a18
cmovne ecx, eax
cmp dword [esi + 0x1d0], 0
mov eax, str._x64
cmove eax, edx
push eax
push ecx
call fcn.0041fbe0
add esp, 4
push eax
push str.FastCopy_s_s
call fcn.0041db80
add esp, 8
lea ecx, [esp + 0x14]
xor edx, edx
push eax
call fcn.0041d370
add esp, 8
lea ecx, [esp + 0x10]
call fcn.00426710
mov edi, 0x47fa50
nop
push ecx
push dword [edi]
lea edx, [esp + 0x18]
lea ecx, [esp + 0x220]
call fcn.0041d370
add esp, 8
lea eax, [esp + 0x420]
mov ecx, esi
push eax
push dword [edi]
call fcn.00412a90
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x21c]
push eax
lea edx, [esp + 0x428]
lea ecx, [esi + 0x60c]
call fcn.00426f60
add esp, 8
test eax, eax
je 0x412604
add edi, 4
cmp edi, str.TLIB_XXVAL_STATUS__T
jne 0x412570
cmp dword [esi + 0x1c8], 0
jne 0x4125e6
push 5
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
mov ecx, esi
call fcn.00414670
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret
mov ecx, 7
call fcn.0041feb0
push eax
lea eax, [esp + 0x21c]
mov ecx, esi
push eax
call fcn.00412640
mov ecx, dword [esp + 0x62c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret
Function at 0x4126a0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1a0]
test ecx, ecx
je 0x41278f
call fcn.00414ac0
xor eax, eax
mov ecx, 5
cmp dword [esi + 0x1a8], 1
cmove eax, ecx
mov ecx, esi
push eax
push 0x72
call fcn.004251f0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x1a4], 0
jne 0x41274a
cmp dword [esi + 0x1a8], 1
je 0x4126f7
cmp dword [esi + 0x1ac], 0
jne 0x4126f7
xor eax, eax
jmp 0x4126fc
mov eax, 1
push eax
push 1
mov ecx, esi
call fcn.004251f0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [esi + 0x610], 0
je 0x412736
cmp dword [esi + 0x1a8], 1
jne 0x412736
mov eax, dword [esi + 0xd8]
lea ecx, [esi + 0xd8]
mov edx, 5
push edx
call dword [eax + 0xc]
pop esi
ret
mov eax, dword [esi + 0xd8]
lea ecx, [esi + 0xd8]
xor edx, edx
push edx
call dword [eax + 0xc]
pop esi
ret
mov eax, dword [esi + 0x1f8]
test eax, eax
jns 0x41277e
mov ecx, dword [esi + 0x1f4]
test ecx, ecx
jne 0x412773
xor eax, eax
mov ecx, esi
push eax
push 1
call fcn.004251f0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop esi
ret
call fcn.0040fde0
mov dword [esi + 0x1f8], eax
push eax
push 1
mov ecx, esi
call fcn.004251f0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop esi
ret
Function at 0x413680
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Get file attributes
Move file
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
mov eax, dword [0x47f06c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x838], ecx
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
push ecx
push 0x472e88
mov edx, ebx
mov dword [ebp - 0x834], eax
lea ecx, [ebp - 0x82c]
call fcn.0041d370
add esp, 4
push 0x472ea4
call fcn.00420c00
mov edx, eax
lea ecx, [ebp - 0x624]
call fcn.0041d370
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x82c]
add esp, 8
push eax
call edi
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
jne 0x41370a
push 0
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test esi, esi
je 0x4137d6
cmp word [esi], 0
je 0x4137d6
push ecx
push str.FastCopy.ini
mov edx, esi
lea ecx, [ebp - 0x41c]
call fcn.0041d370
add esp, 8
lea eax, [ebp - 0x41c]
push eax
call edi
cmp eax, 0xffffffff
je 0x4137d6
test ebx, ebx
jne 0x413760
push 1
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
mov edx, dword [ebp - 0x830]
push ecx
push str.to_OldDir_VirtualStore_.lnk
lea ecx, [ebp - 0x214]
call fcn.0041d370
push ecx
lea edx, [ebp - 0x214]
mov ecx, esi
call fcn.00426450
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push 0x472f14
push eax
call fcn.00410080
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x41c]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 0xffffffff
je 0x4137dc
lea eax, [ebp - 0x41c]
push eax
call esi
jmp 0x4137dc
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x834], 0
jne 0x4137e9
test ebx, ebx
jne 0x413860
lea eax, [ebp - 0x624]
push eax
call edi
cmp eax, 0xffffffff
je 0x413860
test ebx, ebx
jne 0x413811
push 1
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [ebp - 0x834], 0
je 0x413860
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x214]
push str._s.obsolete
push eax
call fcn.00410080
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x624]
push eax
call edi
cmp eax, 0xffffffff
je 0x413860
lea eax, [ebp - 0x624]
push eax
call esi
mov edx, dword [ebp - 0x830]
push ecx
push str.to_ExeDir.lnk
lea ecx, [ebp - 0x214]
call fcn.0041d370
push ecx
mov ecx, dword [ebp - 0x838]
lea edx, [ebp - 0x214]
call fcn.00426450
mov ecx, dword [ebp - 8]
add esp, 0xc
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret
Function at 0x4147a0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
mov eax, dword [0x47f06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
push eax
mov dword [ebp - 0x874], eax
lea eax, [ebp - 0x210]
push str._s.
push eax
call fcn.00410080
add esp, 0xc
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x414810
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x844]
push eax
push dword [ebp - 0x874]
lea eax, [ebp - 0x210]
push str._s_s
push eax
call fcn.00410080
lea eax, [ebp - 0x620]
push eax
lea edx, [ebp - 0x418]
lea ecx, [ebp - 0x210]
call fcn.004146a0
add esp, 0x14
test eax, eax
je 0x4148c0
cmp word [ebp - 0x620], 0
jne 0x4148c0
lea ecx, [ebp - 0x418]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414860
sub ecx, edx
sar ecx, 1
cmp ecx, 0xc
jle 0x4148c0
push 0xc
lea eax, [ebp + ecx*2 - 0x430]
push str.FastCopy.exe
push eax
call fcn.004491ad
add esp, 0xc
test eax, eax
jne 0x4148c0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test esi, esi
je 0x4148c0
lea ecx, [ebp - 0x210]
mov edx, esi
mov eax, ecx
sub edx, eax
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4148b0
lea eax, [ebp - 0x870]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x414810
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret 8

Function at 0x414d10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
cmp eax, 0xfffffffc
je 0x414d29
cmp eax, 0xfffffffe
je 0x414d29
xor eax, eax
pop ebp
ret 8
push 5
push 0
push 0
lea eax, [ecx + 0x7c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
pop ebp
ret 8

Function at 0x415b10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x415b41
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x415b30
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x41c3c0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x41c446
push ecx
push 0x473518
xor edx, edx
mov ecx, edi
call fcn.0041d370
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x104
add esp, 8
xor esi, esi
sub ecx, eax
lea eax, [edi + eax*2]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x10]
call fcn.0041e540
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp + 8]
push str._s__llx
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0041d860
add esp, 0x18
push dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41c44f
call ebx
cmp eax, 0xb7
jne 0x41c446
inc esi
cmp esi, 0x64
jl 0x41c405
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret