joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4370a6
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x452040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x4370e9
call fcn.00424a0b
mov dword [eax], 0xf
call fcn.00424a1e
mov dword [eax], 0xd
call fcn.0041d65f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004186ed
leave
ret
test eax, eax
jne 0x4370f0
inc eax
jmp 0x4370dd
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x4370db
xor eax, eax
cmp ecx, 1
setne al
jmp 0x4370dd
Function at 0x439c35
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00439bb1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x439da4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x439da4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x439d59
jg 0x439c91
test eax, eax
je 0x439d4f
push 1
push 0x1000
call fcn.0042bec0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x439cb4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x439d46
push 0x8000
push ebx
call fcn.00428ad6
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x439cdd
jg 0x439cd8
cmp ecx, 0x1000
jb 0x439cdd
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004387fd
add esp, 0x10
cmp eax, 0xffffffff
je 0x439d22
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x439cd8
jl 0x439d09
test ecx, ecx
jne 0x439cca
push dword [ebp - 0xc]
push ebx
call fcn.00428ad6
push esi
call fcn.0042aadb
add esp, 0xc
xor ebx, ebx
jmp 0x439db2
cmp byte [edi + 0x24], 0
je 0x439d39
cmp dword [edi + 0x20], 5
jne 0x439d39
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x439d44
mov ebx, dword [edi + 0x18]
jmp 0x439d46
xor ebx, ebx
push esi
call fcn.0042aadb
pop ecx
jmp 0x439db2
test ecx, ecx
jg 0x439d1b
jl 0x439d59
test eax, eax
jae 0x439d1b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00437d3a
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x439d79
cmp byte [edi + 0x1c], 0
je 0x439d1b
jmp 0x439daa
push ebx
call fcn.0042d15b
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x439d1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x439db2
cmp byte [edi + 0x1c], 0
je 0x439daf
mov ebx, dword [edi + 0x18]
jmp 0x439db2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00437d3a
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43afd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43affd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43affd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401e50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x5c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
pop edi
add esp, 0x54
ret

Function at 0x402000
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [esp + 8]
ret 8

Function at 0x402030
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
ret 8

Function at 0x40a561
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0040a5e0
jae 0x40a56d
xor ecx, ecx
call fcn.0040a5e0
jae 0x40a597
xor eax, eax
call fcn.0040a5e0
jae 0x40a5a8
mov al, 0x10
call fcn.0040a5e0
adc al, al
jae 0x40a589
jne 0x40a5d5
stosb byte es:[edi], al
jmp 0x40a56e
call fcn.0040a5ec
dec ecx
loop 0x40a5b4
mov eax, ebp
call fcn.0040a5ea
jmp 0x40a5d6
lodsb al, byte [esi]
shr eax, 1
je 0x40a5fc
adc ecx, 2
mov ebp, eax
jmp 0x40a5d6
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0040a5ea
cmp eax, 0x7d00
jae 0x40a5d4
cmp eax, 0x500
jae 0x40a5d5
cmp eax, 0x7f
ja 0x40a5d6
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40a56e
pop ebp
ret 8
Function at 0x40f5e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
push ebx
push esi
mov ebx, 0x4848e8
call fcn.0040f580
mov esi, eax
lea eax, [esp + 0xa8]
push esi
push eax
call fcn.00413990
push esi
call fcn.004112ef
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.0040f6a0
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.0040f6d0
xor ebx, ebx
mov dword [edi + 8], ebx
xor ecx, ecx
mov eax, ebx
movzx edx, byte [esp + ecx + 0x18]
add eax, edx
movzx edx, byte [esp + ecx + 0x19]
add eax, edx
movzx edx, byte [esp + ecx + 0x1a]
add eax, edx
movzx edx, byte [esp + ecx + 0x1b]
add ecx, 4
add eax, edx
cmp ecx, 0x10
jl 0x40f631
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push 0x4876c8
push eax
call fcn.00414e06
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x42b2ee
push edi
call fcn.0040f450
cmp eax, ebx
je 0x42b2f8
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.00414e94
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x40f690
mov edx, dword [edi]
push edx
push 0x10
lea eax, [esp + 0x10]
push 1
push eax
call fcn.004151b0
add esp, 0x10
push 0x99f2
push 0x10
lea ecx, [esp + 0x10]
push ecx
call fcn.0044afdc
xor eax, eax
mov dword [edi + 8], ebx
xor ecx, ecx
movzx edx, byte [esp + eax + 8]
inc eax
imul ecx, edx
cmp eax, 0x10
jl 0x42b324
mov eax, dword [edi]
push eax
mov dword [edi + 8], ecx
call fcn.00415484
add esp, 4
mov dword [edi + 4], eax
xor eax, eax
jmp 0x40f690

Function at 0x40f6a0
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.004131f0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret
Function at 0x4353b4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x4a72e8], eax
mov edx, 1
mov eax, 0x4a72e8
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x4a7ca4
jl 0x4353c8
mov dword [0x49223c], 1
mov dword [0x4a7cb8], 1
pop edi
ret

Function at 0x44afdc
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xdc
push ebx
mov ebx, dword [esp + 0xe4]
push esi
push edi
mov edi, dword [esp + 0xf0]
lea eax, [esp + 0x10]
push eax
call fcn.004431e0
mov ecx, dword [esp + 0xf4]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.0044313a
xor esi, esi
test edi, edi
jbe 0x44b02e
lea esp, [esp]
lea eax, [esp + 0x10]
push eax
call fcn.004431b2
xor byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x44b01c
pop edi
pop esi
pop ebx
add esp, 0xdc
ret 0xc
Function at 0x460160
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebx + 0xc0c2474]
mov eax, dword [esi]
push edi
mov edi, dword [esi + 4]
add byte [edx], ch
push 0x47
push edi
push eax
add edi, edi
push 0x8900fde9
call dword [0x482174]
mov eax, gs
test ebp, ebp
jne 0x460195
je 0x4601ac
sub byte [eax + ebp*8], dl
loop 0x4601c2
cli
pop edi
pop esi
pop ebp
pop ebx
add al, 0
push ebx
xor ecx, ecx
add al, byte [eax]
add byte [ebx + 0xfe2f700], al
nop
rcl dword [ebx - 9], 0xd9
or ecx, eax
push ecx
call fcn.0041171b
mov esi, dword [esi]
add esp, 4
push ebp
mov ebx, eax
push ebx
push edi
push esi
add byte [edx + 0x68], ch
jmp 0xffcf02bc
dec eax
add byte [esp + ecx*2 + 0x5000180c], cl
dec eax
push ebx
call 0xf7403fb1
push ebx
call fcn.004112f0
les eax, [eax*4 + 0x5b5d5e5b]
add al, 0
push ebx

Function at 0x47151f
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7474ab14], al
push esi
mov ecx, dword [ebp - 0x17dfebdc]
xor dword [ebx + 0x244c8bf9], ebp
adc byte [eax], dh
call 0x8c40c061
dec esp
and al, 0x10
inc eax
call 0x8c40c061
inc esp
and al, 0x40
insb byte es:[edi], dx
push eax
xor edi, edi
xor ebp, ebp
call fcn.00453082
mov ebx, eax
movzx eax, word [ebx]
mov byte [esp + 0x17], 0
mov dword [esp + edx], esp
sbb byte [ecx + 0x4450247c], cl
and al, 0x1c
pop eax
add byte [eax], al
add byte [esi - 0x77], bl
jl 0x471591
pop esp
cmp ax, di
je 0x8347157a
inc ebp
cmp ax, 0x24
jne 0x478b55
cmp word [ebx + ebp*2], ax
jne 0x47159e
push 0x24
lea esp, [esp + ebp]
and al, 0xc6
inc esp
and al, 0x1b
add eax, ebp
fstp dword [esi]
stc
inc dword [ebp - 0x17]
mov ecx, 0x68000001
call 0x4caf15ec
sbb eax, dword [ecx]
call fcn.00403471
inc ebp
jmp 0x471757
push 0x680048e8
dec esp
inc esp
and al, 0x34
call 0x8c4021e1
movzx eax, word [ebx + ebp*2]
cmp ax, 0x24
je 0x4715d4
cmp ax, di
je 0x4715d4
movzx eax, ax
push eax
dec esp
inc esp
and al, 0x34
call 0x8c403471
movzx eax, word [ebx + ebp*2 + 2]
inc ebp
cmp ax, 0x24
jne 0x4715b6
cmp word [ebx + ebp*2], di
je 0x4717a8
lea ecx, [esp + 0x30]
push ecx
lea esp, [eax + ebp]
inc esp
inc ebp
call fcn.0040df51
call fcn.00410a41
lea esp, [eax + edx]
sbb byte [edx - 0x73], dl
and al, 0x30
and byte [eax + 0x33], dl
leave
call 0x8c40c3e1
inc esp
and al, 0x40
sbb al, 0x3b
invalid
movzx eax, word [ebx + ebp*2]
xor edi, edi
cmp ax, di
jne 0x8c471577
and byte [esp + esi], 0x17
add byte [ebp + ecx - 0x75], dh
je 0x471794
je 0x47177a
mov esi, dword [esp + 0x6c]
insb byte es:[edi], dx
lea edi, [esp + 0x20]
call fcn.0040e641
lea esp, [eax + ebp]
push eax
call 0x8c4092c1
dec esp
and al, 0x10
inc eax
call 0x8c402621
dec esp
and al, 0x10
xor al, ch
mov word [esi], cs
stc
mov ecx, dword [esp + 0x10]
and al, ch
or dword [esi], 0xfffffff9
mov ebx, dword [esi + 0x5d]
pop ebp
pop ebx
add esp, 0x54
ret 8
mov edi, 0x6800a834
dec esp
inc esp
and al, 0x20
call 0x6040d3b1
lea esp, [eax + eax*2]
xor byte [eax - 0x73], dl
and al, 0x10
and al, 0xe8
jge 0x47176b
stc
pop edi
jmp 0x47176d
add esp, edi
invalid
Function at 0x479c97
Capabilities:
Authenticate hmac

Disassembly:
pop esi
pop ebp
pop ebp
add dword [ebx + 0x18c254c4], 0x10548b53
push 0xc68016a
stosb byte es:[edi], al
dec eax
add byte [edi], dl
add dword [edx - 0x18], edx
and ebp, esp
dec dword [ebx - 0x7ea2a2a2]
add esp, 0x54
ret 0x5318
push ebx
push ebx
sub esp, 0x5e000094
push ebx
push ebp
mov ebp, dword [esp + 0x5e0000a0]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x5e0000ac]
push edi
jl 0x479c70
and al, 0xac
add byte [eax], al
pop esi
push 0x20
inc esp
xchg esp, eax
and al, 0x84
add byte [eax], al
pop esi
xor eax, eax
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x28], ebx
push es
inc esp
and al, 0x40
invalid

Function at 0x47f09d
Capabilities:
Get number of processors

Disassembly:
add byte [ebx - 0x74acef14], al
insb byte es:[edi], dx
and al, 0xc
sbb al, 0x8b
je 0x47f0ce
or al, 0x24
mov eax, dword [esi - 0x7d]
mov ebx, 0x5e000000
mov dword [esp + ecx + 0x24], ebx
mov ecx, dword [eax + 4]
push edi
mov edi, 0x5e00007f
cmp word [ecx + 8], di
je 0x47f131
xor eax, eax
push 0xffffffffffffffff
lea esp, [eax + edx]
adc al, 0x44
and al, 0x30
adc al, 0x44
and al, 0x30
and byte [edx - 0x73], dl
and al, 0x30
xor byte [eax + 0x56], dl
mov ecx, ebp
mov dword [esp + 0x28], ebx
call 0x8a40ab51
test eax, eax
jne 0x47f10a
mov eax, dword [ebx + ecx*4]
push ss
push esp
and al, 0x28
mov eax, dword [ecx + edx*4]
cmp word [eax + 8], di
je 0x47f11d
movsx eax, word [eax + 0xa]
push eax
push 0x72
push ebp
call 0x8c45e62f
dec esp
and al, 0x28
adc al, ch
scasb al, byte es:[edi]
mov eax, dword [0x5d5e8bf8]
pop ebp
add dword [ebx + 0xc0c10c4], 0x10248d85
lea esp, [eax + edx]
adc al, ch
cmp edx, esi
clc
mov ecx, dword [esp + 0x28]
adc byte [ebx - 0x5e6f1728], cl
clc
mov esi, dword [ebx]
test byte [ebp - 0x72958125], 0xbd
insb byte es:[edi], dx
add byte [eax], al
add byte [eax + 0x50fce857], dl
sti
test al, al
jne 0x47f1bc
xor esi, esi
test ebx, ebx
jle 0x47f1a1
lea edi, [ebp + 0x6c]
nop
push edi
call 0x85434240
sal byte [ebp + 0x75], 0x4c
dec esp
mov eax, edi
call fcn.0040f361
invalid
pop esi
pop ebp
pop ebp
add dword [ebx + 0xc0c10c4], 0x10ec8385
test dword [ebx + 0x165310ec], eax
Function at 0x47f1aa
Capabilities:
Get number of processors

Disassembly:
test dword [ebx + 0x165310ec], eax
pop esp
and al, 0x18
mov ecx, dword [ebx + 0x240c2474]
mov eax, dword [esi - 0x7d]
mov ebp, 0x5e000000
inc esp
insb byte es:[edi], dx
sbb al, 0x24
mov ecx, dword [eax + 4]
push edi
mov edi, 0x5e00007f
cmp word [ecx + 8], di
je 0x47f23e
xor eax, eax
push 0xffffffffffffffff
lea esp, [eax + edx]
adc al, 0x44
and al, 0x30
adc al, 0x44
and al, 0x30
and byte [edx - 0x73], dl
and al, 0x30
xor byte [eax + 0x56], dl
mov ecx, ebx
mov dword [eax + ebp + 0x28], ebp
call 0x8a40ab51
test eax, eax
jne 0x47f217
mov eax, dword [ebx + ecx*4]
push ss
push esp
and al, 0x28
mov eax, dword [ecx + edx*4]
cmp word [eax + 8], di
je 0x47f22a
movsx eax, word [eax + 0xa]
push eax
push 0x72
push ebx
call 0x8c45e62f
dec esp
and al, 0x28
adc al, ch
mov eax, dword [0x5e8bf8a0]
pop ebp
pop ebp
add dword [ebx + 0xc0c10c4], 0x10248d85
lea esp, [eax + edx]
adc al, ch
aad 0xf8
dec dword [esp + 0x28]
adc byte [ebx - 0x5f7c1718], cl
clc
mov esi, dword [ebx]
test byte [ebp - 0x72988113], 0xbb
insb byte es:[edi], dx
add byte [eax], al
add byte [eax + 0x4fefe857], dl
sti
test al, al
jne 0x47f2c9
xor esi, esi
test ebp, ebp
jle 0x47f2ab
lea edi, [ebx + 0x6c]
nop
push edi
call 0x85434240
sal byte [ebp + 0x75], 0x49
dec ecx
mov eax, edi
call fcn.0040f361
invalid
pop esi
pop ebp
pop ebp
add dword [ebx + 0xc0c10c4], 0x44ec8385
test dword [ebx - 0x74acbb14], eax
xor ebp, ebp
xor byte [eax], bl
mov dword [eax + esi], esp
dec eax
inc esp
Function at 0x402a69
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42ecd0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402afd
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402aba
cmp dword [ebp + 0x10], ebx
jne 0x402af1
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a69
test eax, eax
jne 0x402acc
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402aa1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.00405f57
cmp eax, ebx
je 0x402b04
push ebx
push dword [0x42ecd0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402afd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42ecd0], ebx
jne 0x402afa
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402afa
jmp 0x402afd
Function at 0x405375
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x40735c
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x40734c
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4053c6
xor eax, eax
jmp 0x4053ed
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x4053ed
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
jne 0x4053c2
call esi
pop esi
leave
ret 4

Function at 0x405427
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x42c0a8], 0x44
push eax
xor eax, eax
push 0x42c0a8
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405462
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x4054ec
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0040579b
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x405520
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42eca8], eax
jmp 0x4056b4
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x40553e
test eax, eax
je 0x40565f
test byte [ebp + 0xc], 2
je 0x40565f
mov esi, 0x42b0a8
push edi
push esi
call fcn.00405bc7
test ebx, ebx
je 0x40555b
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405561
push edi
call fcn.00405701
cmp byte [edi], 0
jne 0x40556f
cmp byte [0x42b0a8], 0x5c
jne 0x40557a
push 0x409010
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x405655
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.004056e5
cmp byte [eax], 0
je 0x4055c0
cmp byte [ebp - 0x18], 0
je 0x4055c0
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x4055d6
mov al, byte [esi + 1]
test al, al
je 0x405634
cmp al, 0x2e
jne 0x4055d6
cmp byte [esi + 2], 0
je 0x405634
push esi
push ebx
call fcn.00405bc7
test byte [ebp - 0x148], 0x10
je 0x4055fb
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405634
push dword [ebp + 0xc]
push edi
call fcn.004054ec
jmp 0x405634
push edi
call fcn.0040587f
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40562c
test byte [ebp + 0xc], 4
je 0x405624
push edi
push 0xfffffffffffffff1
call fcn.00404eb3
push 0
push edi
call fcn.00405915
jmp 0x405634
inc dword [0x42eca8]
jmp 0x405634
push edi
push 0xfffffffffffffff2
call fcn.00404eb3
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40559e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x40565f
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4056b4
cmp dword [ebp - 8], esi
jne 0x405674
inc dword [0x42eca8]
jmp 0x4056b4
push edi
call fcn.00405ec2
test eax, eax
je 0x4056b4
push edi
call fcn.004056ba
push edi
call fcn.0040587f
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4056ac
test byte [ebp + 0xc], 4
je 0x40566c
push edi
push 0xfffffffffffffff1
call fcn.00404eb3
push esi
push edi
call fcn.00405915
jmp 0x4056b4
push edi
push 0xffffffffffffffe5
call fcn.00404eb3
pop edi
pop esi
leave
ret 8
Function at 0x40579b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42b4a8
push esi
call fcn.00405bc7
push esi
call fcn.0040574e
mov edi, eax
test edi, edi
jne 0x4057bc
xor eax, eax
jmp 0x40580e
push edi
call fcn.00405e29
test byte [0x42ec38], 0x80
je 0x4057d5
mov al, byte [edi]
test al, al
je 0x4057b8
cmp al, 0x5c
je 0x4057b8
sub edi, esi
jmp 0x4057ed
call fcn.00405ec2
test eax, eax
je 0x4057e7
test byte [eax], 0x10
je 0x4057b8
push esi
call fcn.00405701
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x4057d9
call fcn.004056ba
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x40587f
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40589b
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x40589e
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4058cd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405911
test edi, edi
jne 0x4058d8
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x40590b
Function at 0x405915
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 2
call fcn.00405f57
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405939
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405a72
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x42c230], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x42c230
je 0x40597d
push 1
push 0
push esi
call fcn.0040589e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405a78
cmp eax, edi
jg 0x405a78
mov esi, 0x42bca8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405a78
cmp eax, edi
jg 0x405a78
push esi
push ebp
push str._s_s_r_n
push 0x42b8a8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x42ec30]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405be9
push 4
push 0xc0000000
push esi
call fcn.0040589e
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405a72
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405a6b
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405a6b
cmp edi, dword [esp + 0x18]
jne 0x405a6b
push str._Rename__r_n
push esi
call fcn.00405813
test eax, eax
jne 0x405a7f
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405bc7
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x42b8a8
push eax
call fcn.0040585f
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x42ecb0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x4093e4
push eax
call fcn.00405813
test eax, eax
je 0x405a36
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405aa6
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405a9b
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405a38