joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101cccfe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
test eax, eax
js 0x101ccd64
mov edi, ecx
mov ecx, dword [ecx + 0x2c0]
mov edx, dword [edi + 0x2c4]
sub edx, ecx
sar edx, 2
imul edx, edx, 0xcccccccd
cmp edx, eax
jle 0x101ccd64
lea edx, [eax + eax*4]
mov eax, dword [ecx + edx*4 + 0x10]
cmp eax, 0xffffffff
je 0x101ccd64
mov dword [ebp - 0x14], edx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 0x2a8]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x10], eax
push dword [eax]
call fcn.101d4284
add esp, 4
mov esi, eax
test ebx, ebx
je 0x101ccd72
lea eax, [esi*4]
cmp dword [ebx], eax
jae 0x101ccd72
xor ebx, ebx
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov bl, 1
mov eax, dword [ebp - 0x10]
push dword [eax]
call fcn.101d430a
add esp, 4
lea ecx, [eax - 0x1404]
cmp ecx, 2
jb 0x101ccdc9
mov edx, dword [ebp + 0x10]
cmp eax, 0x1406
je 0x101ccdf4
cmp eax, 0x8b56
mov ecx, dword [ebp - 0x10]
jne 0x101ccd66
test esi, esi
je 0x101ccd66
mov eax, dword [edi + 0x2c0]
mov edi, dword [ebp - 0x14]
mov eax, dword [eax + edi*4 + 0xc]
imul eax, esi
add eax, dword [ecx + 0x38]
xor ecx, ecx
mov edi, edx
movzx edx, byte [eax + ecx]
mov dword [edi + ecx*4], edx
inc ecx
cmp esi, ecx
jne 0x101ccdbb
jmp 0x101ccd66
mov eax, dword [edi + 0x2c0]
shl esi, 2
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + ecx*4 + 0xc]
imul eax, esi
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx + 0x38]
push esi
push eax
push dword [ebp + 0x10]
call fcn.101da630
add esp, 0xc
jmp 0x101ccd66
test esi, esi
mov ecx, dword [ebp - 0x10]
je 0x101ccd66
mov eax, dword [edi + 0x2c0]
mov edi, dword [ebp - 0x14]
mov eax, dword [eax + edi*4 + 0xc]
imul eax, esi
shl eax, 2
add eax, dword [ecx + 0x38]
xor ecx, ecx
movss xmm0, dword [0x10203010]
movss xmm1, dword [eax + ecx*4]
cvttss2si edx, xmm1
movaps xmm2, xmm1
subss xmm2, xmm0
cvttss2si edi, xmm2
xor edi, 0x80000000
ucomiss xmm0, xmm1
cmova edi, edx
mov edx, dword [ebp + 0x10]
mov dword [edx + ecx*4], edi
inc ecx
cmp esi, ecx
jne 0x101cce1f
jmp 0x101ccd66

Function at 0x101cd338
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1004
call fcn.101d79e0
mov esi, ecx
mov edi, dword [ebp + 0x10]
mov eax, dword [0x10243228]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x1010]
push 0x1000
push 0xff
push ebx
call fcn.101db130
add esp, 0xc
test edi, edi
jle 0x101cd3a9
mov eax, dword [ebp + 0x14]
xor ecx, ecx
pxor xmm0, xmm0
pcmpeqd xmm1, xmm1
mov edx, ebx
movd xmm2, dword [eax + ecx*4]
pcmpeqb xmm2, xmm0
pxor xmm2, xmm1
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
psrad xmm2, 0x18
movdqu xmmword [edx], xmm2
inc ecx
add edx, 0x10
cmp edi, ecx
jne 0x101cd383
mov ecx, esi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.101d09e0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d7611
mov al, 1
add esp, 0x1004
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x101fac10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x101fac1f
pop dword [ebp - 0x4c]
mov eax, 0xb1ee2d41
sub eax, 0xa1ce8122
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x5d7752fb
sub dword [ebp - 0x5c], 0xf250db0
mov dword [ebp - 0x58], 0xab71b9ee
sub dword [ebp - 0x58], 0x793e6da9
mov dword [ebp - 0x54], 0x67e0996b
sub dword [ebp - 0x54], 0x1b94553d
mov dword [ebp - 0x50], 0x6b6c05a5
sub dword [ebp - 0x50], 0x6b6c05a5
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xd78cfd02
add eax, 0x3896e87e
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xa6a03c43
sub dword [ebp - 0x5c], 0x322dd2ed
mov dword [ebp - 0x58], 0x129fc43d
sub dword [ebp - 0x58], 0xd13362c8
mov dword [ebp - 0x54], 0x4e7fd487
sub dword [ebp - 0x54], 0xeb10681b
mov dword [ebp - 0x50], 0x95713487
add dword [ebp - 0x50], 0x6a8ecb79
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x49cae
push 0
call eax
mov ecx, 0xf89ba4e3
add ecx, 0x764b403
mov esi, eax
mov edx, 0x38d17d67
add edx, 0xd758c899
add edx, dword [ebp - 0x4c]
mov edi, 0xce928b53
add dword [ebp - 0x34], 0xfcf9298e
mov ebx, dword [edx]
sub dword [ebp - 0x48], eax
xor ebx, edi
xor dword [ebp - 0x14], esi
mov dword [esi], ebx
add dword [ebp - 0x24], edi
add esi, 4
add edx, 0x2a418421
add edx, 0xd5be7be3
loop 0x101fad36
add eax, 0xd36aeda
sub eax, 0xd35586f
xor ebx, ebx
add ebx, eax
add eax, 0xb62f62dd
sub eax, 0xb62f62d8
mov ecx, sym.libGLESv2.dll_Ordinal_0
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x41824b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4233dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040e562
and dword [ebp - 0x14], 0
cmp dword [0x833d14], 0
mov dword [ebp - 0x18], eax
jne 0x4182fe
push 0x403ff0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4183a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403fe4
push ebx
call edi
test eax, eax
je 0x4183a6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403fd4
push ebx
mov dword [0x833d14], eax
call edi
push eax
call esi
push 0x403fc0
push ebx
mov dword [0x833d18], eax
call edi
push eax
call esi
push 0x403fa4
push ebx
mov dword [0x833d1c], eax
call edi
push eax
call esi
mov dword [0x833d24], eax
test eax, eax
je 0x4182fe
push 0x403f8c
push ebx
call edi
push eax
call esi
mov dword [0x833d20], eax
mov eax, dword [0x833d20]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x418357
cmp dword [0x833d24], ecx
je 0x418357
push eax
call esi
push dword [0x833d24]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x418357
test ebx, ebx
je 0x418357
call edi
test eax, eax
je 0x41834e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41834e
test byte [ebp - 8], 1
jne 0x418357
or dword [ebp + 0x10], 0x200000
jmp 0x41838a
mov eax, dword [0x833d18]
cmp eax, dword [ebp - 0x18]
je 0x41838a
push eax
call esi
test eax, eax
je 0x41838a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41838a
mov eax, dword [0x833d1c]
cmp eax, dword [ebp - 0x18]
je 0x41838a
push eax
call esi
test eax, eax
je 0x41838a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x833d14]
call esi
test eax, eax
je 0x4183a6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4183a8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b72e
leave
ret
Function at 0x4065ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406612
xor eax, eax
test eax, eax
je 0x406625
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406625
xor ecx, ecx
jmp 0x406628
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406751
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427d8c], 0
push esi
jne 0x406788
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406762
mov dword [ecx*4 + 0x427d88], eax
inc ecx
cmp ecx, 0x100
jl 0x40675d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067b9
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427d88]
xor eax, esi
inc ecx
dec edx
jne 0x40679b
pop edi
not eax
pop esi
ret 0xc

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4018bf
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
shr edi, 2
xor ebx, ebx
mov eax, edi
mov dword [ebp - 4], 1
shr eax, 1
mov ecx, ebx
add eax, 3
mov dword [esi], eax
add esi, 0x10
test edi, edi
je 0x4018f6
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, edi
jb 0x4018e9
mov edx, dword [esi + edi*4 - 4]
imul eax, edi, 0xc
add eax, 0x70
add eax, esi
mov dword [ebp + 8], eax
test ebx, ebx
jne 0x401964
movzx eax, dl
mov ebx, dword [ebp - 4]
push 0x1b
movzx ecx, byte [eax + 0x10bf5c0]
mov eax, edx
shr eax, 0x18
shl ecx, 8
movzx eax, byte [eax + 0x10bf5c0]
or ecx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
shr edx, 8
shl ecx, 8
movzx eax, byte [eax + 0x10bf5c0]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + 0x10bf5c0]
xor edx, ebx
add ebx, ebx
or edx, ecx
test ebx, 0x100
pop eax
cmovne ebx, eax
mov dword [ebp - 4], ebx
mov ebx, edi
jmp 0x4019b1
cmp ebx, 4
jne 0x4019b4
cmp edi, 6
jbe 0x4019b4
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + 0x10bf5c0]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + 0x10bf5c0]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x10bf5c0]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + 0x10bf5c0]
or edx, ecx
mov eax, dword [ebp + 8]
xor edx, dword [esi]
dec ebx
mov dword [esi + edi*4], edx
add esi, 4
cmp esi, eax
jne 0x401905
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402b17
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [0x110e06c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x368]
mov dword [ebp - 0x368], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x402b57
cmp dword [ebp - 0x364], 6
jne 0x402b57
cmp dword [ebp - 0x360], 0
je 0x402b81
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402b81
push 0xc00
call eax
test eax, eax
jne 0x402c16
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402c16
cmp eax, 0x104
ja 0x402c16
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d6], cx
je 0x402bc1
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [str.UXTHEME], 0
push esi
mov esi, str.UXTHEME
je 0x402c15
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + eax*2]
mov edx, edi
mov cl, byte [esi]
inc esi
movzx eax, cl
mov word [edx], ax
lea edx, [edx + 2]
test cl, cl
jne 0x402bdc
push str..dll
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
push 0
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x402bda
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01043572
leave
ret
Function at 0x408e03
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.010987c6
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x408e2f
call fcn.00408d15
mov esi, eax
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x40aee8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [ebp + 0x10]
xor ebx, ebx
lea ecx, [ebp - 4]
push 0x2002
mov dword [ebp - 4], ebx
call fcn.0040d996
test al, al
je 0x40af41
push esi
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x40af40
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.01094c40
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x40af40
mov dword [ebp - 4], ebx
mov bl, 1
pop esi
lea ecx, [ebp - 4]
call fcn.0040d9b9
mov al, bl
pop ebx
leave
ret 0xc

Function at 0x40af50
Capabilities:
Open clipboard

Disassembly:
push 0x18
mov eax, 0x10baad2
call fcn.0104380a
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
setne al
mov byte [ebp + 0xb], al
test al, al
je 0x40b011
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x40b00e
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
lea eax, [eax*2 + 2]
push eax
push dword [esi]
push 0xd
call fcn.0040aee8
push 0
mov bl, al
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.0040a4c9
mov ecx, dword [ebp - 0x14]
xor eax, eax
inc eax
inc ecx
push ecx
push dword [ebp - 0x18]
mov byte [ebp - 4], al
push eax
call fcn.0040aee8
push 1
pop edi
push edi
test al, al
movzx ebx, bl
push esi
lea eax, [ebp - 0x24]
cmovne ebx, edi
push eax
call fcn.0040a4c9
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00409521
push dword [ebp - 0x24]
call fcn.010437c5
mov eax, dword [ebp - 0x14]
pop ecx
inc eax
push eax
push dword [ebp - 0x18]
push 7
call fcn.0040aee8
push dword [ebp - 0x18]
test al, al
movzx ebx, bl
cmovne ebx, edi
call fcn.010437c5
pop ecx
jmp 0x40b017
mov al, byte [ebp + 0xb]
xor bl, bl
test al, al
je 0x40b01d
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
call fcn.010437d8
ret 8
Function at 0x40bbe5
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x10babca
call fcn.0104380a
cmp byte [0x11124d4], 0
mov edi, dword [ebp + 8]
jne 0x40bc21
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.0040a299
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.010437c5
pop ecx
test esi, esi
jmp 0x40bc2d
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40bc33
mov al, 1
jmp 0x40bc79
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40bc44
xor al, al
jmp 0x40bc79
lea ecx, [ebp - 0x50]
call fcn.0040c07e
lea ecx, [ebp - 0x28]
call fcn.004094fd
push ebx
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.0040c2e8
test al, al
je 0x40bc6e
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.010437c5
pop ecx
mov al, bl
call fcn.010437d8
ret 4

Function at 0x40bc81
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x11124d4], 0
jne 0x40bcb7
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.010437c5
pop ecx
test esi, esi
pop esi
jmp 0x40bcc4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40bcca
mov al, 1
jmp 0x40bccc
xor al, al
leave
ret 4

Function at 0x40bcd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040c91e
cmp eax, 0xffffffff
je 0x40bcfd
mov ecx, eax
and cl, 0x11
cmp cl, 1
jne 0x40bcfd
and eax, 0xfffffffe
push eax
push esi
call fcn.0040bf9e
test al, al
je 0x40bd35
cmp byte [0x11124d4], 0
push esi
jne 0x40bd27
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.010437c5
pop ecx
test esi, esi
jmp 0x40bd2f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40bd35
mov al, 1
jmp 0x40bd37
xor al, al
pop esi
leave
ret 4

Function at 0x40bef3
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x11124d4], 0
jne 0x40bf27
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.010437c5
pop ecx
test esi, esi
pop esi
jmp 0x40bf32
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40bf38
mov al, 1
jmp 0x40bf3a
xor al, al
leave
ret 4
Function at 0x40bf9e
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x11124d4], 0
jne 0x40bfd5
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.010437c5
pop ecx
test esi, esi
pop esi
jmp 0x40bfe3
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40bfe9
mov al, 1
jmp 0x40bfeb
xor al, al
leave
ret 8

Function at 0x40c91e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x11124d4], 0
jne 0x40c952
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.010437c5
pop ecx
mov eax, esi
pop esi
jmp 0x40c965
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
leave
ret 4
Function at 0x40c9f0
Capabilities:
Get disk information

Disassembly:
push 0x2c
mov eax, 0x10bacec
call fcn.0104380a
mov ecx, dword [ebp + 8]
call fcn.00408f10
cmp byte [0x11124d4], 0
jne 0x40cadd
mov ecx, dword [ebp + 8]
call fcn.00408f10
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x40caf0
push edi
call fcn.010437bc
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x40cb92
cmp edi, dword [ebp - 0x18]
ja 0x40cb92
lea ecx, [ebp - 0x2c]
call fcn.0040933c
mov byte [ebp - 4], 1
test edi, edi
je 0x40cad3
xor eax, eax
mov dword [ebp - 0x14], edi
inc eax
mov ecx, edi
mov dword [ebp - 0x10], eax
cmp byte [esi + eax - 1], 0
jne 0x40cac4
lea eax, [ebx + esi]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00409571
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0040a257
mov edi, eax
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 2
call fcn.00408f92
mov ecx, dword [ebp + 8]
push edi
call fcn.00408ecc
push dword [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.010437c5
pop ecx
mov ecx, dword [ebp - 0x14]
mov eax, ebx
inc eax
sub ecx, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
jne 0x40ca78
mov edi, dword [ebp - 0x1c]
push dword [ebp - 0x2c]
cmp ebx, edi
jmp 0x40cb89
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x40caf7
xor al, al
jmp 0x40cb9b
push edi
lea ecx, [ebp - 0x1c]
call fcn.0040c013
mov esi, dword [ebp - 0x1c]
push esi
push edi
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x40cb92
cmp edi, dword [ebp - 0x18]
ja 0x40cb92
lea ecx, [ebp - 0x38]
call fcn.004094fd
mov byte [ebp - 4], 4
mov edx, ebx
mov dword [ebp - 0x18], edx
mov eax, ebx
mov dword [ebp - 0x10], eax
test edi, edi
je 0x40cb84
push 2
pop ecx
mov dword [ebp - 0x14], ecx
cmp word [esi + ecx - 2], bx
jne 0x40cb73
lea eax, [edx + esi]
push eax
lea ecx, [ebp - 0x38]
call fcn.004096a8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
inc eax
mov dword [ebp - 0x18], eax
call fcn.00408f92
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x38]
push eax
call fcn.00408ecc
mov ecx, dword [ebp - 0x14]
mov edx, ecx
mov eax, dword [ebp - 0x10]
inc eax
add ecx, 2
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, edi
jb 0x40cb3d
mov edx, dword [ebp - 0x18]
push dword [ebp - 0x38]
cmp edx, edi
sete bl
call fcn.010437c5
pop ecx
push esi
call fcn.010437c5
mov al, bl
pop ecx
call fcn.010437d8
ret 4
Function at 0x41e0a3
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10bb3a9
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x110e06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00421936
lea ecx, [esi + 0x30]
call fcn.0041e046
push dword [esi + 0x24]
call fcn.010437c5
pop ecx
lea ecx, [esi + 0xc]
call fcn.00408e58
mov ecx, esi
call fcn.0041df5a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret

Function at 0x4223ad
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x110e06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
mov edx, 0x4011
test al, al
mov ecx, 0x4110
lea eax, [ebp - 0x164]
cmovne ecx, edx
push ecx
push 0x160
push eax
push 0x90
push 0x10bf8e4
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01043572
leave
ret 4