joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000114a
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1001c008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x108]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.10003920
push esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.10003920
mov ecx, dword [0x10041030]
add esp, 0x18
test ecx, ecx
jne 0x1000119b
call fcn.10001060
mov ecx, dword [0x10041030]
mov esi, ebx
imul ecx, ecx, 0x19660d
xor edx, edx
push 0x19
pop edi
add ecx, 0x3c6ef35c
mov eax, ecx
div edi
add dl, 0x61
mov byte [ebp + esi - 0x20c], dl
inc esi
cmp esi, 0xa
jl 0x1000119d
mov ecx, ebx
mov al, byte [ebp + ecx - 0x20c]
mov byte [ebp + ecx - 0x108], al
inc ecx
test al, al
jne 0x100011c4
push 0x208
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.10003920
lea ecx, [ebp - 0x108]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100011f5
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x108]
push ebx
push ebx
sub ecx, edx
push ecx
push eax
push ebx
push ebx
call edi
mov esi, eax
lea eax, [ebp - 0x414]
lea ecx, [esi + 1]
push ecx
push ebx
push eax
call fcn.100013ac
lea ecx, [ebp - 0x108]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001231
push esi
lea eax, [ebp - 0x414]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
call edi
xor eax, eax
mov word [ebp + esi*2 - 0x414], ax
lea eax, [ebp - 0x414]
push 0x10001102
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov dword [0x10041020], eax
test eax, eax
je 0x1000138f
push 0x10041004
push eax
mov dword [0x10041004], 0x10
mov dword [0x10041008], 4
mov dword [0x1004100c], 5
mov dword [0x10041014], ebx
mov dword [0x10041010], ebx
mov dword [0x10041018], ebx
mov dword [0x1004101c], ebx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
je 0x1000138f
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call edi
xor esi, esi
inc esi
push esi
call edi
push ebx
call edi
mov edx, ebx
mov cl, byte [edx + 0x1001c850]
mov eax, dword [0x10040250]
xor cl, al
xor cl, ah
xor cl, byte [0x10040252]
xor cl, byte [0x10040253]
mov byte [edx + 0x1001c850], cl
inc edx
mov ecx, 0x23a00
cmp edx, ecx
jb 0x100012d5
mov eax, ebx
xor byte [eax + 0x1001c850], 0x34
inc eax
cmp eax, ecx
jl 0x10001302
sub esp, 0x10
mov edx, ecx
call fcn.1000195f
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x10001350
push esi
call edi
push 0
call edi
push esi
call edi
push 0
call edi
push esi
call edi
mov ecx, ebx
call fcn.10001be6
push 0
mov esi, eax
call edi
push 1
call edi
push 0
call edi
call esi
mov ecx, ebx
call fcn.10001c8d
and dword [0x10041018], 0
push 0x10041004
push dword [0x10041020]
mov dword [0x10041008], 3
mov dword [0x1004101c], 0x3e8
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
je 0x1000138f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001d07
leave
ret 8
Function at 0x417900
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 8
mov dword [0x47ca88], 0x34dab2b4
mov eax, dword [0x4835b4]
mov dword [0x47f338], 0xa640078c
and dword [0x4827a4], 0xfed73fbe
mov dword [esp], eax
mov dword [esp + 4], 0x4e20
call dword [0x476818]
sub esp, 8
mov cx, word [0x47a636]
movsx ecx, cx
mov edx, dword [0x47c808]
sar edx, 3
add edx, ecx
cmp edx, 0x5abad5ce
jne 0x41798c
mov ecx, dword [0x47f2d8]
lea edx, [ecx - 1]
mov dword [0x47f2d8], edx
cmp ecx, 0xd56c0ca1
jl 0x41798c
mov ecx, dword [0x47b42c]
mov dx, word [0x4793c0]
mov esi, 0xffffab06
sub esi, ecx
add esi, edx
mov word [0x4793c0], si
cmp eax, 0x80
je 0x4179a3
test eax, eax
jne 0x4179af
add dword [0x4831a0], 0x27b985c1
jmp 0x4179c0
or dword [0x47d588], 0xa1dbf5df
jmp 0x4179c0
mov ax, word [0x479a6a]
add eax, 0xfffffae0
mov word [0x479a6a], ax
mov eax, dword [0x47f420]
lea ecx, [eax + 1]
mov dword [0x47f420], ecx
add eax, 0x67e1
mov word [0x477be8], ax
mov dword [esp], 1
call fcn.00447e96
int3
Function at 0x41fed0
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x20]
mov eax, dword [0x48083c]
mov ecx, dword [0x482b78]
imul ecx, eax
shl ecx, 7
mov dword [0x482b78], ecx
add dword [0x482110], 0xd41cbcb7
cmp dword [0x483d20], 0
jne 0x41ff29
add dword [0x47e61c], 0x2e208081
call fcn.0041ada0
mov dword [0x483d20], eax
mov ax, word [0x478e8a]
xor eax, 0x64cd
mov word [0x478e8a], ax
inc dword [0x480694]
mov eax, dword [0x47f258]
imul eax, eax, 0x3943aaf3
add eax, 0x193386c3
mov ecx, dword [0x47b78c]
imul ecx, eax
mov dword [0x47b78c], ecx
mov dword [esp + 4], 3
mov dword [esp], 0x6788
call fcn.00440830
mov edi, eax
mov ax, word [0x476d24]
mov cx, word [0x478d06]
add ecx, eax
mov word [0x478d06], cx
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00447300
mov esi, eax
mov eax, dword [0x480498]
shl eax, 8
mov ecx, dword [0x482088]
add ecx, eax
mov eax, dword [0x47fdd4]
and eax, ecx
and eax, 0xd09b27d0
mov dword [0x47fdd4], eax
mov dword [esp + 4], edi
mov dword [esp], 3
call fcn.00422bb0
and dword [0x480d00], 0x297d5e71
test esi, esi
je 0x41ffdb
mov eax, dword [0x47b258]
and eax, 0x384134b2
mov dword [0x47eafc], eax
jmp 0x4200b7
mov ax, word [0x479f40]
xor eax, 0x3db8
mov word [0x479f40], ax
mov dword [esp], 0x421
call dword [0x476820]
sub esp, 4
mov eax, dword [0x48130c]
lea ecx, [eax - 1]
mov dword [0x48130c], ecx
mov ecx, dword [0x47b43c]
lea edx, [ecx + 1]
mov dword [0x47b43c], edx
lea eax, [ecx + eax + 1]
and eax, 0x8101a4d1
mov ecx, dword [0x47f114]
imul ecx, ecx, 0x9e1bdae9
cmp eax, ecx
jle 0x420042
mov eax, dword [0x482054]
imul eax, eax, 0xaa4cb48
mov dword [0x482054], eax
mov dword [esp + 4], 3
mov dword [esp], 0x6788
call fcn.00440830
mov edi, eax
mov ax, word [0x47900e]
add eax, 0x6701
mov word [0x47900e], ax
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00447300
mov esi, eax
mov eax, dword [0x48086c]
lea ecx, [eax - 1]
mov dword [0x48086c], ecx
add dword [0x480220], eax
mov dword [esp + 4], edi
mov dword [esp], 3
call fcn.00422bb0
mov word [0x47990c], 0x828c
mov eax, dword [0x47b258]
and eax, 0x384134b2
mov dword [0x47eafc], eax
test esi, esi
je 0x420127
xor dword [0x47fe18], 0xb83f44e0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], 0x483d20
call fcn.004474b3
mov eax, dword [0x47c38c]
imul eax, eax, 0x69af4b2
mov dword [0x47c38c], eax
mov dword [esp], esi
call fcn.004475a1
mov ax, word [0x476e3a]
lea ecx, [eax - 1]
mov word [0x476e3a], cx
cwde
imul eax, eax, 0x35138a15
mov ecx, dword [0x47daac]
lea edx, [ecx + 1]
mov dword [0x47daac], edx
or ecx, eax
xor dword [0x480be8], ecx
add dword [0x47c98c], 0x28055366
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x4219f0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov eax, dword [0x481174]
inc eax
mov dword [0x481174], eax
xor eax, 0x517c94fe
mov edx, dword [0x48176c]
lea esi, [edx - 1]
mov dword [0x48176c], esi
or eax, edx
mov edx, dword [0x47eae4]
imul edx, eax
mov dword [0x47eae4], edx
mov dword [ecx], 0
mov ax, word [0x4784b4]
dec eax
mov word [0x4784b4], ax
mov dword [ecx + 4], 0
mov eax, dword [0x47eaa4]
lea edx, [eax + 1]
mov dword [0x47eaa4], edx
mov edx, dword [0x47b4f8]
and edx, 0x59538fea
xor edx, eax
mov eax, dword [0x482a70]
sub eax, edx
mov dword [0x482a70], eax
mov dword [ecx + 8], 0x67452301
mov eax, dword [0x47e068]
inc eax
mov dword [0x47e068], eax
mov dx, word [0x47aba8]
dec edx
mov word [0x47aba8], dx
movsx edx, dx
xor edx, 0x8254934c
or edx, eax
cmp edx, 0xff3ff37f
jne 0x421ac4
mov ax, word [0x47815a]
lea edx, [eax + 1]
mov word [0x47815a], dx
add eax, 0x1c59
mov dx, word [0x47772c]
or edx, eax
or edx, 0x389a
mov word [0x47772c], dx
jmp 0x421ad5
mov ax, word [0x477be2]
add eax, 0xfffffb3f
mov word [0x477be2], ax
mov dword [ecx + 0xc], 0xefcdab89
mov ax, word [0x478b8a]
dec eax
mov word [0x478b8a], ax
mov ax, word [0x477c2a]
xor eax, 0x4f34
mov word [0x477c2a], ax
mov dword [ecx + 0x10], 0x98badcfe
add dword [0x482a7c], 0x6bc1d2a8
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [0x47d3e4]
mov eax, dword [0x47b808]
lea ecx, [eax - 1]
mov dword [0x47b808], ecx
cmp eax, 0xa11f9227
jg 0x421b5a
mov ax, word [0x476e7e]
shl eax, 0xa
mov cx, word [0x478016]
dec ecx
mov word [0x478016], cx
and ecx, 0x502e
or ecx, eax
mov ax, word [0x4779b4]
and eax, ecx
mov word [0x4779b4], ax
pop esi
ret

Function at 0x428760
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [0x47847c]
inc eax
mov word [0x47847c], ax
cwde
or eax, 0x10b0a182
xor dword [0x47ccf8], eax
mov ax, word [0x47a7e6]
imul eax, eax, 0xfffff99f
mov word [0x47a7e6], ax
mov eax, dword [0x480958]
imul eax, eax, 0xf0239c13
cmp eax, 0xf67a20
jne 0x4287a9
and dword [0x47ce5c], 0x6415de75
jmp 0x4287d0
mov eax, dword [0x47bcd4]
inc eax
mov dword [0x47bcd4], eax
imul eax, eax, 0x4e54b19c
xor eax, 0x6ac457a6
cmp eax, 0x54a46a76
jg 0x4287d0
add dword [0x4805f0], 0xe2789b05
push edi
push esi
sub esp, 0x14
mov ax, word [0x4799ee]
inc eax
mov word [0x4799ee], ax
cwde
and eax, 0x6cc973ed
add dword [0x47fef0], eax
mov dword [0x4807b4], 0xebbcbd7f
lea eax, [esp + 4]
mov dword [esp], eax
call dword [0x4767c8]
sub esp, 4
mov ax, word [0x47a934]
cwde
shl eax, 7
or eax, 0x8cacb396
add dword [0x480aa8], eax
movzx eax, word [esp + 0x12]
mov ecx, dword [0x47fa70]
sar ecx, 7
mov edx, 0x9f95937a
sub edx, ecx
xor dword [0x47c4c4], edx
xor edi, edi
mov ecx, 0x15
nop
or dword [0x47d6e0], 0xf564919d
and dword [0x482180], 0x6feca366
lea edi, [edi + eax*2]
add eax, eax
mov dx, word [0x478a48]
movsx edx, dx
sar edx, 8
xor dword [0x481894], edx
dec ecx
jne 0x428840
add dword [0x48258c], 0x6bf3beff
mov dword [esp], 0
call fcn.00447129
mov esi, eax
xor esi, edi
xor dword [0x480f50], 0x977934ff
call dword [0x476788]
xor eax, esi
add dword [0x47ca98], 0xa4a7aa5e
mov dword [esp], eax
call fcn.0044719b
mov dword [0x47f2d8], 0xcfd5d4a
add esp, 0x14
pop esi
pop edi
ret
Function at 0x44ea7e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4757e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0044c68d
mov dword [ebp - 0x14], eax
cmp dword [0x484764], esi
jne 0x44eb71
push 0x800
push esi
push 0x465220
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x44eafe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x44ec51
push esi
push esi
push 0x465220
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x44ec51
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44ec51
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x484764], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x484768], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x48476c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x484774], eax
test eax, eax
je 0x44eb6e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x484770], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x44eb96
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x44eb89
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x44ebab
push 4
pop eax
jmp 0x44ec53
cmp dword [ebp - 0x14], esi
je 0x44ebab
push dword [0x484764]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x44eb90
mov eax, dword [0x484770]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x44ec09
cmp dword [0x484774], edi
je 0x44ec09
push eax
call ebx
push dword [0x484774]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x44ec09
test eax, eax
je 0x44ec09
call ecx
test eax, eax
je 0x44ebfe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x44ebfe
test byte [ebp - 8], 1
jne 0x44ec09
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x44ec39
mov eax, dword [0x484768]
cmp eax, edi
je 0x44ec36
push eax
call ebx
test eax, eax
je 0x44ec36
call eax
mov esi, eax
test esi, esi
je 0x44ec36
mov eax, dword [0x48476c]
cmp eax, edi
je 0x44ec36
push eax
call ebx
test eax, eax
je 0x44ec36
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x484764]
call ebx
test eax, eax
je 0x44ec51
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x44ec53
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ec82
mov esp, ebp
pop ebp
ret
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x463c0b
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20030
call fcn.00432450
push ebx
push esi
lea eax, [esp + 0x10038]
mov esi, edx
push eax
mov edx, 0x7fff
call fcn.00464c05
lea eax, [esp + 0x3c]
mov edx, 0x7fff
push eax
mov ecx, esi
call fcn.00464c05
pop ecx
pop ecx
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x463c99
cmp byte [ebp + 8], al
je 0x463c92
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call fcn.0042405c
pop ecx
pop ecx
test eax, eax
je 0x463c8b
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
jmp 0x463d45
xor al, al
jmp 0x463d45
lea ecx, [esp + 0x10038]
call fcn.0046502e
test al, al
je 0x463c92
lea ecx, [esp + 0x38]
call fcn.0046502e
test al, al
je 0x463d4b
cmp byte [ebp + 8], 0
je 0x463c92
lea eax, [esp + 0x10038]
push str..
push eax
call fcn.0042389d
lea eax, [esp + 0x10040]
push eax
call fcn.0042370c
xor ecx, ecx
mov word [esp + eax*2 + 0x10046], cx
lea eax, [esp + 0x44]
push eax
call fcn.0042370c
xor ecx, ecx
mov dword [esp + 0x1c], 2
add esp, 0x10
mov word [esp + eax*2 + 0x3a], cx
lea eax, [esp + 0x10038]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 8], eax
mov eax, 0x614
mov word [esp + 0x18], ax
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb al, al
inc al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x2c]
call fcn.00407da1
lea ecx, [esp + 0x28]
call fcn.00463fc4
mov bl, al
lea ecx, [esp + 0x28]
neg bl
sbb bl, bl
call fcn.004058c4
inc bl
jne 0x463c92
lea ecx, [esp + 0x38]
call fcn.0046502e
test al, al
jmp 0x463cbe
Function at 0x463d89
Capabilities:
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x34]
mov byte [ebp - 1], bl
mov edi, edx
call fcn.00407627
lea ecx, [ebp - 0x44]
call fcn.00407627
lea ecx, [ebp - 0x24]
call fcn.00407627
lea ecx, [ebp - 0x14]
call fcn.00407627
lea edx, [ebp - 0x34]
mov ecx, esi
call fcn.00404712
lea edx, [ebp - 0x44]
mov ecx, edi
call fcn.00404712
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x34]
call fcn.00464fc4
mov ecx, dword [ebp - 0x34]
mov byte [ebp - 3], al
call fcn.0046502e
mov esi, str..
test al, al
je 0x463dfa
push esi
lea ecx, [ebp - 0x34]
call fcn.00407c6b
mov ecx, dword [ebp - 0x44]
call fcn.0046502e
test al, al
je 0x463e0f
push esi
lea ecx, [ebp - 0x44]
call fcn.00407c6b
lea ecx, [ebp - 0x54]
call fcn.00407627
lea ecx, [ebp - 0x64]
call fcn.00407627
push ebx
lea eax, [ebp - 0x64]
push ebx
push eax
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x34]
call fcn.0040455d
add esp, 0xc
lea eax, [ebp - 0x2c8]
push eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [ebp - 2], al
cmp esi, 0xffffffff
je 0x463f5b
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp al, 1
jne 0x463f5b
test byte [ebp - 0x2c8], 0x10
jne 0x463f2f
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x74]
call fcn.00407da1
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x74]
call fcn.00464608
pop ecx
lea ecx, [ebp - 0x74]
call fcn.004058c4
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x14]
call fcn.00408007
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x14]
call fcn.00407aee
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00407c6b
lea ecx, [ebp - 0x24]
call fcn.004641d1
test al, al
je 0x463ee7
cmp byte [ebp + 8], bl
je 0x463f52
push ebx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
call fcn.004078c8
push dword [ebp - 0x24]
test eax, eax
je 0x463ef5
call edi
cmp byte [ebp + 0xc], 1
jne 0x463f19
cmp byte [ebp - 3], bl
jne 0x463f00
push dword [ebp - 0x24]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x463f27
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x14]
call fcn.00463f9e
movzx eax, al
test eax, eax
je 0x463f52
push dword [ebp - 0x14]
call edi
jmp 0x463f27
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x14]
call fcn.00463f9e
movzx eax, al
test eax, eax
je 0x463f52
mov byte [ebp - 1], 1
lea eax, [ebp - 0x2c8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov al, byte [ebp - 2]
jne 0x463e59
mov al, bl
mov byte [ebp - 2], al
jmp 0x463e59
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x463f65
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, byte [ebp - 1]
lea ecx, [ebp - 0x64]
call fcn.004058c4
lea ecx, [ebp - 0x54]
call fcn.004058c4
lea ecx, [ebp - 0x14]
call fcn.004058c4
lea ecx, [ebp - 0x24]
call fcn.004058c4
lea ecx, [ebp - 0x44]
call fcn.004058c4
lea ecx, [ebp - 0x34]
call fcn.004058c4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4640ac
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x288
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0xf], bl
call fcn.00407627
lea ecx, [esp + 0x20]
call fcn.00407627
lea ecx, [esp + 0x30]
call fcn.00407627
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.00404712
mov ecx, dword [esp + 0x10]
call fcn.0046502e
test al, al
je 0x464103
push str..
lea ecx, [esp + 0x14]
call fcn.00407c6b
push ebx
lea eax, [esp + 0x34]
push ebx
push eax
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x1c]
call fcn.0040455d
add esp, 0xc
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [esp + 0xe], al
cmp esi, 0xffffffff
je 0x4641a3
cmp al, 1
jne 0x4641a3
test byte [esp + 0x40], 0x10
jne 0x46417e
mov byte [esp + 0xf], al
lea ecx, [esp + 0x10]
lea eax, [esp + 0x20]
push eax
call fcn.00408007
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.00407aee
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x14]
call fcn.00407c6b
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x46419a
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov al, byte [esp + 0xe]
jne 0x464136
mov al, bl
mov byte [esp + 0xe], al
jmp 0x464136
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4641ae
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, byte [esp + 0xf]
lea ecx, [esp + 0x30]
call fcn.004058c4
lea ecx, [esp + 0x20]
call fcn.004058c4
lea ecx, [esp + 0x10]
call fcn.004058c4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret