joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b7f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4af570
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0048b3a0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0048b420
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0048b420
lea ecx, [esi + 0xc]
call fcn.004a0cd4
lea ecx, [esi + 0x10]
call fcn.004a0cd4
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0048dc60
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0048dc60
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0048dc60
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004a0d49
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004a0d49
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x48c498
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4af798
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x48c4a8
call fcn.0048c9c0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x48c58b
cmp byte [edi], 0
je 0x48c58b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x48c4cd
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.0048b1c0
test eax, eax
jne 0x48c4ed
push 0x50678c
lea ecx, [esi + 0x38]
call fcn.004a0e86
jmp 0x48c58b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.0048b210
test eax, eax
jne 0x48c51c
mov ecx, esi
call fcn.0048b310
push edi
add esi, 0x38
push 0x506768
push esi
call fcn.0049ece5
add esp, 0xc
jmp 0x48c58b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.0048d250
test eax, eax
je 0x48c584
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.0048c660
test eax, eax
jne 0x48c5a0
push edi
lea eax, [esi + 0x38]
push 0x506744
push eax
call fcn.0049ece5
add esp, 0xc
mov ecx, esi
call fcn.0048c9c0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x48c648
mov ecx, dword [0x506a88]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.0049ece5
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.0048b2c0
test eax, eax
jne 0x48c60a
push 0x506728
lea ecx, [esi + 0x38]
call fcn.004a0e86
jmp 0x48c61a
push 0xfa
mov ecx, esi
call fcn.0048d250
test eax, eax
jne 0x48c637
mov ecx, esi
call fcn.0048c9c0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.004a0d49
jmp 0x48c58b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.004a0d49
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x4a3117
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a314f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004a11a4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004a117c
jmp 0x4a315b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4a4808
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a484a
call fcn.004aa587
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a484a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a4841
xor eax, eax
jmp 0x4a4852
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a4858
pop edi
pop esi
pop ebx
ret 4

Function at 0x4aaab7
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4aaae5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4aab03
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004aaa1d
jmp 0x4aab03
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4aab03
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004aaa1d
test edi, edi
mov eax, edi
jne 0x4aaaed
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4010d5
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x44], 0
mov dword [esi], 0x5a2b00
je 0x401125
push dword [esi + 0x18]
call dword [sym.imp.WINMM.dll_waveInStop]
push dword [esi + 0x18]
call dword [sym.imp.WINMM.dll_waveInReset]
push 2
lea edi, [esi + 0x30]
pop ebx
push 0x20
push dword [edi]
push dword [esi + 0x18]
call dword [sym.imp.WINMM.dll_waveInUnprepareHeader]
add edi, 4
dec ebx
jne 0x4010fe
push dword [esi + 0x18]
call dword [sym.imp.WINMM.dll_waveInClose]
push 0xffffffffffffffff
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp byte [esi + 0x45], 0
je 0x401156
push dword [esi + 0x40]
call dword [sym.imp.WINMM.dll_waveOutReset]
push 2
lea edi, [esi + 0x30]
pop ebx
push 0x20
push dword [edi]
push dword [esi + 0x40]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
add edi, 4
dec ebx
jne 0x40113a
push dword [esi + 0x40]
call dword [sym.imp.WINMM.dll_waveOutClose]
push 2
lea edi, [esi + 0x30]
pop ebx
push dword [edi - 0x28]
call fcn.0056dc10
push dword [edi]
call fcn.0056dc10
push dword [edi - 0x20]
call fcn.0056dc10
push dword [edi + 8]
call fcn.0056dc10
add esp, 0x10
add edi, 4
dec ebx
jne 0x40115c
push dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 0x28]
call edi
push dword [esi + 0x2c]
call edi
pop edi
pop esi
pop ebx
ret

Function at 0x401240
Capabilities:
Capture microphone audio
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
test eax, eax
je 0x401290
lea eax, [ebp - 4]
xor esi, esi
push eax
push 4
push edi
push 0x40138a
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x20000
push esi
push dword [ebp - 4]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x46]
lea ebx, [edi + 0x18]
push eax
push 0xffff
push ebx
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
je 0x401294
xor al, al
jmp 0x4012f5
lea esi, [edi + 0x30]
mov dword [ebp - 8], 2
mov eax, dword [esi]
mov ecx, dword [esi - 0x28]
push 0x20
mov dword [eax], ecx
mov eax, dword [esi]
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov eax, dword [esi]
and dword [eax + 0x10], 0
mov eax, dword [esi]
and dword [eax + 0x14], 0
push dword [esi]
push dword [ebx]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
add esi, 4
dec dword [ebp - 8]
jne 0x40129e
mov eax, dword [edi + 0x1c]
push 0x20
push dword [edi + eax*4 + 0x30]
push dword [ebx]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebx]
call dword [sym.imp.WINMM.dll_waveInStart]
mov byte [edi + 0x44], 1
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4024bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
call fcn.005569b0
mov esi, eax
inc esi
push esi
call dword [0x5c6764]
push esi
mov edi, eax
push dword [ebp + 8]
push edi
call fcn.00556200
add esp, 0x14
xor eax, eax
test esi, esi
jle 0x4024fa
mov cl, byte [eax + edi]
xor cl, 0x19
sub cl, 0x7a
mov byte [eax + edi], cl
inc eax
cmp eax, esi
jl 0x4024e9
lea eax, [ebp - 4]
push eax
push esi
push edi
call fcn.004023ef
push edi
call dword [0x5c6768]
mov eax, dword [ebp - 4]
add esp, 0x10
pop edi
pop esi
leave
ret

Function at 0x40389c
Capabilities:
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
mov eax, 0x58e054
call fcn.0055690c
sub esp, 0x110
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
push 0x5e8c10
xor esi, esi
push 0xd4
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, esi
je 0x4039b1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, esi
je 0x4039b1
push dword [ebp - 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x4039b1
push dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [ebp - 0x14]
call fcn.00556200
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x11c]
push 0x5e8c04
push eax
call fcn.00556ac0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ecx
pop ecx
lea eax, [ebp - 0x11c]
push eax
call edi
push esi
push esi
push 2
push esi
push esi
lea eax, [ebp - 0x11c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, esi
je 0x4039b1
lea eax, [ebp - 0x1c]
push esi
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x600970
push dword [ebp + 8]
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebp - 0x18]
push str.open
push dword [eax + 0x1c]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [ebp - 0x11c]
push eax
call edi
cmp eax, esi
je 0x4039a4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0057265c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40400c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00403eee
xor edx, edx
test eax, eax
jle 0x40403d
mov ecx, dword [ebp - 4]
add byte [ecx + edx], 0x7a
add ecx, edx
mov ecx, dword [ebp - 4]
xor byte [ecx + edx], 0x19
add ecx, edx
inc edx
cmp edx, eax
jl 0x404026
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x404d24
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x404d3c
mov eax, 0x80
jmp 0x404d3e
or al, 0x80
push 0x4010
lea ecx, [ebp - 0x160]
push 0x160
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [ebp - 0x15c]
leave
ret
Function at 0x406d35
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, 0x58e510
call fcn.0055690c
sub esp, 0x354
push ebx
push edi
push 0x104
lea eax, [ebp - 0x25c]
push 0
mov dword [ebp - 0x18], ecx
push eax
call fcn.005561a0
mov ebx, dword [ebp + 8]
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + ebx - 1], 0x5c
mov dword [ebp + 8], 0x5e8da0
jne 0x406d7f
mov dword [ebp + 8], 0x600970
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x25c]
push ebx
push str._s_s.
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
jne 0x406dbd
xor al, al
jmp 0x406e64
push esi
mov esi, str._s_s_s
cmp byte [ebp - 0x12c], 0x2e
je 0x406e40
test byte [ebp - 0x158], 0x10
je 0x406dfe
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x360]
push dword [ebp + 8]
push ebx
push esi
push eax
call edi
mov ecx, dword [ebp - 0x18]
add esp, 0x14
lea eax, [ebp - 0x360]
push eax
call fcn.00406d35
jmp 0x406e40
mov eax, dword [0x5eb854]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x12c]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push ebx
push esi
push eax
call fcn.0056b3b3
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [eax + 0xa4]
call fcn.004091dd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0057265c
lea eax, [ebp - 0x158]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406dc3
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4071da
Capabilities:
Get file size

Disassembly:
mov eax, 0x58e5a0
call fcn.0055690c
sub esp, 0x18
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0xb0], ebx
jne 0x4071fc
xor eax, eax
jmp 0x4073ee
lea eax, [esi + 0x244]
push edi
push eax
lea ecx, [ebp - 0x14]
call fcn.005723d1
push ebx
push ebx
push 0x1042
mov dword [ebp - 4], ebx
push dword [esi + 0x780]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
mov edi, 0x5e8da0
je 0x407286
lea ecx, [esi + 0x764]
push eax
call fcn.0056c2be
cmp eax, 1
jne 0x407286
push ebx
lea eax, [ebp - 0x1c]
push dword [ebp - 0x18]
lea ecx, [esi + 0x764]
push eax
call fcn.0056c219
push edi
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
call fcn.005728f1
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00572a74
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0057265c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.0057265c
mov ecx, dword [esi + 0x6c]
lea eax, [esi + 0x6c]
cmp dword [ecx - 8], ebx
je 0x4072b4
push edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.005728f1
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00572a74
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.0057265c
mov eax, dword [esi + 0xa8]
lea edi, [esi + 0x70]
add eax, 8
mov ecx, edi
push eax
call fcn.00572795
push edi
lea ecx, [ebp - 0x10]
call fcn.005723d1
push dword [ebp - 0x14]
mov eax, dword [esi + 0x668]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
push eax
call fcn.0056acaa
lea eax, [ebp - 0x10]
lea ecx, [esi + 0x64]
push eax
call fcn.00572795
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push ebx
mov ecx, edi
call fcn.00572a8c
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x407320
xor esi, esi
jmp 0x4073d4
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x78], eax
push edi
mov dword [ebp - 0x24], eax
mov dword [esi + 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 8]
add eax, 0xa
push eax
push 0x40
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp - 0x18]
mov edi, eax
push ebx
push edi
call fcn.005561a0
lea eax, [ebp - 0x20]
push 4
push eax
lea eax, [edi + 1]
push eax
mov byte [edi], 4
call fcn.00556200
lea eax, [ebp - 0x24]
push 4
push eax
lea eax, [edi + 5]
push eax
call fcn.00556200
mov eax, dword [ebp - 0x10]
add esp, 0x24
lea ecx, [ebp - 0x10]
mov eax, dword [eax - 8]
inc eax
push eax
push ebx
call fcn.00572a8c
push eax
lea eax, [edi + 9]
push eax
call fcn.00556200
add esp, 0xc
mov ecx, dword [esi + 0x658]
push dword [ebp - 0x18]
push edi
push dword [esi + 0x654]
call fcn.0040b14a
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x1c]
lea ecx, [esi + 0xa4]
push eax
call fcn.00409169
lea ecx, [ebp - 0x1c]
call fcn.0057265c
push 1
pop esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0057265c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0057265c
mov eax, esi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4078bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
push 9
mov ecx, dword [esi + 0x654]
add ecx, 0x24
call fcn.00402304
mov ecx, dword [esi + 0x654]
push 1
add ecx, 0x24
mov dword [ebp - 0x18], eax
call fcn.00402304
mov edi, dword [eax + 4]
mov edx, dword [eax]
xor ecx, ecx
xor ebx, ebx
or ecx, edi
or edx, ebx
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], edx
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov ecx, dword [esi + 0x654]
mov eax, dword [eax + 4]
add ecx, 0x24
mov dword [ebp - 8], eax
call fcn.004021b1
push ebx
push 0x80
push 3
push ebx
push 2
mov edi, eax
push 0x40000000
lea ecx, [esi + 0x60]
push ebx
sub edi, 9
call fcn.00572a8c
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [ebp - 0x14]
push ebx
push ecx
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x10]
push ebx
push eax
push edi
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jg 0x407976
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xf
jl 0x407957
cmp dword [ebp - 4], 0xf
jne 0x4079ac
cmp eax, ebx
jg 0x4079ac
lea eax, [esi + 0x60]
push 0x5e8e2c
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.005728f1
push 0x30
push 0x5e8678
push dword [eax]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x18]
call fcn.0057265c
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov ecx, esi
add dword [esi + 0x80], eax
adc dword [esi + 0x84], ebx
call fcn.00407bda
cmp byte [esi + 0x5c], bl
je 0x4079d9
mov ecx, esi
call fcn.00407bb9
jmp 0x407a1b
mov eax, dword [ebp - 0x10]
push 4
add dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x23]
push eax
mov byte [ebp - 0x24], 7
call fcn.00556200
lea eax, [ebp - 8]
push 4
push eax
lea eax, [ebp - 0x1f]
push eax
call fcn.00556200
mov ecx, dword [esi + 0x658]
add esp, 0x18
lea eax, [ebp - 0x24]
push 9
push eax
push dword [esi + 0x654]
call fcn.0040b14a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407caf
Capabilities:
Delete file

Disassembly:
mov eax, 0x58e634
call fcn.0055690c
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
mov byte [esi + 0x7f4], 1
mov eax, dword [0x5eb854]
mov dword [ebp - 0x10], eax
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
xor ebx, ebx
push ebx
push ebx
push 0x1032
mov dword [ebp - 4], ebx
push dword [esi + 0x7bc]
call edi
cmp eax, 1
push ebx
push ebx
jbe 0x407d12
push 0x1032
push dword [esi + 0x7bc]
call edi
push eax
lea eax, [ebp - 0x10]
push 0x5e8ef0
push eax
call fcn.0056b3b3
add esp, 0xc
jmp 0x407d7a
push 0x1042
push dword [esi + 0x7bc]
call edi
push ebx
push eax
lea eax, [ebp - 0x14]
lea ecx, [esi + 0x7a0]
push eax
call fcn.0056c219
push ebx
push ebx
push 0x1042
mov byte [ebp - 4], 1
push dword [esi + 0x7bc]
call edi
push eax
lea ecx, [esi + 0x7a0]
call fcn.0056c2be
push dword [ebp - 0x14]
cmp eax, 1
jne 0x407d5e
push 0x5e8ec4
jmp 0x407d63
push 0x5e8eac
lea eax, [ebp - 0x10]
push eax
call fcn.0056b3b3
add esp, 0xc
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.0057265c
push 0x24
push 0x5e8ea0
push dword [ebp - 0x10]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x407e4b
push ebx
mov ecx, esi
call fcn.00406e74
lea edi, [esi + 0x7a0]
mov ecx, edi
call fcn.004090e5
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x407e2b
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.004090f9
push ebx
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.0056c219
push eax
lea eax, [esi + 0x668]
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
call fcn.0057288b
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.0057265c
push dword [ebp - 0x20]
mov ecx, edi
call fcn.0056c2be
test eax, eax
je 0x407e12
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.00572a5f
push dword [ebp - 0x14]
mov ecx, esi
call fcn.00408232
jmp 0x407e1b
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.0057265c
cmp dword [ebp - 0x18], ebx
jne 0x407db2
push 1
mov ecx, esi
call fcn.00406e74
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x5e8da4
call fcn.005726ca
mov ecx, esi
call fcn.00405550
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0057265c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4080f8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
push 1
mov ecx, dword [esi + 0x654]
add ecx, 0x24
call fcn.00402304
mov edi, eax
xor ebx, ebx
mov eax, dword [edi]
mov dword [ebp - 4], eax
mov eax, dword [edi + 4]
mov dword [ebp - 8], eax
mov edx, dword [edi + 4]
mov ecx, dword [edi]
xor eax, eax
or eax, edx
or ecx, ebx
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], ecx
mov ecx, esi
call fcn.00407bda
mov eax, dword [esi + 0x80]
cmp eax, dword [esi + 0x78]
jne 0x40815a
mov eax, dword [esi + 0x84]
cmp eax, dword [esi + 0x7c]
je 0x408226
cmp dword [edi + 4], 0xffffffff
je 0x408226
xor ebx, ebx
cmp byte [esi + 0x5c], bl
jne 0x408226
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push ebx
lea ecx, [esi + 0x70]
call fcn.00572a8c
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x40822d
lea ecx, [ebp - 4]
push ebx
push ecx
push dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x2000
push 0x40
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 4]
push 4
push eax
lea eax, [edi + 1]
mov byte [edi], 5
push eax
call fcn.00556200
lea eax, [ebp - 8]
push 4
push eax
lea eax, [edi + 5]
push eax
call fcn.00556200
add esp, 0x18
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [edi + 9]
push 0x1ff7
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jbe 0x40821d
mov ecx, dword [esi + 0x658]
add eax, 9
push eax
push edi
push dword [esi + 0x654]
call fcn.0040b14a
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x40822d
mov ecx, esi
call fcn.00407aae
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408232
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push ebx
lea eax, [ebp - 0x450]
push str._s.
mov dword [ebp - 4], ecx
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x40827e
xor al, al
jmp 0x4082ff
push edi
mov edi, 0x5e8f08
cmp byte [ebp - 0x118], 0x2e
je 0x4082d5
test byte [ebp - 0x144], 0x10
lea eax, [ebp - 0x118]
push eax
push ebx
push edi
je 0x4082bc
lea eax, [ebp - 0x248]
push eax
call esi
mov ecx, dword [ebp - 4]
add esp, 0x10
lea eax, [ebp - 0x248]
push eax
call fcn.00408232
jmp 0x4082d5
lea eax, [ebp - 0x34c]
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408284
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne al
pop edi
pop esi
pop ebx
leave
ret 4