joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e002
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x43f520]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41e045
cmp word [esi], dx
jne 0x41e045
or byte [edi + eax + 0x28], 4
jmp 0x41e04a
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41e19d
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41e17d
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41e08c
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41e0c2
cmp eax, edx
jae 0x41e0ce
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41e064
jmp 0x41e19d
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41e179
cmp dword [ebp - 0x14], 0
je 0x41e179
mov eax, dword [ebx*4 + 0x43f520]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41e151
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41e11a
mov word [esi], cx
jmp 0x41e14d
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x43f520]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x43f520]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x43f520]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41e19d
pop ebx
cmp word [ebp - 4], bx
jne 0x41e162
cmp esi, dword [ebp + 0xc]
jne 0x41e162
mov word [esi], bx
jmp 0x41e19a
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041c74c
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41e19d
push 0xd
jmp 0x41e196
mov ecx, dword [ebx*4 + 0x43f520]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41e194
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41e19d
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x421507
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4351c4
push 0x4351bc
push str.FlsAlloc
push 0x1e
call fcn.00421388
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42153b
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d318]
call esi
jmp 0x421541
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x421585
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4351d4
push 0x4351cc
push str.FlsGetValue
push 0x20
call fcn.00421388
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4215bc
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d318]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x421a94
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00421905
Function at 0x424697
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00424613
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x42480f
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x42480f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4247be
jg 0x4246f0
test eax, eax
je 0x4247b4
push 1
push 0x1000
call fcn.00422087
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x424716
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x4247ab
push 0x8000
push ebx
call fcn.0041d55b
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x424742
jg 0x42473d
cmp ecx, 0x1000
jb 0x424742
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0041f11c
add esp, 0x10
cmp eax, 0xffffffff
je 0x424787
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x42473d
jl 0x42476e
test ecx, ecx
jne 0x42472f
push dword [ebp - 0xc]
push ebx
call fcn.0041d55b
push esi
call fcn.004204ff
add esp, 0xc
xor edi, edi
jmp 0x424820
cmp byte [edi + 0x24], 0
je 0x42479e
cmp dword [edi + 0x20], 5
jne 0x42479e
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4247a9
mov edi, dword [edi + 0x18]
jmp 0x4247ab
xor edi, edi
push esi
call fcn.004204ff
pop ecx
jmp 0x424820
test ecx, ecx
jg 0x424780
jl 0x4247be
test eax, eax
jae 0x424780
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041c74c
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4247e1
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x424780
jmp 0x424818
push ebx
call fcn.004233cd
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x424780
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x424820
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x42481d
mov edi, dword [edi + 0x18]
jmp 0x424820
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0041c74c
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x424b8c
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x43c058]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x424bd7
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00424d2b
test al, al
jne 0x424bd1
sub edx, 2
cmp edx, edi
jne 0x424bb7
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x424bf9
lea eax, [edi + 2]
cmp edx, eax
je 0x424bf9
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00424ad8
add esp, 0x10
jmp 0x424cf3
push esi
lea ecx, [ebp - 0x255]
call fcn.00424d2b
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x424c3c
push dword [ebp - 0x25c]
jmp 0x424be9
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x424c79
cmp word [ebp - 0x226], 0
je 0x424c9a
cmp word [ebp - 0x226], ax
jne 0x424c79
cmp word [ebp - 0x224], 0
je 0x424c9a
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00424ad8
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x424ce6
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x424c53
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x424cce
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x424cf3
push 0x424908
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004291a0
add esp, 0x10
jmp 0x424cc3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412fe2
leave
ret

Function at 0x425617
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x425628
pop esi
ret
push ebx
push edi
push esi
call fcn.004255e0
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00420539
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x425650
push ebx
push esi
push edi
call fcn.00413650
add esp, 0xc
push 0
call fcn.004204ff
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x425a14
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00425665
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x416c4f0f
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x49014397
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4015f3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x401625
test dl, 7
je 0x401625
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x432d70]
inc edx
mov dword [ebp + 0xc], edx
sub esi, 1
jne 0x401605
cmp esi, 8
jb 0x4016b5
push edi
mov edi, esi
shr edi, 3
xor ebx, dword [edx]
sub esi, 8
mov edx, dword [edx + 4]
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
movzx eax, al
mov ecx, dword [ecx*4 + 0x432d70]
xor ecx, dword [eax*4 + 0x433170]
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x433570]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x433d70]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x434170]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x434570]
movzx eax, dl
mov edx, dword [ebp + 0xc]
add edx, 8
mov dword [ebp + 0xc], edx
xor ecx, dword [eax*4 + 0x433970]
movzx eax, bl
xor ecx, dword [eax*4 + 0x434970]
mov ebx, ecx
sub edi, 1
jne 0x401634
pop edi
test esi, esi
je 0x4016d1
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x432d70]
inc edx
sub esi, 1
jne 0x4016b9
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x401d0e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 1
jne 0x401d27
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401d9a
mov ecx, esi
call fcn.00401e1d
test al, al
je 0x401d62
mov eax, 0x4e20
cmp dword [ebp + 0xc], eax
jbe 0x401d62
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.00401d0e
jmp 0x401d9d
cmp dword [esi + 0xc], 1
jne 0x401d77
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x401d77
xor eax, eax
jmp 0x401d9d
cmp dword [esi + 0xc], 0
jne 0x401d95
mov edi, 0x8000
cmp dword [ebp + 0xc], edi
jbe 0x401d95
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x401d95
push edi
jmp 0x401d56
or eax, 0xffffffff
jmp 0x401d9d
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x401e50
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1054
call fcn.00413500
push ebx
mov ebx, dword [esp + 0x1060]
push ebp
push edi
mov edi, ecx
and dword [edi + 0x1024], 0
cmp byte [edi + 0x22], 0
jne 0x401e7c
test bl, 4
jne 0x401e7c
xor cl, cl
jmp 0x401e7e
mov cl, 1
mov eax, ebx
shr eax, 1
push esi
and al, 1
movzx esi, al
neg esi
sbb esi, esi
and esi, 0xc0000000
add esi, 0x80000000
test bl, 1
je 0x401ea3
or esi, 0x40000000
shr ebx, 3
not ebx
and ebx, 1
test cl, cl
je 0x401eb2
or ebx, 2
xor eax, eax
lea ecx, [esp + 0x1c]
cmp byte [edi + 0x1b], al
setne al
dec eax
and eax, 0x8000000
mov dword [esp + 0x10], eax
call fcn.00401aed
cmp byte [edi + 0x20], 0
je 0x401ed9
or esi, 0x100
push 0
push dword [esp + 0x14]
push 3
push 0
push ebx
push esi
push dword [esp + 0x1080]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x401f5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push 0x800
push eax
push dword [esp + 0x1070]
call fcn.00403444
test al, al
je 0x401f4a
push 0
push dword [esp + 0x14]
lea eax, [esp + 0x24]
push 3
push 0
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x401f45
mov dword [esp + 0x14], eax
cmp ebp, 0xffffffff
jne 0x401f5b
cmp dword [esp + 0x14], 2
jne 0x401f5b
mov dword [edi + 0x1024], 1
cmp byte [edi + 0x20], 0
pop esi
je 0x401f81
cmp ebp, 0xffffffff
je 0x401f81
or dword [esp + 0x10], 0xffffffff
lea eax, [esp + 0x10]
or dword [esp + 0x14], 0xffffffff
push 0
push eax
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
xor eax, eax
cmp ebp, 0xffffffff
mov byte [edi + 0x18], al
setne bl
mov dword [edi + 0xc], eax
mov byte [edi + 0x10], al
cmp ebp, 0xffffffff
je 0x401fb3
push 0x800
push dword [esp + 0x1068]
lea ecx, [edi + 0x24]
mov dword [edi + 4], ebp
push ecx
call fcn.004067b8
mov byte [edi + 0x21], 0
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 0x1054
ret 8
Function at 0x40232f
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov ebx, ecx
test ebp, ebp
jne 0x402344
mov al, 1
jmp 0x402448
cmp dword [ebx + 0xc], 1
jne 0x402355
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebx + 4], eax
push esi
push edi
mov edi, 0x4000
and dword [esp + 0x10], 0
cmp dword [ebx + 0xc], 0
mov byte [esp + 0x14], 0
je 0x4023a9
xor esi, esi
test ebp, ebp
je 0x4023cd
mov eax, ebp
sub eax, esi
cmp eax, edi
jb 0x40237c
mov eax, edi
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esp + 0x28]
add eax, esi
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec eax
neg eax
sbb al, al
add al, 1
mov dword [esp + 0x14], eax
je 0x4023cd
add esi, edi
cmp esi, ebp
jb 0x402372
jmp 0x4023c9
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push dword [esp + 0x28]
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec eax
neg eax
sbb al, al
inc al
mov dword [esp + 0x14], eax
test al, al
jne 0x40243e
cmp byte [ebx + 0x1a], 0
je 0x40243e
cmp dword [ebx + 0xc], 0
jne 0x40243e
push 0
lea esi, [ebx + 0x24]
mov ecx, 0x451b74
push esi
call fcn.004017f9
test al, al
je 0x402431
cmp dword [esp + 0x10], ebp
jae 0x40235c
cmp dword [esp + 0x10], 0
jbe 0x40235c
mov edi, dword [ebx]
push 0
mov esi, dword [edi + 0x14]
mov ecx, esi
call dword [0x428220]
mov ecx, ebx
call esi
sub eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x10]
sbb edx, 0
push edx
push eax
call dword [0x428220]
mov ecx, ebx
call dword [edi + 0x10]
jmp 0x402357
push esi
push 0
mov ecx, 0x451b74
call fcn.00401a44
mov al, byte [esp + 0x14]
pop edi
mov byte [ebx + 8], 1
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 8

Function at 0x402594
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00413500
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4025d9
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.00403444
test al, al
je 0x4025d9
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x402616
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00413500
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00403753
movzx eax, word [eax]
cmp eax, 0x2e
je 0x402647
cmp eax, 0x20
je 0x402647
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40267a
push esi
call fcn.00402580
test al, al
jne 0x40268d
push 0x800
lea eax, [ebp - 0x1000]
push eax
push esi
call fcn.00403444
test al, al
je 0x40268d
push 0
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40268d
cmp byte [ebp + 0xc], 0
je 0x402689
push dword [ebp + 0x10]
push esi
call fcn.00402853
xor eax, eax
jmp 0x4026a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4026a2
cmp eax, 3
je 0x4026a2
xor eax, eax
inc eax
jmp 0x4026a5
push 2
pop eax
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x402853
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00413500
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test bl, bl
jne 0x4028a3
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.00403444
test al, al
je 0x4028a3
push dword [ebp + 0xc]
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x402a03
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov eax, 0x1250
call fcn.00413500
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1260]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x126c]
or ebx, 0xffffffff
mov ebp, 0x800
push eax
cmp esi, ebx
jne 0x402aa0
push dword [esp + 0x126c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, ebx
jne 0x402ac7
push ebp
lea eax, [esp + 0x264]
push eax
push dword [esp + 0x1270]
call fcn.00403444
test al, al
je 0x402a79
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, ebx
jne 0x402ac7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x402a93
cmp eax, 3
je 0x402a93
cmp eax, 0x12
je 0x402a93
xor eax, eax
inc eax
jmp 0x402a95
xor eax, eax
mov byte [edi + 0x1044], al
jmp 0x402b70
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402abf
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [edi + 0x1044], al
cmp esi, ebx
je 0x402b70
push ebp
push dword [esp + 0x126c]
push edi
call fcn.004067b8
push ebp
lea eax, [esp + 0x40]
push eax
push edi
call fcn.0040382a
mov ecx, dword [esp + 0x2c]
xor eax, eax
add eax, dword [esp + 0x30]
mov dword [edi + 0x1000], eax
mov eax, dword [esp + 0x10]
adc ecx, 0
mov dword [edi + 0x1008], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 0x1028], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x102c], eax
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x1030], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0x1034], eax
mov eax, dword [esp + 0x24]
mov dword [edi + 0x1038], eax
mov eax, dword [esp + 0x28]
mov dword [edi + 0x103c], eax
lea eax, [esp + 0x24]
mov dword [edi + 0x1004], ecx
lea ecx, [edi + 0x1010]
push eax
call fcn.00407268
lea eax, [esp + 0x14]
push eax
lea ecx, [edi + 0x1018]
call fcn.00407268
lea eax, [esp + 0x1c]
push eax
lea ecx, [edi + 0x1020]
call fcn.00407268
and dword [edi + 0x1040], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1250
ret 0xc
Function at 0x403444
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00413500
push esi
mov esi, dword [ebp + 8]
cmp word [esi], 0
jne 0x403462
xor al, al
jmp 0x4035cc
push ebx
push edi
push esi
call fcn.004035d3
push esi
call fcn.004187c3
pop ecx
push esi
mov edi, eax
call fcn.004035ff
test al, al
je 0x4034f4
push esi
call fcn.004035d3
test al, al
je 0x4034ab
lea eax, [edi + 4]
cmp dword [ebp + 0x10], eax
jbe 0x4035c8
push dword [ebp + 0x10]
push 0x4285a8
push dword [ebp + 0xc]
call fcn.004067b8
push dword [ebp + 0x10]
jmp 0x4035bb
push 0x5c
pop eax
cmp word [esi], ax
jne 0x4035c8
lea ebx, [esi + 2]
cmp word [ebx], ax
jne 0x4035c8
mov esi, dword [ebp + 0x10]
lea eax, [edi + 6]
cmp esi, eax
jbe 0x4035c8
push esi
push 0x4285a8
push dword [ebp + 0xc]
call fcn.004067b8
push esi
push 0x4285b4
push dword [ebp + 0xc]
call fcn.00406790
push esi
push ebx
jmp 0x4035bc
lea eax, [ebp - 0x1000]
mov ebx, 0x7ff
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4035c8
cmp eax, ebx
ja 0x4035c8
movzx eax, word [esi]
push eax
call fcn.00403635
test al, al
je 0x40355b
lea eax, [edi + 6]
mov edi, dword [ebp + 0x10]
cmp edi, eax
jbe 0x4035c8
push edi
push 0x4285a8
push dword [ebp + 0xc]
call fcn.004067b8
xor eax, eax
mov word [ebp - 0xffc], ax
lea eax, [ebp - 0x1000]
push edi
push eax
push dword [ebp + 0xc]
call fcn.00406790
jmp 0x4035ba
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.00403071
lea eax, [ebp - 0x1000]
push eax
call fcn.004187c3
add edi, 4
add eax, edi
mov edi, dword [ebp + 0x10]
pop ecx
cmp edi, eax
jbe 0x4035c8
push edi
push 0x4285a8
push dword [ebp + 0xc]
call fcn.004067b8
push edi
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 0xc]
call fcn.00406790
cmp word [esi], 0x2e
jne 0x4035ba
movzx eax, word [esi + 2]
push eax
call fcn.00403635
test al, al
je 0x4035ba
add esi, 4
push edi
push esi
push dword [ebp + 0xc]
call fcn.00406790
mov al, 1
jmp 0x4035ca
xor al, al
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405405
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ecx
cmp dword [esp + 0xc], 0
movups xmm1, xmmword [ecx + 8]
push esi
mov esi, dword [esp + 0xc]
push edi
lea edi, [ecx + 0x18]
jbe 0x405480
mov edx, dword [esp + 0x18]
mov eax, esi
add esi, 0x10
cmp byte [ecx + 1], 0
movups xmm0, xmmword [eax]
je 0x405430
pxor xmm0, xmm1
movups xmm1, xmmword [edi]
mov eax, dword [ecx + 4]
pxor xmm1, xmm0
cmp eax, 1
jle 0x405462
lea edx, [edi + 0x10]
lea edi, [eax - 1]
mov dword [esp + 8], edi
lea edi, [ecx + 0x18]
sub dword [esp + 8], 1
movups xmm0, xmmword [edx]
lea edx, [edx + 0x10]
aesenc xmm1, xmm0
jne 0x40544c
mov edx, dword [esp + 0x18]
add eax, eax
movups xmm0, xmmword [edi + eax*8]
mov eax, edx
add edx, 0x10
sub dword [esp + 0x14], 1
aesenclast xmm1, xmm0
mov dword [esp + 0x18], edx
movups xmmword [eax], xmm1
jne 0x40541e
pop edi
movups xmmword [ecx + 8], xmm1
pop esi
pop ecx
ret 0xc

Function at 0x40548a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebp
push edi
mov ebp, ecx
xor edi, edi
inc edi
mov dword [esp + 0x14], ebp
mov dword [esp + 8], edi
cmp dword [ebp + 4], edi
jle 0x405538
push ebx
lea ebx, [ebp + 0x28]
push esi
mov dword [esp + 0x14], ebx
lea eax, [ebx + 2]
xor esi, esi
mov dword [esp + 0x18], eax
lea edi, [esp + 0x20]
mov ebp, eax
push 4
add edi, esi
pop ebx
movzx eax, byte [ebp + 1]
movzx ecx, byte [ebp - 1]
mov dl, byte [esi + eax*4 + 0x43bbe0]
movzx eax, byte [ebp - 2]
xor dl, byte [esi + ecx*4 + 0x43b3e0]
xor dl, byte [esi + eax*4 + 0x43afe0]
movzx eax, byte [ebp]
lea ebp, [ebp + 4]
xor dl, byte [esi + eax*4 + 0x43b7e0]
mov byte [edi], dl
lea edi, [edi + 4]
sub ebx, 1
jne 0x4054c2
mov eax, dword [esp + 0x18]
inc esi
cmp esi, 4
jl 0x4054b7
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push 0x10
push eax
push ebx
call fcn.00414d90
mov edi, dword [esp + 0x1c]
add esp, 0xc
mov ebp, dword [esp + 0x1c]
inc edi
add ebx, 0x10
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
cmp edi, dword [ebp + 4]
jl 0x4054ae
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x20
ret