joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b86c0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov eax, dword [ebp - 4]
call fcn.00404a8c
mov eax, dword [ebp + 8]
call fcn.00404a8c
xor eax, eax
push ebp
push 0x4b8812
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004048a4
add eax, 2
call fcn.0040274c
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
call fcn.004048a4
add eax, 2
call fcn.0040274c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b87ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004048a4
mov edx, eax
add edx, 2
mov eax, dword [ebp - 8]
xor ecx, ecx
call fcn.00403030
mov eax, dword [ebp + 8]
call fcn.004048a4
mov edx, eax
add edx, 2
mov eax, dword [ebp - 0xc]
xor ecx, ecx
call fcn.00403030
mov eax, dword [ebp - 4]
call fcn.00404a9c
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.004093b8
mov eax, dword [ebp + 8]
call fcn.00404a9c
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004093b8
mov dword [ebp - 0x2a], ebx
mov dword [ebp - 0x26], 2
mov eax, 0x4b8820
mov dword [ebp - 0x22], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x22], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1e], eax
mov word [ebp - 0x1a], 0x18
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2a]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
je 0x4b87b5
call fcn.0040dc04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b87f4
mov eax, dword [ebp - 4]
call fcn.004048a4
mov edx, eax
add edx, 2
mov eax, dword [ebp - 8]
call fcn.0040276c
mov eax, dword [ebp + 8]
call fcn.004048a4
mov edx, eax
add edx, 2
mov eax, dword [ebp - 0xc]
call fcn.0040276c
ret
Function at 0x404938
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x43ea38], 2
push esi
push edi
mov edi, eax
mov esi, ecx
jl 0x40494c
call fcn.004037c5
mov ecx, esi
call fcn.00404915
xor eax, eax
mov edx, dword [eax + 0x425308]
mov ecx, dword [esi + 0xf4]
mov dword [eax + ecx], edx
add eax, 4
cmp eax, 0x20
jl 0x404955
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov eax, dword [esi + 0xf4]
mov ecx, dword [esp + 0xc]
xor dword [eax + 8], ecx
mov esi, dword [esi + 0xf4]
or edi, 0x2000
shl edi, 0x10
xor dword [esi + 0xc], edi
pop edi
pop esi
ret 4
Function at 0x40573c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
push edi
push 0x400
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
call fcn.0040f250
call fcn.00419f62
add eax, 0x20
xor ebx, ebx
cmp dword [ebp + 8], eax
jne 0x405773
cmp byte [0x42c170], bl
jne 0x405788
call fcn.00419f62
add eax, 0x40
cmp dword [ebp + 8], eax
jne 0x4057ef
cmp byte [0x42c171], bl
je 0x4057ef
push dword [ebp + 0x10]
lea eax, [ebp - 0x800]
push ebx
push eax
mov esi, 0x1800
push esi
mov edi, 0x42d978
push edi
call fcn.00418157
add esp, 0x14
push esi
mov esi, 0x42c178
push esi
push edi
call fcn.004104a5
push esi
push esi
call dword [sym.imp.USER32.dll_CharToOemA]
call fcn.00419f62
xor ecx, ecx
add eax, 0x20
cmp dword [ebp + 8], eax
sete cl
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
push ebx
lea eax, [ebp + 0x10]
push eax
push esi
call fcn.004181c0
pop ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40583e
push dword [ebp + 0x10]
lea eax, [ebp - 0x800]
push ebx
push eax
push 0x1800
mov edi, 0x42d978
push edi
call fcn.00418157
add esp, 0x14
call fcn.00419f62
xor ecx, ecx
add eax, 0x40
cmp dword [ebp + 8], eax
setne cl
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push ebx
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.00417f15
pop ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x405e36
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x405e63
test cl, 7
je 0x405e63
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x433178]
dec esi
inc ecx
jmp 0x405e44
cmp esi, 8
jb 0x405f06
mov edx, esi
shr edx, 3
mov dword [ebp + 8], edx
push ebx
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx edi, bl
mov edi, dword [edi*4 + 0x433578]
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x433178]
mov ebx, edx
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x433978]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x434178]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edi, dword [ebx*4 + 0x434578]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x434978]
movzx edx, dl
xor edi, dword [edx*4 + 0x433d78]
movzx eax, al
xor edi, dword [eax*4 + 0x434d78]
sub esi, 8
add ecx, 8
dec dword [ebp + 8]
mov eax, edi
jne 0x405e75
pop ebx
jmp 0x405f06
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x433178]
dec esi
inc ecx
test esi, esi
ja 0x405ef2
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4061c7
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0x40
pop ebx
cmp esi, ebx
jbe 0x406211
lea eax, [ebp - 0x1d0]
push eax
call fcn.0040eb70
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1d0]
push eax
call fcn.0040ee72
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.0040eeeb
lea eax, [ebp - 0x80]
push 0x20
mov dword [ebp + 8], eax
pop esi
xor ecx, ecx
push edi
test esi, esi
jbe 0x406231
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x36
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x406220
cmp esi, ebx
jae 0x406249
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x36
push eax
call fcn.00417f80
add esp, 0xc
lea eax, [ebp - 0xf0]
push eax
call fcn.0040eb70
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.0040ee72
push dword [ebp + 0x14]
lea eax, [ebp - 0xf0]
push dword [ebp + 0x10]
push eax
call fcn.0040ee72
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.0040eeeb
lea eax, [ebp - 0x160]
push eax
call fcn.0040eb70
xor ecx, ecx
test esi, esi
jbe 0x4062b3
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x5c
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x4062a2
pop edi
cmp esi, ebx
jae 0x4062cc
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x5c
push eax
call fcn.00417f80
add esp, 0xc
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.0040ee72
push 0x20
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.0040ee72
push dword [ebp + 0x18]
lea eax, [ebp - 0x160]
push eax
call fcn.0040eeeb
pop esi
pop ebx
leave
ret 0x14
Function at 0x406304
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0xbc
push esi
mov esi, dword [ebp + 0x6c]
push edi
push 0x40
pop eax
cmp esi, eax
jae 0x40631d
mov eax, esi
push eax
push dword [ebp + 0x68]
lea eax, [ebp - 0x44]
push eax
call fcn.004199f0
add esp, 0xc
lea eax, [ebp + 0x20]
push eax
mov byte [ebp + esi - 0x44], 0
mov byte [ebp + esi - 0x43], 0
mov byte [ebp + esi - 0x42], 0
mov byte [ebp + esi - 0x41], 1
add esi, 4
push esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.004061c7
push 0x20
pop esi
push esi
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp]
push eax
call fcn.004199f0
mov eax, dword [ebp + 0x7c]
add esp, 0xc
dec eax
mov dword [ebp + 0x4c], eax
push 0x10
pop eax
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x70]
mov dword [ebp + 0x40], eax
mov eax, dword [ebp + 0x74]
mov dword [ebp + 0x44], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x48], eax
xor edi, edi
mov eax, dword [ebp + edi + 0x4c]
test eax, eax
jbe 0x4063d4
mov dword [ebp + 0x6c], eax
lea eax, [ebp - 0x64]
push eax
push esi
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.004061c7
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.004199f0
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax + 0x20]
xor byte [ebp + eax], cl
inc eax
cmp eax, esi
jb 0x4063c2
dec dword [ebp + 0x6c]
jne 0x40639b
push esi
lea eax, [ebp]
push eax
push dword [ebp + edi + 0x40]
call fcn.004199f0
add edi, 4
add esp, 0xc
cmp edi, 0xc
jb 0x406390
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.0040e4c7
push esi
lea eax, [ebp]
push eax
call fcn.0040e4c7
push esi
lea eax, [ebp + 0x20]
push eax
call fcn.0040e4c7
push esi
lea eax, [ebp - 0x64]
push eax
call fcn.0040e4c7
pop edi
pop esi
add ebp, 0x58
leave
ret 0x20
Function at 0x40641f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
cmp dword [ebp + 0x1c], 0x18
push edi
mov edi, ecx
mov dword [ebp - 8], edi
ja 0x4065d9
and dword [ebp - 4], 0
push ebx
push esi
lea ebx, [edi + 0x4b4]
mov eax, dword [ebp + 0x1c]
lea esi, [ebx + 0x102]
cmp dword [esi + 0x32], eax
jne 0x406476
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.0040e5a2
test al, al
je 0x406476
push 0x10
push dword [ebp + 0x14]
push esi
call fcn.00418364
add esp, 0xc
test eax, eax
je 0x4065de
inc dword [ebp - 4]
add ebx, 0x178
cmp dword [ebp - 4], 4
jb 0x406444
mov esi, 0x200
push esi
lea eax, [ebp - 0x268]
push eax
push dword [ebp + 0x10]
call fcn.0041058f
mov ecx, dword [ebp + 0x1c]
xor eax, eax
inc eax
shl eax, cl
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x10
push dword [ebp + 0x14]
lea eax, [ebp - 0x268]
push eax
call fcn.004181c0
pop ecx
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00406304
push esi
lea eax, [ebp - 0x268]
push eax
call fcn.0040e4c7
mov esi, dword [ebp + 0xc]
lea eax, [edi + 0xa94]
mov ecx, dword [eax]
mov edx, ecx
and edx, 3
imul edx, edx, 0x178
lea ebx, [edx + edi + 0x4b4]
inc ecx
mov dword [eax], ecx
mov eax, dword [ebp + 0x1c]
push 0x40
pop ecx
mov dword [ebx + 0x134], eax
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 0x10
push dword [ebp + 0x14]
lea eax, [ebx + 0x102]
push eax
movsw word es:[edi], word [esi]
call fcn.004199f0
push 0x20
pop esi
push esi
lea eax, [ebp - 0x48]
push eax
lea edi, [ebx + 0x112]
push edi
call fcn.004199f0
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebx + 0x138]
push eax
call fcn.004199f0
push esi
lea eax, [ebp - 0x68]
push eax
add ebx, 0x158
push ebx
call fcn.004199f0
add esp, 0x30
push 0
push 1
push esi
push edi
call fcn.0040e419
mov edi, dword [ebp - 8]
cmp dword [ebp + 0x20], 0
je 0x40657b
push esi
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 0x20]
call fcn.004199f0
add esp, 0xc
mov ebx, dword [ebp + 0x24]
test ebx, ebx
je 0x4065ad
push 8
push 0
push ebx
call fcn.00417f80
add esp, 0xc
xor ecx, ecx
mov dl, byte [ebp + ecx - 0x28]
mov eax, ecx
and eax, 7
add eax, ebx
xor byte [eax], dl
inc ecx
cmp ecx, esi
jb 0x406591
push esi
lea eax, [ebp - 0x28]
push eax
call fcn.0040e4c7
cmp dword [ebp + 0x18], 0
je 0x4065cd
push dword [ebp + 0x18]
lea eax, [ebp - 0x48]
push 0x100
push eax
push dword [ebp + 8]
lea ecx, [edi + 0xa9c]
call fcn.0040df76
push esi
lea eax, [ebp - 0x48]
push eax
call fcn.0040e4c7
pop esi
pop ebx
pop edi
leave
ret 0x20
push 0
push 0
push 0x20
pop esi
lea eax, [ebx + 0x112]
push esi
push eax
call fcn.0040e419
push esi
lea eax, [ebx + 0x112]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004199f0
add esp, 0xc
push 0
push 1
push esi
lea eax, [ebx + 0x112]
push eax
call fcn.0040e419
push esi
lea eax, [ebx + 0x138]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004199f0
push esi
add ebx, 0x158
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.004199f0
add esp, 0x18
jmp 0x406565
Function at 0x4066e9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 2
jne 0x406735
mov eax, dword [esi + 4]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp + 8]
push eax
push 0x20
push dword [ebp + 0xc]
call fcn.004061c7
xor edx, edx
mov dword [esi + 4], edx
xor eax, eax
push ebx
movzx ebx, byte [ebp + eax - 0x20]
mov ecx, eax
and ecx, 3
shl ecx, 3
shl ebx, cl
xor edx, ebx
inc eax
cmp eax, 0x20
jb 0x40671a
mov dword [esi + 4], edx
pop ebx
cmp dword [esi], 3
jne 0x40675d
lea eax, [ebp - 0x20]
push eax
push 0x20
add esi, 4
push esi
push 0x20
push dword [ebp + 0xc]
call fcn.004061c7
push 0x20
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.004199f0
add esp, 0xc
pop esi
leave
ret 8
Function at 0x408d70
Capabilities:
Move file

Disassembly:
mov eax, 0x423e87
call fcn.00417c1c
mov eax, 0x5028
call fcn.00418250
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x800
push esi
lea eax, [ebp - 0x5034]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x408f2d
cmp eax, esi
jae 0x408f2d
push esi
lea eax, [ebp - 0x4034]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x408f2d
cmp eax, esi
jae 0x408f2d
lea eax, [ebp - 0x5034]
push eax
call fcn.0040bb32
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4034]
push eax
call fcn.0040bb32
mov edi, eax
cmp word [edi], 0
je 0x408f2d
push edi
push dword [ebp - 0x10]
call fcn.00410808
test eax, eax
je 0x408f2d
push edi
push ebx
call fcn.0040bb32
push eax
call fcn.00410808
test eax, eax
jne 0x408f2d
mov word [ebp - 0x1010], ax
xor edi, edi
cmp word [ebp - 0x1010], 0
jne 0x408e89
push esi
push ebx
lea eax, [ebp - 0x1010]
push eax
call fcn.0040f15f
push edi
push str.rtmp_d
push esi
lea eax, [ebp - 0x1010]
push eax
call fcn.0040bb32
push eax
call fcn.00401ba6
add esp, 0x10
lea eax, [ebp - 0x1010]
push eax
call fcn.00409b6d
test al, al
je 0x408e70
xor eax, eax
mov word [ebp - 0x1010], ax
add edi, 0x7b
cmp edi, 0x2710
jl 0x408e23
cmp word [ebp - 0x1010], 0
je 0x408f2d
push esi
push ebx
lea eax, [ebp - 0x3034]
push eax
call fcn.0040f15f
push esi
push dword [ebp - 0x10]
lea eax, [ebp - 0x3034]
push eax
call fcn.0040bc9c
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x3034]
push eax
call esi
test eax, eax
je 0x408f2d
lea ecx, [ebp - 0x2034]
call fcn.0040900e
push dword [ebp + 8]
and dword [ebp - 4], 0
xor bl, bl
call fcn.00409b6d
test al, al
jne 0x408ef0
push 0x12
push dword [ebp + 8]
lea ecx, [ebp - 0x2034]
call fcn.004091ab
mov bl, al
lea eax, [ebp - 0x3034]
push eax
lea eax, [ebp - 0x1010]
push eax
call esi
test bl, bl
je 0x408f1a
lea ecx, [ebp - 0x2034]
call fcn.004092ba
lea ecx, [ebp - 0x2034]
call fcn.00409308
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2034]
call fcn.004094f5
mov al, 1
jmp 0x408f2f
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x409331
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp dword [ebp + 0xc], ebx
je 0x409420
cmp dword [esi + 0xc], 1
jne 0x409355
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push edi
mov dword [ebp - 4], ebx
cmp dword [esi + 0xc], ebx
je 0x4093a0
xor edi, edi
cmp dword [ebp + 0xc], ebx
jbe 0x4093bf
mov ecx, dword [ebp + 0xc]
sub ecx, edi
mov eax, 0x4000
cmp ecx, eax
jae 0x409375
mov eax, ecx
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec eax
neg eax
sbb al, al
inc al
je 0x4093bf
add edi, 0x4000
cmp edi, dword [ebp + 0xc]
jb 0x409365
jmp 0x4093bb
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec eax
neg eax
sbb al, al
inc al
cmp al, bl
jne 0x40941b
cmp byte [esi + 0x14], bl
je 0x40941b
cmp dword [esi + 0xc], ebx
jne 0x40941b
push ebx
lea eax, [esi + 0x1e]
mov edi, 0x435184
push eax
mov ecx, edi
call fcn.00406b77
test al, al
je 0x40940f
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x409356
cmp eax, ebx
jbe 0x409356
mov edi, dword [esi]
push ebx
mov ecx, esi
call dword [edi + 0x10]
mov ecx, dword [ebp - 4]
xor ebx, ebx
sub eax, ecx
sbb edx, ebx
push edx
push eax
mov ecx, esi
call dword [edi + 0xc]
jmp 0x409356
lea eax, [esi + 0x1e]
push eax
push ebx
mov ecx, edi
call fcn.00406d03
mov byte [esi + 8], 1
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x409518
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
jne 0x409532
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4095a3
mov ecx, esi
call fcn.004094d2
test al, al
je 0x40956d
mov eax, 0x4e20
cmp dword [ebp + 0xc], eax
jbe 0x40956d
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.00409518
jmp 0x4095a6
cmp dword [esi + 0xc], 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x409584
call ebx
cmp eax, 0x6d
jne 0x409584
xor eax, eax
jmp 0x4095a6
cmp dword [esi + 0xc], 0
jne 0x40959e
mov edi, 0x8000
cmp dword [ebp + 0xc], edi
jbe 0x40959e
call ebx
cmp eax, 0x21
jne 0x40959e
push edi
jmp 0x409561
or eax, 0xffffffff
jmp 0x4095a6
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x409894
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00418250
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.0040bf2c
movzx eax, word [ebp - 0x1000]
neg eax
sbb eax, eax
lea ecx, [ebp - 0x1000]
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x4098dd
cmp eax, 5
je 0x4098dd
xor eax, eax
jmp 0x4098e0
xor eax, eax
inc eax
leave
ret 4
Function at 0x409909
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00418250
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
push dword [ebp + 8]
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x40994d
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.0040bfbb
test al, al
je 0x40994d
lea eax, [ebp - 0x1000]
push eax
call esi
mov edi, eax
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x409955
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00418250
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call esi
test eax, eax
setne bl
test bl, bl
jne 0x4099a4
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.0040bfbb
test al, al
je 0x4099a4
push dword [ebp + 0xc]
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
setne bl
pop esi
mov al, bl
pop ebx
leave
ret 8

Function at 0x409b91
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00418250
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0040b893
movzx eax, word [eax]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp ax, 0x2e
je 0x409bc7
cmp ax, 0x20
je 0x409bc7
push 0
push edi
call esi
test eax, eax
jne 0x409bf6
push edi
call fcn.00409b6d
test al, al
jne 0x409c09
push 0x800
lea eax, [ebp - 0x1000]
push eax
push edi
call fcn.0040bfbb
test al, al
je 0x409c09
push 0
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
je 0x409c09
cmp byte [ebp + 0xc], 0
je 0x409c05
push dword [ebp + 0x10]
push edi
call fcn.00409955
xor eax, eax
jmp 0x409c21
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x409c1e
cmp eax, 3
je 0x409c1e
xor eax, eax
inc eax
jmp 0x409c21
push 2
pop eax
pop edi
pop esi
leave
ret 0xc
Function at 0x409d35
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1250
call fcn.00418250
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [ebp - 0x250]
mov edi, 0x800
push eax
jne 0x409dc4
push dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
call ebx
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x409df1
push edi
lea eax, [ebp - 0x1250]
push eax
push dword [ebp + 0xc]
call fcn.0040bfbb
test al, al
je 0x409d9d
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x1250]
push eax
call ebx
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x409df1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x409db7
cmp eax, 3
je 0x409db7
cmp eax, 0x12
je 0x409db7
xor eax, eax
inc eax
jmp 0x409db9
xor eax, eax
mov byte [esi + 0x1044], al
jmp 0x409ebc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409de7
or dword [ebp + 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [esi + 0x1044], al
cmp dword [ebp + 8], 0xffffffff
je 0x409ebc
push edi
push dword [ebp + 0xc]
push esi
call fcn.0040f15f
push edi
lea eax, [ebp - 0x224]
push eax
push esi
call fcn.0040bc9c
push 1
push 0
push 0
push dword [ebp - 0x234]
call fcn.00418330
mov ecx, dword [ebp - 0x230]
xor edi, edi
add eax, ecx
mov dword [esi + 0x1000], eax
mov eax, dword [ebp - 0x250]
mov dword [esi + 0x1008], eax
mov eax, dword [ebp - 0x24c]
mov dword [esi + 0x1028], eax
mov eax, dword [ebp - 0x248]
mov dword [esi + 0x102c], eax
mov eax, dword [ebp - 0x244]
mov dword [esi + 0x1030], eax
mov eax, dword [ebp - 0x240]
mov dword [esi + 0x1034], eax
mov eax, dword [ebp - 0x23c]
mov dword [esi + 0x1038], eax
mov eax, dword [ebp - 0x238]
mov dword [esi + 0x103c], eax
lea eax, [ebp - 0x23c]
adc edx, edi
push eax
lea ecx, [esi + 0x1010]
mov dword [esi + 0x1004], edx
call fcn.0040f8ca
lea eax, [ebp - 0x24c]
push eax
lea ecx, [esi + 0x1018]
call fcn.0040f8ca
lea eax, [ebp - 0x244]
push eax
lea ecx, [esi + 0x1020]
call fcn.0040f8ca
and dword [esi + 0x1040], 0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40bfbb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00418250
push esi
mov esi, dword [ebp + 8]
cmp word [esi], 0
jne 0x40bfd9
xor al, al
jmp 0x40c163
push ebx
push edi
push esi
call fcn.0040ba7b
push esi
call fcn.00417f15
pop ecx
push esi
mov ebx, eax
call fcn.0040bef7
test al, al
je 0x40c083
push esi
call fcn.0040ba7b
test al, al
je 0x40c030
add ebx, 4
cmp dword [ebp + 0x10], ebx
jbe 0x40c15f
mov edi, dword [ebp + 0xc]
push 4
push str.__
push edi
call fcn.0041a2fd
push esi
add edi, 8
push edi
call fcn.00417f5d
add esp, 0x14
jmp 0x40c15b
cmp word [esi], 0x5c
jne 0x40c15f
add esi, 2
cmp word [esi], 0x5c
jne 0x40c15f
add ebx, 6
cmp dword [ebp + 0x10], ebx
jbe 0x40c15f
mov edi, dword [ebp + 0xc]
push 4
push str.__
push edi
call fcn.0041a2fd
lea eax, [edi + 8]
push 0x425aec
push eax
call fcn.00417f5d
push esi
add edi, 0xe
push edi
call fcn.00417f5d
add esp, 0x1c
jmp 0x40c15b
lea eax, [ebp - 0x1000]
push eax
mov edi, 0x7ff
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40c15f
cmp eax, edi
ja 0x40c15f
movzx eax, word [esi]
push eax
call fcn.0040b8ce
test al, al
je 0x40c0f0
add ebx, 6
cmp dword [ebp + 0x10], ebx
jbe 0x40c15f
mov edi, dword [ebp + 0xc]
push 4
push str.__
push edi
call fcn.0041a2fd
push 2
lea eax, [ebp - 0x1000]
push eax
lea eax, [edi + 8]
push eax
call fcn.0041a2fd
push esi
add edi, 0xc
push edi
call fcn.00417f5d
add esp, 0x20
jmp 0x40c15b
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.0040b8f3
lea eax, [ebp - 0x1000]
push eax
call fcn.00417f15
lea eax, [eax + ebx + 4]
pop ecx
cmp dword [ebp + 0x10], eax
jbe 0x40c15f
mov edi, dword [ebp + 0xc]
push 4
push str.__
push edi
call fcn.0041a2fd
lea eax, [ebp - 0x1000]
push eax
lea eax, [edi + 8]
push eax
call fcn.00417f5d
add esp, 0x14
cmp word [esi], 0x2e
jne 0x40c151
movzx eax, word [esi + 2]
push eax
call fcn.0040b8ce
test al, al
je 0x40c151
add esi, 4
push dword [ebp + 0x10]
push esi
push edi
call fcn.0040f18c
mov al, 1
jmp 0x40c161
xor al, al
pop edi
pop ebx
pop esi
leave
ret 0xc