joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5891da
Capabilities:
Encode data using xor

Disassembly:
enter 0x94b, 0x7a
pop esi
add eax, 0x2b1f747f
push eax
sbb byte [edi], bh
dec ecx
jp 0x5891cd
mov cs, word [esi - 0x2f]
xchg ebp, eax
fisub word [eax]
and dword ds:[ecx - 0x4d67854c], ebx
in eax, 0x5b
fldcw word [edi + 0x3f02cf74]
sub al, 0x1e
cmpsd dword [esi], dword es:[edi]
cmp eax, 0xaec0f72e
mov ch, byte [ebx]
jo 0x58920b
inc eax
aad 0x2a
int 0xbe
test edx, 0x4ff4b1c8
nop
in al, dx
lds ebp, [eax + 0x65]
jmp 0x589265
dec edi
and al, 0xae
pop eax
ficom word [esi + 0x6452c1ca]
mov dword [0xf3e8370c], eax
cmp dh, al
push eax
mov byte [0xadc632c4], al
adc cl, byte [edi]
dec ecx
dec esp
out 0xcb, al
in al, 0xdf
fld st(7)
sbb byte [edi], 0x10
scasd eax, dword es:[edi]
sahf
pop ebx
cwde
ficom dword [ebx + 0x17b825e5]
cwde
outsb dx, byte [esi]
add al, 0xcd
js 0x5892f7
mov ah, 0x13
mov bl, 0x2b
xor dword [edi + 0x48], ecx
mov esi, 0xd8a573c8
xor edi, esi
fdiv st(2)
fstp qword [eax + ebx*8 - 0x72]
stc
xor ch, byte [ebx]
cmp dh, byte [edi + ebx*8 + 0x39452c13]
push es
push cs
inc ebx
dec edx
mov ch, 0x87
dec edx
int 0x9b
sub eax, 0xa3b45988
mov eax, dword [0x7de846df]
pop esi
mov byte [ecx - 0x4c], bl
mov dword [0xe846dfa1], eax
jge 0x58932a
clc
sal ebx, 1
cwde
pop edx
das
sar byte [ebp + 0x6f684fb4], 0x6a
mov dh, 0x43
imul edx, dword [ecx], 0xb586690f
call ecx
mov edx, 0x1876f496
inc byte [edx - 0x236f1d26]
cdq
popal
or al, byte [eax + 0x6949f8f]
push es
cmp dword [ebx + 0x122b3e46], esi
outsb dx, byte [esi]
jo 0x5892c2
test al, 0x58
daa
sti
and esi, esi
xchg ebx, eax
or dword [eax - 0x590004e3], 0x51609778
pop es
dec esi
pop esi
add al, 0x79
not byte [eax + ecx*4]
xor edi, dword [esi]
jb 0x589315
pushal
adc byte [esp + edi*4], dh
pop ds
rcl ebx, 1
jg 0x589358
dec esi
lodsd eax, dword [esi]
sal byte [ebp + esi*2 + 0x744de18d], cl
mov dword [ebx + edx*4], eax
in al, 0xc6
das
cmc
loopne 0x589367
push esi
sar dword [ebp*8 - 0x4f6bf4d0], cl
ror cl, cl
add byte [ebx + esi], bl
fiadd dword [0x4f5f53b2]
outsd dx, dword [esi]
jmp 0x2c17b064
sbb eax, 0x82b82bbf
xchg edi, eax
adc al, 0x5f
jle 0x589329
invalid
int 0xb8
mov al, ah
jno 0x589392
and eax, 0xa0148f5d
push 0x3dae34b4
jecxz 0x5893ca
das
inc ebx
pop esi
imul edx, dword fs:[ebp + edi*2 - 0x2c], 0x27f5202b
out dx, al
pop ebp
fbld tbyte [edx + ebp*4 - 0xb]
mov eax, dword [0x8efe0dd7]
add eax, 0x506e64e2
outsb dx, byte fs:[esi]
push eax
mov al, byte [ecx]
cmp edx, edi
outsb dx, byte [esi]
inc esi
jnp 0x58931f
pop esi
pop edx
xchg dword [ebx - 0x2f], esp
dec edx
mov eax, dword [0x9ef45680]
loopne 0x589350
mov eax, dword [0xeabafa5d]
std
adc al, 0x27
adc eax, 0xc34efaf9
pop ebp
cmp al, 0x17
push esp
and eax, 0x783e4422
and byte [edx + 0x52c8979d], dl
jnp 0x589445
mov eax, dword [0xac811be6]
loope 0x58942f
out 0x1b, al
sub dword [ecx + 0x5fcd665f], 0xde9c22ec
lcall 0x4c56, 0xbe8de08
int 0x5f
in al, dx
and bl, byte [esi + ebx*8 - 0x1721f766]
or edx, dword [esi + 0x4c]
or eax, 0xb0433a42
invalid
xchg ecx, eax
jecxz 0x589461
xchg esi, eax
push 0x538da920
or bh, bh
std
push ecx
invalid
iretd
scasb al, byte es:[edi]
or ah, bl
cmc
pop edi
mov dh, 0x9e
outsd dx, dword [esi]
sbb ecx, dword [ecx]
invalid
Function at 0x5a7b0a
Capabilities:
Encode data using xor

Disassembly:
dec esp
adc edi, ebp
cmp dword [ebp + 0x6e], 0x55fa12e
out 0x82, eax
test eax, 0x58a2d47a
in eax, 0xf9
sub byte [ecx + 0x58a2d47a], 0xe5
stc
cwde
mov ecx, 0xfefb7f69
insb byte es:[edi], dx
xor eax, 0x3009a501
push esp
inc esi
xor edi, dword [esi]
inc ebx
mov edi, 0x12eb5ae6
or al, 0xb7
dec esp
js 0x5a7b15
sub dword [eax + ebp*2 + 0x7b], ecx
mul byte [ebp - 0xf]
inc ebp
invalid

Function at 0x5a8240
Capabilities:
Encode data using xor

Disassembly:
test dword [edx + 0x3489ee9d], eax
mov bl, 0xce
add eax, 0x2b7fc8f5
stosb byte es:[edi], al
mov eax, 0x5de0bb5
das
ror dword [esi - 0x50ee64e1], 0x2a
cmp dl, bh
out 0x76, eax
xchg edx, eax
cmp ah, byte [ebx - 0x25]
psubsw mm3, qword [ecx - 0x1ae004c]
inc ebx
pop edi
imul ecx, dword [ebx - 0x6f9958b0], 0x57
nop
push edi
cmp al, 0x17
test eax, 0xdeb7b91
jbe 0x5a82b5
stc
imul ebx, dword [ecx], 0xffffffbc
scasd eax, dword es:[edi]
out 0x8f, eax
xor byte [ebx], cl
leave
lodsb al, byte [esi]
push esp
xor eax, 0xddf1a364
call 0x3ab788b0
inc edi
ja 0x5a8271
sahf
retf 0x48a6
invalid

Function at 0x5cf899
Capabilities:
Encode data using xor

Disassembly:
sub byte [ecx - 0xf], 0x78
popal
insd dword es:[edi], dx
sbb esp, dword [ebp + 0x2dd5b610]
push esi
dec ebp
ret 0x4c6d
jne 0x5cf819
xor dword [0xd1770fd3], ebp
test dword [esi - 0x25], 0xff2c3b9c
mov ah, 0x94
add bl, cl
invalid

Function at 0x5d95eb
Capabilities:
Encode data using xor

Disassembly:
test byte [ecx + ecx], 0xb7
das
push ebx
add dword [edi + 0x67], eax
jmp 0x5d955f
push cs
lodsd eax, dword [esi]
rol ebp, 0x4d
rcl dword [bx + di - 0x1024]
mov dh, bh
sal dword [edi + 0x23], 1
pop es
insd dword es:[edi], dx
push es
mov edi, 0x355e7b29
inc ecx
arpl word [eax - 0x2f4b6dcb], ax
retf
jo 0x5d95b3
ja 0x5d9535
mov edi, 0x7e71e37
xchg ebp, eax
scasd eax, dword es:[edi]
int 0x8e
call gs:[ecx - 0x68b58867]
adc ch, dl
xor dword [eax + 0x23667560], esp
lcall 0x57f3, 0xf5d58bc5
jne 0x5d961b
and ebx, dword [edx - 0xa2a743b]
push edi
pmuludq mm6, qword [edi]
add ax, 0x9385
mul dword [eax]
jbe 0x5d95f3
neg dl
pop es
push 0x44dcf5c7
xchg esp, eax
jge 0x5d95fa
cmpsb byte [esi], byte es:[edi]
add al, byte [eax - 0x3a]
popfd
xchg ebp, eax
sbb esi, dword [edi]
or eax, 0x8d557dc1
insd dword es:[edi], dx
iretd
and dword [edx], eax
mov al, byte [0x54a231b5]
daa
cmp esi, dword [edx + 0x39939762]
pop ss
test dword [edi + 0x35767b18], edi
xchg esi, eax
jno 0x5d959a
push esi
mov byte [0x1fa5878d], al
add al, 0xf2
push 0x9e57b839
cmp eax, ebp
or eax, dword [esi - 0x23]
cwde
in eax, 0xcb
jae 0x5d962f
mov ch, 0x5b
pop ebx
sbb al, 0x76
mov ebx, 0xbaee4505
Function at 0x60a7ad
Capabilities:
Access peb ldr_data

Disassembly:
add byte [eax - 0x7d], dl
in al, dx
adc byte [ebx + 0x56], dl
push edi
mov eax, dword [0x590630]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x30]
mov esi, dword [eax + 0x10]
add esi, dword [eax + 0xc]
mov edx, dword [edi + 0x290]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
push ecx
push 0x470
xor ebx, ebx
push edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x20], ebx
call dword [0x540884]
mov eax, dword [esp + 0x30]
cmp esi, eax
jge 0x60a803
mov esi, eax
mov eax, dword [esp + 0x10]
cmp esi, eax
jle 0x60a80d
mov esi, eax
call fcn.00623088
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x60a827
push 0x80004005
call fcn.006047c1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push ebx
mov eax, esi
cdq
push 0x7d8200
push edx
push eax
mov dword [esp + 0x38], ebx
call 0x71bbd1
mov dword [esp + 0x18], eax
mov eax, edx
and edx, 0x7fffffff
mov dword [esp + 0x1c], edx
fild qword [esp + 0x18]
and eax, 0x80000000
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
fild qword [esp + 0x18]
sub esp, 8
lea ecx, [esp + 0x1c]
fchs
faddp st(1)
fld qword [0x56dfe8]
fmul st(1), st(0)
fmulp st(1)
fstp qword [esp]
push 0x56b964
push ecx
call fcn.006057b1
mov esi, dword [esp + 0x24]
add esp, 0x10
push esi
lea ecx, [edi + 0x21c]
call fcn.006205da
mov edx, dword [esp + 0x34]
lea eax, [esi - 0x10]
mov dword [edx], ebx
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x60a8d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x63affd
Capabilities:
Encode data using xor

Disassembly:
popfd
std
sbb ch, dl
adc byte [0x1de06465], al
test dword [esi - 0x2a9172a0], edi
adc ecx, esp
push ebp
loope 0x63af30
loope 0x63af51
add byte [esi - 0x13], ah
fsub dword [eax + edx*8]
mov ah, 0x35
mov dl, 0xa4
add dword [eax - 0x63e26edb], eax
push ebx
add byte [ebp + edx*4 + 0x34a10545], 0x8d
pop ds
xchg ebx, eax
dec ebp
movsd dword es:[edi], dword [esi]
mov al, byte [0x27f1b785]
xchg ebp, eax
push ebp
jo 0x63aec8
and dword [ebp + ebx*2 + 0x252113e3], esi
add al, 0x61
aad 0x51
in al, 0xcd
adc al, 0x66
adc byte [esi - 0x6ddd128e], dh
add byte [eax - 0x7adf0b3b], dh
sti
xchg esp, eax
fldcw word [ecx]
shl byte [eax + 0x11], 0xa4
sbb al, 0xdc
and al, 0x2f
xor edx, 0x89897805
js 0x63af8c
add eax, 0x78898978
pop ecx
mov dword [eax + 0x59], edi
test al, 0x62
xchg ebx, eax
jp 0x63aed9
push esp
ljmp 0x2a
adc dword [ecx], edx
xor al, 0xc5
jo 0x63af8a
push edi
loop 0x63aee0
loope 0x63afa1
sbb al, 0xa5
invalid
loopne 0x63af79
nop
outsd dx, dword [esi]
aam 0x3d
shl dword fs:[ebp + 0x41], 0xc
lcall 0x8182, 0xa3751754
aad 0xee
mov dword [0xeed58182], eax
out dx, al
dec esp
mov ch, 0x35
mov byte [0x74bdaf30], al
sal byte [ebp - 2], 1
lahf
jne 0x63af89
lds esi, [ecx + 0x2b]
jno 0x63afb6
sub esi, eax
invalid
clc
xchg byte [eax + 0x4ee54596], dl
mov bl, 0x61
invalid
fild word [esp + ebx + 0x1cfde53a]
fidiv dword [eax - 0x7f]
cmp ah, ch
std
sbb al, 0xda
jo 0x63af2c
jo 0x63af8c
test byte [ebx + 0x77d0c88d], dl
or byte [0x3a606480], dl
stc
pushal
cmp bh, cl
adc eax, 0x2324d748
invalid
mov bl, 0x58
dec ecx
clc
jnp 0x63af75
mov cl, 0x44
stosd dword es:[edi], eax
pushfd
dec esp
ja 0x63af66
ror dword [eax + 0x22], 0xf2
and edi, dword [eax - 0x2b]
les esi, [0x552fb7ca]
jo 0x63afa4
test byte [ecx - 0x16], al
push esp
cmpsb byte [esi], byte es:[edi]
push ebp
mov edi, 0x3c1b5a29
jmp 0x63b00d
cmp al, 0xeb
adc eax, 0xe57c0cca
mov ah, 0xbf
mov ah, 0xbf
mov ah, 0xbf
pop es
salc
sub eax, 0x58427d4
sbb eax, esi
test byte [ebp - 0x4fd6d4f], cl
sti
mov esp, 0x3e44d350
inc esp
and eax, 0xea527058
adc bl, byte [ebx]
xor al, 0xb1
sub cl, cl
jecxz 0x63aff5
mov edx, 0x2a05153b
ror dword [ebx + 0x7b], 1
mov esp, 0xdc9be994
mov byte [0xaa6b3ae5], al
mov ah, 0x63
mov dword [ebx - 0x4fa36f7], ebp
adc al, 0x92
test byte [ebp - 0x2fec1a19], ch
xor ah, byte [ebp - 0x7a8836d5]
sal byte [edx], 1
movsd dword es:[edi], dword [esi]
sub ecx, ecx
ja 0x63afce
jns 0x63b042
test dword [ecx + eax*2 + 0x5e], esp
dec esi
push esi
push ebp
ret 0x7cee
Function at 0x9c8400
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x7e0015
lea edi, [esi - 0x3df015]
mov dword [edi + 0x58d36c], 0x42142c14
push edi
or ebp, 0xffffffff
jmp 0x9c842a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9c8431
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c8420
mov eax, 1
add ebx, ebx
jne 0x9c8443
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9c8454
jne 0x9c8473
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c8473
dec eax
add ebx, ebx
jne 0x9c8460
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x9c8438
add ebx, ebx
jne 0x9c846f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x9c84c5
xor ecx, ecx
sub eax, 3
jb 0x9c848b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9c84fa
sar eax, 1
mov ebp, eax
jmp 0x9c8496
add ebx, ebx
jne 0x9c8496
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c8464
inc ecx
add ebx, ebx
jne 0x9c84a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c8464
add ebx, ebx
jne 0x9c84b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9c84a6
jne 0x9c84c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9c84a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9c84e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9c84d6
jmp 0x9c8426
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9c84e4
add edi, ecx
jmp 0x9c8426
pop esi
mov edi, esi
mov ecx, 0x18feb
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9c8502
cmp byte [edi], 0x26
jne 0x9c8502
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9c8507
lea edi, [esi + 0x5b4000]
mov eax, dword [edi]
or eax, eax
je 0x9c8576
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5c8000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5c80fc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9c8534
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5c8104]
or eax, eax
je 0x9c8570
mov dword [ebx], eax
add ebx, 4
jmp 0x9c8551
call dword [esi + 0x5c8100]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x9c85a7
cmp al, 0xef
ja 0x9c859a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x9c857c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x9c8589
mov ebp, dword [esi + 0x5c8108]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x5c8602]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9c85f3
sub esp, 0xffffff80
jmp 0x4014c0
Function at 0x405160
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x48414c
call fcn.00483210
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov edi, ecx
call fcn.00407a39
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x405195
push dword [ebp - 0x10]
push edi
call esi
test eax, eax
je 0x405195
mov al, 1
jmp 0x4051df
test ebx, ebx
je 0x4051dd
lea ecx, [ebp - 0x1c]
call fcn.00402a8d
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x1c]
mov ecx, edi
call fcn.00407b42
test al, al
je 0x4051d4
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call esi
mov esi, eax
push dword [ebp - 0x1c]
call fcn.00401bf2
test esi, esi
pop ecx
setne al
jmp 0x4051df
push dword [ebp - 0x1c]
call fcn.00401bf2
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4051ee
Capabilities:
Delete directory

Disassembly:
mov eax, 0x484160
call fcn.00483210
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407a39
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x40521d
push edi
call esi
test eax, eax
je 0x40521d
mov al, 1
jmp 0x405261
test ebx, ebx
je 0x40525f
lea ecx, [ebp - 0x18]
call fcn.00402a8d
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.00407b42
test al, al
push dword [ebp - 0x18]
je 0x405259
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401bf2
test esi, esi
pop ecx
setne al
jmp 0x405261
call fcn.00401bf2
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40543b
Capabilities:
Create directory

Disassembly:
mov eax, 0x4841ac
call fcn.00483210
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407a39
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x405479
push 0
push edi
call esi
test eax, eax
je 0x40546c
mov al, 1
jmp 0x4054c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4054c0
test ebx, ebx
je 0x4054c0
lea ecx, [ebp - 0x18]
call fcn.00402a8d
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.00407b42
test al, al
je 0x4054b7
push 0
push dword [ebp - 0x18]
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401bf2
test esi, esi
pop ecx
setne al
jmp 0x4054c2
push dword [ebp - 0x18]
call fcn.00401bf2
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x405612
Capabilities:
Create directory

Disassembly:
mov eax, 0x4841ef
call fcn.00483210
sub esp, 0x7c
push ebx
push esi
push edi
mov esi, ecx
call fcn.00407a39
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 1
je 0x405657
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40564a
mov al, 1
jmp 0x40573a
call ebx
cmp eax, 0xb7
je 0x4056eb
test edi, edi
je 0x4056eb
lea ecx, [ebp - 0x18]
call fcn.00402a8d
and dword [ebp - 4], 0
cmp edi, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, esi
call fcn.00407b42
test al, al
je 0x4056de
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x405693
mov bl, 1
jmp 0x4056d9
call ebx
cmp eax, 0xb7
je 0x4056a0
xor bl, bl
jmp 0x4056d9
lea ecx, [ebp - 0x50]
call fcn.00406145
lea ecx, [ebp - 0x28]
call fcn.00402a8d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.004061e5
test al, al
jne 0x4056c7
xor bl, bl
jmp 0x4056d0
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.00401bf2
pop ecx
push dword [ebp - 0x18]
jmp 0x405732
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.00401bf2
pop ecx
call ebx
cmp eax, 0xb7
je 0x4056f8
xor al, al
jmp 0x40573a
lea ecx, [ebp - 0x88]
call fcn.00406145
lea ecx, [ebp - 0x60]
call fcn.00402a8d
push esi
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], 2
call fcn.004061e5
test al, al
jne 0x405726
xor bl, bl
jmp 0x40572f
mov ebx, dword [ebp - 0x68]
shr ebx, 4
and bl, 1
push dword [ebp - 0x60]
call fcn.00401bf2
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405749
Capabilities:
Delete file

Disassembly:
mov eax, 0x484204
call fcn.00483210
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00406168
cmp eax, 0xffffffff
je 0x40577d
test al, 0x10
jne 0x40577d
test al, 1
je 0x40577d
mov edx, eax
mov ecx, edi
and edx, 0xfffffffe
call fcn.00405160
test al, al
je 0x4057de
mov ecx, edi
call fcn.00407a39
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
cmp ebx, 1
je 0x40579c
push edi
call esi
test eax, eax
je 0x40579c
mov al, 1
jmp 0x4057e0
test ebx, ebx
je 0x4057de
lea ecx, [ebp - 0x18]
call fcn.00402a8d
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.00407b42
test al, al
push dword [ebp - 0x18]
je 0x4057d8
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401bf2
test esi, esi
pop ecx
setne al
jmp 0x4057e0
call fcn.00401bf2
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x406168
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x4842d8
call fcn.00483210
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407a39
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x406194
push edi
call esi
cmp eax, 0xffffffff
jne 0x4061d6
test ebx, ebx
je 0x4061d3
lea ecx, [ebp - 0x18]
call fcn.00402a8d
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.00407b42
test al, al
push dword [ebp - 0x18]
je 0x4061cd
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401bf2
pop ecx
mov eax, esi
jmp 0x4061d6
call fcn.00401bf2
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x406800
Capabilities:
Get disk information

Disassembly:
mov eax, 0x48437c
call fcn.00483210
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.00425ac0
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
je 0x4068c0
lea eax, [ebx + ebx]
push eax
call fcn.00401bcb
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov edi, eax
test edi, edi
mov dword [ebp - 0x10], edi
je 0x4068b9
cmp edi, ebx
ja 0x4068b9
lea ecx, [ebp - 0x2c]
call fcn.00402a8d
xor eax, eax
xor ebx, ebx
cmp edi, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
jbe 0x4068a1
push 2
pop edi
cmp word [esi + edi - 2], 0
jne 0x406896
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.00402b82
mov ecx, dword [ebp - 0x18]
lea eax, [ebx + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], edi
call fcn.00401511
mov eax, edi
inc ebx
inc edi
inc edi
cmp ebx, dword [ebp - 0x10]
jb 0x40686c
mov edi, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00401bf2
push esi
call fcn.00401bf2
cmp dword [ebp - 0x14], edi
pop ecx
pop ecx
sete al
jmp 0x4068c2
push esi
call fcn.00401bf2
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4069a3
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ecx + 4], 0
push esi
je 0x4069c4
cmp byte [ecx + 5], 0
je 0x4069c4
mov eax, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [eax], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 4], ecx
jmp 0x406a03
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4069e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4069e5
xor al, al
jmp 0x406a05
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00483550
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x418538
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x485387
call fcn.00483210
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00402a8d
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.00402a8d
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402a8d
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00402a8d
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00402a8d
and byte [esi + 0x3c], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
call fcn.00402a8d
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 5
call fcn.00402a8d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x418d93
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4854d7
call fcn.00483210
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00402b14
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00402b14
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00402b14
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.00402b14
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.00402b14
mov al, byte [edi + 0x3c]
lea ecx, [esi + 0x40]
mov byte [esi + 0x3c], al
lea eax, [edi + 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.00402b14
add edi, 0x4c
lea ecx, [esi + 0x4c]
push edi
mov byte [ebp - 4], 5
call fcn.00402b14
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x41e2cf
Capabilities:
Encode data using xor

Disassembly:
push esi
or eax, 0xffffffff
xor esi, esi
test edx, edx
jbe 0x41e2fc
push ebx
push edi
movzx edi, byte [esi + ecx]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x4a34a0]
xor eax, edi
inc esi
cmp esi, edx
jb 0x41e2db
pop edi
pop ebx
not eax
pop esi
ret