joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f550
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4e9cf8], 0
push esi
mov esi, eax
jne 0x48f6f8
push 0x4e9cfc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x4e9cf8], 0
je 0x48f58a
push 0x4e9cfc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov esp, ebp
pop ebp
ret
push edi
xor ecx, ecx
push ecx
push 0x28
push 0x4e98e0
xor eax, eax
push ecx
mov dword [0x4e9ae8], 0
mov dword [0x4e9cf4], 0
mov word [0x4e98e0], ax
mov word [0x4e9aec], cx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x48f5db
push str.:windows_
push 0x4e98e0
call dword [0x4a93dc]
test eax, eax
je 0x48f65d
xor edi, edi
call fcn.00475270
test al, al
jne 0x48f6ec
test esi, esi
je 0x48f6ec
push esi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x48f64d
test eax, eax
je 0x48f64d
lea edx, [ebp - 4]
push edx
push 8
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x48f64d
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push 0x4e98e0
push ecx
mov dword [ebp - 8], 0x104
call dword [0x4a9584]
test eax, eax
je 0x48f643
mov edi, 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [ebp - 0xc]
call fcn.00434d00
test edi, edi
je 0x48f6ec
push 0x4e98e0
call dword [0x4a93d8]
mov eax, 0x4e98e0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48f670
push 0x104
sub eax, edx
push 0x4e9aec
sar eax, 1
push 0x4e98e0
mov dword [0x4e9ae8], eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x48f6a4
cmp eax, 0x104
jb 0x48f6ac
xor eax, eax
mov word [0x4e9aec], ax
push 0x4e9aec
push 0x4e98e0
call dword [0x4a93e8]
test eax, eax
jne 0x48f6c9
xor ecx, ecx
mov word [0x4e9aec], cx
mov eax, 0x4e9aec
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48f6d1
sub eax, edx
sar eax, 1
mov dword [0x4e9cf4], eax
mov byte [0x4e9cf8], 1
push 0x4e9cfc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48fb20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
push esi
push edi
push pe_nt_image_headers32
push eax
lea eax, [ebp - 0xc]
xor esi, esi
push eax
mov ecx, 0x4bc910
mov edx, 0x80000002
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call fcn.0048f890
test al, al
jne 0x48fb6b
mov eax, dword [ebp - 0xc]
cmp eax, esi
je 0x48fb62
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
mov esi, dword [ebp - 0xc]
je 0x48fb95
cmp eax, 0xffffffff
je 0x48fb95
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push 0
push str.Codepage
push esi
mov dword [ebp - 8], eax
call edi
mov ebx, dword [ebx + 0xc]
cmp dword [ebx - 0xc], 0
je 0x48fbbb
test ebx, ebx
je 0x48fbbb
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
push ebx
push 1
push 0
push 0x4bc2f4
push esi
call edi
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x10]
cmp dword [ebx - 0xc], 0
je 0x48fbe4
test ebx, ebx
je 0x48fbe4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
push ebx
push 1
push 0
push str.FaviconPath
push esi
call edi
mov edx, dword [ebp + 8]
mov ebx, dword [edx + 0x14]
cmp dword [ebx - 0xc], 0
je 0x48fc0d
test ebx, ebx
je 0x48fc0d
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push str.FaviconURL
push esi
call edi
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx + 0x18]
cmp dword [ebx - 0xc], 0
je 0x48fc36
test ebx, ebx
je 0x48fc36
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
push ebx
push 1
push 0
push str.OSDFileURL
push esi
call edi
mov ebx, dword [ebp + 8]
xor eax, eax
cmp dword [ebx + 0x1c], eax
setne al
cmp eax, 0xffffffff
je 0x48fc5b
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.ShowSearchSuggestions
push esi
call edi
mov ebx, dword [ebx + 0x20]
cmp dword [ebx - 0xc], 0
je 0x48fc81
test ebx, ebx
je 0x48fc81
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
push ebx
push 1
push 0
push str.SuggestionsURL_JSON
push esi
call edi
mov edx, dword [ebp + 8]
mov ebx, dword [edx + 0x24]
cmp dword [ebx - 0xc], 0
je 0x48fcaa
test ebx, ebx
je 0x48fcaa
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push 0x4bc3a8
push esi
call edi
test esi, esi
je 0x48fcb5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4910b0
Capabilities:
Terminate thread

Disassembly:
cmp dword [edi + 8], 0
je 0x4910ed
mov eax, dword [edi + 0xc]
push 0x7d0
push eax
mov byte [edi + 0x10], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4910dc
mov ecx, dword [edi + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [edi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], 0
push esi
mov esi, dword [edi]
test esi, esi
je 0x491108
call fcn.00490530
push esi
call fcn.0044556f
add esp, 4
mov dword [edi], 0
cmp dword [edi + 4], 0
pop esi
je 0x491116
mov dword [edi + 4], 0
mov eax, dword [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret

Function at 0x499d10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3ae6
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4e24e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
push eax
call fcn.0046b6a0
add esp, 4
test eax, eax
je 0x499d82
mov ecx, esi
call fcn.00499c00
test eax, eax
je 0x499d82
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x499db0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a46d6
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4e24e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x14], edi
test eax, eax
je 0x499e59
test ecx, ecx
je 0x499e59
push ecx
push 0x4732d0
push edi
push eax
call dword [0x4a9374]
test eax, eax
je 0x499e59
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x10]
push eax
call fcn.0049bd40
movzx edi, al
add esp, 4
mov dword [ebp - 0x14], edi
cmp edi, 1
jne 0x499e59
mov eax, dword [0x4ea5dc]
cmp eax, 2
jne 0x499e2e
xor eax, eax
jmp 0x499e38
cmp eax, 3
jne 0x499e38
mov eax, 1
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x18]
push eax
push edx
call fcn.0048c600
add esp, 8
movzx edi, al
jmp 0x499e59
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49cf20
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x4e24e0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
push 0x81e
push eax
lea ecx, [ebp - 0x822]
mov dword [ebp - 0x828], 0
push ecx
mov word [ebp - 0x824], ax
call fcn.0044b7d0
add esp, 0xc
push 0
push 0x1a
lea edx, [ebp - 0x824]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x828]
mov ecx, 0x208
lea edx, [ebp - 0x824]
call fcn.0048e7a0
test eax, eax
jl 0x49cfac
mov eax, dword [ebp - 0x828]
push 0x7fffffff
mov ecx, 0x208
push 0x4af9b0
sub ecx, eax
lea edx, [ebp + eax*2 - 0x824]
call fcn.0048e7e0
lea edi, [ebp - 0x828]
mov ecx, 0x208
lea edx, [ebp - 0x824]
call fcn.0048e7a0
pop edi
test eax, eax
jl 0x49cfea
mov eax, dword [ebp - 0x828]
push 0x7fffffff
mov ecx, 0x208
push 0x4af9d4
sub ecx, eax
lea edx, [ebp + eax*2 - 0x824]
call fcn.0048e7e0
push 0
lea eax, [ebp - 0x824]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push esi
lea ecx, [ebp - 0x824]
call fcn.00411220
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.0044557a
mov esp, ebp
pop ebp
ret

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, reloc.comctl32.dll_MenuHelp
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x79686fd9
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x610b7db6
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret
Function at 0x40726f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x412aab
call fcn.00411d10
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x4143fc
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x414218
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.0040b92f
push dword [esi + 8]
mov ecx, ebx
call fcn.0040b92f
push dword [esi + 0xc]
mov ecx, edi
call fcn.0040b92f
push dword [esi + 0xc]
mov ecx, edi
call fcn.0040b92f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x407820
Capabilities:
Create thread

Disassembly:
mov eax, 0x412c51
call fcn.00411d10
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x14], esi
mov dword [esi], 0x414300
mov dword [esi + 4], 0x414488
lea ecx, [esi + 0xc]
mov dword [esi + 8], edi
call fcn.0040105a
push 4
lea ecx, [esi + 0x5c]
pop ebx
mov dword [ebp - 4], edi
push ebx
call fcn.00401a1c
mov dword [esi + 0x5c], 0x414480
lea ecx, [esi + 0x70]
push ebx
mov byte [ebp - 4], 1
call fcn.00401a1c
mov dword [esi + 0x70], 0x414478
lea eax, [esi + 0x84]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], ebx
mov dword [eax], 0x414470
mov dword [esi + 0x98], edi
push edi
push edi
push edi
lea ecx, [esi + 0x9c]
push edi
mov byte [ebp - 4], bl
call fcn.0040d8e0
lea eax, [esi + 0xa0]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], ebx
mov dword [eax], 0x41432c
push edi
push edi
push edi
lea ecx, [esi + 0xb4]
push edi
mov byte [ebp - 4], 6
call fcn.0040d8e0
push edi
push edi
push edi
lea ecx, [esi + 0xb8]
push 1
mov byte [ebp - 4], 7
call fcn.0040d8e0
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 8
push eax
push edi
push esi
push 0x407989
push edi
push edi
mov dword [esi], 0x41445c
mov dword [esi + 4], 0x414450
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x98], eax
jne 0x40792a
lea eax, [ebp - 0x10]
push 0x414ac0
push eax
mov dword [ebp - 0x10], 0x425d1
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x407bbc
Capabilities:
Create thread

Disassembly:
mov eax, 0x412ceb
call fcn.00411d10
sub esp, 0xcc
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x78]
mov ecx, dword [edi + 0x18]
push dword [ecx + eax*8 + 4]
lea eax, [ecx + eax*8]
lea ecx, [ebp - 0xd8]
push dword [eax]
call fcn.0040732c
lea esi, [edi + 0x70]
lea eax, [ebp - 0xd8]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.004083ec
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov ecx, dword [ecx + eax*4 - 4]
call fcn.00407475
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov eax, dword [edi + 0xb8]
mov ecx, dword [edx + ecx*4 - 4]
mov dword [ecx + 0x64], eax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + eax*4 - 4]
lea ecx, [edi + 0xa0]
mov eax, dword [eax + 0x68]
push dword [eax]
call fcn.0040212e
mov dword [ebp - 0x14], ebx
add edi, 0x84
push ebx
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00408497
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov edx, dword [edi + 0xc]
mov eax, dword [ecx + eax*4 - 4]
mov ecx, dword [edi + 8]
lea esi, [edx + ecx*4 - 4]
lea ecx, [ebp - 0x10]
push ecx
push ebx
push eax
push 0x407cb2
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
pop edi
pop esi
cmp eax, ebx
pop ebx
jne 0x407c97
lea eax, [ebp - 0x10]
push 0x414ac0
push eax
mov dword [ebp - 0x10], 0x425d0
call sub.MSVCRT.dll__CxxThrowException
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8]
call fcn.004074ea
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x40af8c
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jbe 0x40afb7
push ebx
push edi
movzx edi, byte [edx]
movzx ebx, al
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x418650]
xor eax, edi
inc edx
dec esi
jne 0x40af9d
pop edi
pop ebx
mov dword [ecx], eax
pop esi
ret 8

Function at 0x40c15d
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x418a84], 0
je 0x40c180
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
neg eax
sbb eax, eax
neg eax
jmp 0x40c1aa
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040c1ae
push dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
test eax, eax
setne bl
call fcn.0040b047
pop ecx
mov al, bl
pop ebx
leave
ret 8

Function at 0x40c200
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x418a84], 0
je 0x40c220
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
jmp 0x40c246
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040c1ae
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
test eax, eax
setne bl
call fcn.0040b047
pop ecx
mov al, bl
pop ebx
leave
ret 4
Function at 0x40c25f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x418a84], 0
je 0x40c281
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
neg eax
sbb eax, eax
neg eax
jmp 0x40c2a3
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040c1ae
push dword [eax]
call fcn.0040c24a
push dword [ebp - 0xc]
mov bl, al
call fcn.0040b047
pop ecx
mov al, bl
pop ebx
leave
ret 4

Function at 0x40c4ab
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x40c4bf
xor al, al
jmp 0x40c4cf
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
ret 4

Function at 0x40c4d2
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x418a84], 0
je 0x40c500
push 0
push dword [ebp + 8]
call fcn.0040c15d
test al, al
je 0x40c522
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
jmp 0x40c522
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040c1ae
push dword [eax]
call fcn.0040c4ab
push dword [ebp - 0xc]
mov bl, al
call fcn.0040b047
pop ecx
mov al, bl
pop ebx
leave
ret 4

Function at 0x40c526
Capabilities:
Delete directory
Set file attributes

Disassembly:
mov eax, 0x413150
call fcn.00411d10
sub esp, 0x6c
push ebx
push esi
lea ecx, [ebp - 0x48]
call fcn.0040cbcc
mov esi, dword [ebp + 8]
push 0x5c
lea eax, [ebp - 0x18]
xor ebx, ebx
push esi
push eax
mov dword [ebp - 4], ebx
call fcn.0040cd32
lea eax, [ebp - 0x18]
push 0x2a
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 1
call fcn.0040cd32
mov byte [ebp - 0x34], bl
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.0040b341
push dword [ebp - 0x24]
mov byte [ebp - 4], 5
call fcn.0040b047
pop ecx
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x38]
push eax
call fcn.0040d210
test al, al
je 0x40c5da
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x18]
sub esp, 0xc
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.0040b341
call fcn.0040c633
cmp al, bl
jne 0x40c581
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0040b047
pop ecx
lea ecx, [ebp - 0x38]
call fcn.0040cde3
push dword [ebp - 0x18]
call fcn.0040b047
push dword [ebp - 0x48]
call fcn.0040b047
pop ecx
xor al, al
pop ecx
jmp 0x40c61e
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0040b047
pop ecx
lea ecx, [ebp - 0x38]
call fcn.0040cde3
mov eax, dword [esi]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x40c60a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne bl
push dword [ebp - 0x18]
call fcn.0040b047
push dword [ebp - 0x48]
call fcn.0040b047
pop ecx
mov al, bl
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x40caab
Capabilities:
Delete file

Disassembly:
mov eax, 0x4131d8
call fcn.00411d10
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
lea ecx, [ebp - 0x1c]
call fcn.0040cb5c
push esi
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.0040c9fc
test al, al
je 0x40cb39
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40cb24
push dword [esi]
call fcn.0040d177
test al, al
je 0x40cb08
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040ca87
push dword [ebp - 0x18]
call fcn.0040b047
pop ecx
jmp 0x40cabf
push dword [esi]
call fcn.0040c24a
test al, al
jne 0x40cb22
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40cb39
jmp 0x40caf1
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.0040ca87
push dword [ebp - 0x18]
call fcn.0040b047
pop ecx
mov al, bl
jmp 0x40cb4c
lea ecx, [ebp - 0x1c]
call fcn.0040ca87
push dword [ebp - 0x18]
call fcn.0040b047
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40cfed
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x413244
call fcn.00411d10
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 1
mov eax, dword [esi]
push 0
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
push 0
mov dword [edi + 0x18], eax
push dword [esi + 0x1c]
call fcn.00411ed0
mov ecx, dword [esi + 0x20]
xor ebx, ebx
add eax, ecx
lea ecx, [ebp - 0x18]
mov dword [edi + 0x20], eax
lea eax, [esi + 0x2c]
adc edx, ebx
push eax
mov dword [edi + 0x24], edx
call fcn.0040b153
and dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040d0a6
push eax
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 1
call fcn.0040abb8
push dword [ebp - 0x24]
call fcn.0040b047
push dword [ebp - 0x18]
call fcn.0040b047
mov eax, dword [esi + 0x24]
pop ecx
pop ecx
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40d368
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40d38f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40d38f
xor al, al
jmp 0x40d3af
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00411ed0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4