joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481ca9
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00481acd
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x481e18
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x481e18
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x481dcd
jg 0x481d05
test eax, eax
je 0x481dc3
push 1
push 0x1000
call fcn.0046c2f2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x481d28
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x481dba
push 0x8000
push ebx
call fcn.00464ef6
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x481d51
jg 0x481d4c
cmp ecx, 0x1000
jb 0x481d51
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0046f139
add esp, 0x10
cmp eax, 0xffffffff
je 0x481d96
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x481d4c
jl 0x481d7d
test ecx, ecx
jne 0x481d3e
push dword [ebp - 0xc]
push ebx
call fcn.00464ef6
push esi
call fcn.0046780e
add esp, 0xc
xor ebx, ebx
jmp 0x481e26
cmp byte [edi + 0x24], 0
je 0x481dad
cmp dword [edi + 0x20], 5
jne 0x481dad
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x481db8
mov ebx, dword [edi + 0x18]
jmp 0x481dba
xor ebx, ebx
push esi
call fcn.0046780e
pop ecx
jmp 0x481e26
test ecx, ecx
jg 0x481d8f
jl 0x481dcd
test eax, eax
jae 0x481d8f
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0046f817
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x481ded
cmp byte [edi + 0x1c], 0
je 0x481d8f
jmp 0x481e1e
push ebx
call fcn.004748f7
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x481d8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x481e26
cmp byte [edi + 0x1c], 0
je 0x481e23
mov ebx, dword [edi + 0x18]
jmp 0x481e26
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0046f817
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x484ff0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x48501d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x48501d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401a20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret

Function at 0x402230
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00402240

Function at 0x4024c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004024d0
Function at 0x409790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d475
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x457b80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
add eax, 4
mov dword [ebp - 0x18], eax
push 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.004114d9
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
add esp, 4
mov dword [ebp - 0x14], eax
lea edi, [eax + 8]
mov edx, dword [ecx]
mov ecx, edx
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409800
sub ecx, esi
push ecx
push edx
mov ecx, edi
call fcn.00407e20
cmp dword [edi + 0x14], 0xf
mov edx, edi
mov dword [ebp - 4], 1
jbe 0x409823
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x409842
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x409830
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push esi
push edi
push eax
call fcn.004095d0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4098ce
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
mov byte [esi + 4], 0
test eax, eax
je 0x4098b9
mov ecx, dword [edi + 0x14]
cmp ecx, 0xf
jbe 0x40989d
mov eax, dword [edi]
inc ecx
cmp ecx, 0x1000
jb 0x409890
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409967
mov eax, edx
push ecx
push eax
call fcn.00411509
mov eax, dword [ebp - 0x14]
add esp, 8
push 0x20
push eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
call fcn.00411509
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp - 0x10]
mov eax, dword [edi + 8]
cmp eax, 0x7ffffff
je 0x40996c
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x431950]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x431950]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x40993a
mov ecx, edi
call fcn.0040bb50
mov eax, dword [ebp - 0x14]
mov ecx, edi
add eax, 8
push esi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004095d0
mov ecx, dword [eax]
jmp 0x40993d
mov ecx, dword [ebp - 0x20]
push dword [ebp - 0x14]
push ecx
push esi
mov ecx, edi
call fcn.0040b900
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.004185a1
push str.unordered_map_set_too_long
call fcn.00410f96
int3
Function at 0x40c6f0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
pop ebp
ret
Function at 0x40e7a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
mov dword [ebp - 8], esi
push str.CommandLineToArgvW_failure
setne cl
movzx ecx, cl
push ecx
push 0xfe6
push str.D:_acactuscactus_src_base_system.cpp
call fcn.0040e960
cmp dword [ebp - 4], 0
push str.Invalid_argc_value
setg al
movzx eax, al
push eax
push 0xfe7
push str.D:_acactuscactus_src_base_system.cpp
call fcn.0040e960
mov eax, dword [ebp - 4]
add esp, 0x20
xor ebx, ebx
xor edi, edi
test eax, eax
jle 0x40e859
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [esi + edi*4]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
push str.WideCharToMultiByte_failure
setne cl
movzx ecx, cl
push ecx
push 0xfee
push str.D:_acactuscactus_src_base_system.cpp
call fcn.0040e960
mov eax, dword [ebp - 4]
add ebx, esi
mov esi, dword [ebp - 8]
inc edi
add esp, 0x10
cmp edi, eax
jl 0x40e810
lea eax, [eax*4 + 4]
push eax
call fcn.00414799
push ebx
mov dword [ebp - 0xc], eax
call fcn.00414799
mov edi, eax
mov eax, dword [ebp - 0xc]
push ebx
push 0
push edi
mov dword [eax], edi
call fcn.004128e0
add esp, 0x14
mov dword [ebp - 0x14], 0
cmp dword [ebp - 4], 0
jle 0x40e8f8
mov ecx, dword [ebp - 0xc]
mov edx, esi
sub edx, ecx
mov dword [ebp - 0x10], ecx
mov eax, ecx
mov dword [ebp - 0x18], edx
nop
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push dword [edx + eax]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
push str.WideCharToMultiByte_failure
setne cl
movzx ecx, cl
push ecx
push 0xffa
push str.D:_acactuscactus_src_base_system.cpp
call fcn.0040e960
mov eax, dword [ebp - 0x10]
add edi, esi
mov ecx, dword [ebp - 0x14]
add eax, 4
mov edx, dword [ebp - 0x18]
inc ecx
add esp, 0x10
mov dword [ebp - 0x10], eax
sub ebx, esi
mov dword [ebp - 0x14], ecx
mov dword [eax], edi
cmp ecx, dword [ebp - 4]
jl 0x40e8a0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [edx + eax*4], 0
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret
Function at 0x40ea90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d6dd
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x457b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
lea ecx, [ebp - 0x28]
push 0x30
push esi
call fcn.0040dc00
cmp dword [ebp - 0x14], 7
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
cmova ecx, dword [ebp - 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x40eb62
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.00410600
cmp dword [ebp - 0x2c], 0xf
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
cmova ecx, dword [ebp - 0x40]
push ecx
push esi
push str.GetCurrentDirectoryW_failed:__ld__s
push str.filesystem
call fcn.0040ea70
mov ecx, dword [ebp - 0x2c]
add esp, 0x18
mov byte [ebx], 0
cmp ecx, 0xf
jbe 0x40eb5e
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40eb54
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ec02
push ecx
push edx
call fcn.00411509
add esp, 8
xor ebx, ebx
jmp 0x40ebaf
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00410890
add esp, 8
cmp byte [ebp - 0x44], 0
mov byte [ebx], 0
jne 0x40eb87
xor ebx, ebx
jmp 0x40eba7
cmp dword [ebp - 0x48], 0xf
lea ecx, [ebp - 0x5c]
mov eax, dword [ebp + 0xc]
cmova ecx, dword [ebp - 0x5c]
dec eax
push eax
push ecx
push ebx
call fcn.00419c90
push ebx
call fcn.00410460
add esp, 0x10
lea ecx, [ebp - 0x5c]
call fcn.0040df20
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x40ebe5
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ebdb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ec07
push ecx
push edx
call fcn.00411509
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411457
mov esp, ebp
pop ebp
ret
call fcn.004185a1
call fcn.004185a1
int3
Function at 0x40ec10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x457b80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00410750
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 7
cmova eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ec53
test al, 0x10
je 0x40ec53
mov esi, 1
jmp 0x40ec55
xor esi, esi
mov ecx, dword [ebp - 8]
cmp ecx, 7
jbe 0x40ec8b
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ec81
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ec9c
push ecx
push edx
call fcn.00411509
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00411457
mov esp, ebp
pop ebp
ret
call fcn.004185a1
int3
Function at 0x40ede0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d72b
mov eax, dword fs:[0]
push eax
sub esp, 0x490
mov eax, dword [0x457b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x480], eax
mov eax, dword [ebp + 0x14]
push str._s_
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x210]
push 0x200
push eax
call fcn.00410010
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.00410750
add esp, 0x18
cmp dword [ebp - 0x214], 7
lea ecx, [ebp - 0x478]
lea eax, [ebp - 0x228]
mov dword [ebp - 4], 0
cmova eax, dword [ebp - 0x228]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40efa3
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop word [eax + eax]
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.00410890
add esp, 8
cmp byte [ebp - 0x484], 0
mov byte [ebp - 4], 1
jne 0x40eeca
push edi
push str.ERROR:_file_folder_name_containing_invalid_UTF_16_found_in_folder__s
push str.filesystem
push 0
call fcn.0040d410
add esp, 0x10
jmp 0x40ef02
cmp dword [ebp - 0x488], 0xf
lea ecx, [ebp - 0x49c]
push dword [ebp - 0x47c]
cmova ecx, dword [ebp - 0x49c]
mov eax, dword [ebp - 0x478]
push dword [ebp + 0x10]
shr eax, 4
and eax, 1
push eax
push ecx
call dword [ebp - 0x480]
add esp, 0x10
test eax, eax
jne 0x40ef5d
cmp byte [ebp - 0x484], 0
mov byte [ebp - 4], 0
je 0x40ef49
mov ecx, dword [ebp - 0x488]
cmp ecx, 0xf
jbe 0x40ef49
mov edx, dword [ebp - 0x49c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ef3f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40effb
push ecx
push edx
call fcn.00411509
add esp, 8
lea eax, [ebp - 0x478]
push eax
push esi
call ebx
test eax, eax
jne 0x40ee90
jmp 0x40ef9c
cmp byte [ebp - 0x484], 0
je 0x40ef9c
mov ecx, dword [ebp - 0x488]
cmp ecx, 0xf
jbe 0x40ef9c
mov edx, dword [ebp - 0x49c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ef92
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40effb
push ecx
push edx
call fcn.00411509
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x214]
cmp ecx, 7
jbe 0x40efdf
mov edx, dword [ebp - 0x228]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40efd5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f000
push ecx
push edx
call fcn.00411509
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411457
mov esp, ebp
pop ebp
ret
call fcn.004185a1
call fcn.004185a1
int3
Function at 0x40f3b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x457b80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00410750
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 7
cmova eax, dword [ebp - 0x1c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40f3fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40f3fb
or esi, 0xffffffff
jmp 0x40f3fd
xor esi, esi
mov ecx, dword [ebp - 8]
cmp ecx, 7
jbe 0x40f433
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f429
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f444
push ecx
push edx
call fcn.00411509
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00411457
mov esp, ebp
pop ebp
ret
call fcn.004185a1
int3

Function at 0x40f450
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x457b80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x7ff
push eax
lea eax, [ebp - 0x804]
mov byte [ebp - 0x804], 0
push eax
call fcn.00419c90
lea eax, [ebp - 0x804]
add esp, 0xc
lea edx, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f490
push ebx
sub eax, edx
push esi
push edi
test eax, eax
jle 0x40f4d4
dec eax
lea esi, [ebp - 0x804]
add esi, eax
mov cl, byte [esi]
and cl, 0xc0
cmp cl, 0x80
jne 0x40f4b7
test eax, eax
jne 0x40f4a0
lea eax, [ebp - 0x820]
mov dword [ebp - 0x820], esi
push eax
call fcn.00410320
add esp, 4
cmp eax, 0xffffffff
jne 0x40f4d4
mov byte [esi], 0
mov al, byte [ebp - 0x803]
lea esi, [ebp - 0x803]
test al, al
je 0x40f54f
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp al, 0x2f
jne 0x40f547
cmp byte [esi + 1], 0
je 0x40f547
lea eax, [ebp - 0x804]
mov byte [esi], 0
push eax
lea eax, [ebp - 0x81c]
push eax
call fcn.00410750
add esp, 8
lea eax, [ebp - 0x81c]
cmp dword [ebp - 0x808], 7
cmova eax, dword [ebp - 0x81c]
push 0
push eax
call ebx
test eax, eax
jne 0x40f539
call edi
cmp eax, 0xb7
jne 0x40f562
lea ecx, [ebp - 0x81c]
call fcn.00408a30
mov byte [esi], 0x2f
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x40f4f0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411457
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x81c]
call fcn.00408a30
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411457
mov esp, ebp
pop ebp
ret
Function at 0x40f590
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x457b80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00410750
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 7
cmova eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 8]
neg eax
sbb esi, esi
cmp ecx, 7
jbe 0x40f5fd
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f5f3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f60f
push ecx
push edx
call fcn.00411509
add esp, 8
mov ecx, dword [ebp - 4]
lea eax, [esi + 1]
xor ecx, ebp
pop esi
call fcn.00411457
mov esp, ebp
pop ebp
ret
call fcn.004185a1
int3

Function at 0x40f620
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x457b80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00410750
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 7
cmova eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 8]
neg eax
sbb esi, esi
neg esi
cmp ecx, 7
jbe 0x40f68f
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f685
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f6a1
push ecx
push edx
call fcn.00411509
add esp, 8
mov ecx, dword [ebp - 4]
lea eax, [esi - 1]
xor ecx, ebp
pop esi
call fcn.00411457
mov esp, ebp
pop ebp
ret
call fcn.004185a1
int3
Function at 0x40f6b0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d7bd
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x457b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00410750
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push esi
push eax
call fcn.00410750
add esp, 0x10
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x40]
cmova ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 7
push 3
cmova eax, dword [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x14]
neg eax
sbb esi, esi
cmp ecx, 7
jbe 0x40f757
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f74d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f7be
push ecx
push edx
call fcn.00411509
add esp, 8
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp ecx, 7
jbe 0x40f7a1
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f797
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f7be
push ecx
push edx
call fcn.00411509
add esp, 8
lea eax, [esi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411457
mov esp, ebp
pop ebp
ret
call fcn.004185a1
int3

Function at 0x40f900
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f960
add esp, 8
mov esi, eax
test byte [ebp + 0xc], 8
je 0x40f956
test esi, esi
je 0x40f956
push esi
push 3
lea eax, [ebp - 4]
push 1
push eax
call fcn.0041b386
add esp, 0x10
cmp eax, 3
jne 0x40f947
cmp byte [ebp - 4], 0xef
jne 0x40f947
cmp byte [ebp - 3], 0xbb
jne 0x40f947
cmp byte [ebp - 2], 0xbf
je 0x40f954
push 0
push 0
push esi
call fcn.0041b729
add esp, 0xc
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40fb00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.0041b386
add esp, 0x10
pop ebp
ret