joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1088820
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x1088832
xor eax, eax
pop edi
ret
push ebx
push esi
push edi
call fcn.01069000
mov ebx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [eax], esi
test ebx, ebx
je 0x10888e2
mov eax, dword [edi + 0x10c]
push ebp
cmp eax, esi
jne 0x1088880
test esi, esi
jle 0x10888c1
mov ecx, ebx
lea eax, [edi + 0x8c]
mov ebp, esi
lea ebx, [ebx]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x1088870
jmp 0x10888c1
mov ecx, esi
sub ecx, eax
cmp ecx, 1
mov byte [eax + edi + 0xec], 0x80
jle 0x10888a5
dec ecx
push ecx
lea eax, [eax + edi + 0xed]
push 0
push eax
call fcn.0104aa48
add esp, 0xc
test esi, esi
jle 0x10888c1
mov ecx, ebx
lea eax, [edi + 0xac]
mov ebp, esi
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x10888b3
push esi
push ebx
push ebx
push edi
call fcn.01067470
add esp, 0x10
pop ebp
test eax, eax
jne 0x10888e2
push esi
push ebx
call fcn.0105a050
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x1096e30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.0104aba0
mov eax, dword [0x10a4920]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x1096e7f
mov eax, 1
mov dword [esi], ebp
jmp 0x1096e81
mov ebp, dword [esi]
test ecx, ecx
je 0x1096f64
push ebp
call fcn.0106c2f0
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x1096eb0
push 0x1022c00
push 0x68
push 0x1022be8
call fcn.010521b0
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x1096f07
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.010700d0
add esp, 0xc
test eax, eax
je 0x1097006
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.01070280
add esp, 0xc
test eax, eax
je 0x1097006
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.010702a0
add esp, 0xc
test eax, eax
je 0x1097006
jmp 0x1096f41
cmp edi, 0x80
jbe 0x1096f23
push 0x1022bc0
push 0x75
push 0x1022be8
call fcn.010521b0
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.0104aa54
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x1096f6c
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.0104aa48
add esp, 0xc
jmp 0x1096f6c
test eax, eax
je 0x1096ff2
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x1096f70
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.010700d0
add esp, 0xc
test eax, eax
je 0x1097006
push ebp
call fcn.0106c2f0
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.01070280
add esp, 0x10
test eax, eax
je 0x1097006
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x1096fb4
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.010700d0
add esp, 0xc
test eax, eax
je 0x1097006
push ebp
call fcn.0106c2f0
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.01070280
add esp, 0x10
test eax, eax
je 0x1097006
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.010703d0
add esp, 8
test eax, eax
jne 0x109700a
xor eax, eax
jmp 0x109700f
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0104ae77
add esp, 0x8c
ret
Function at 0x10bf989
Capabilities:
Packed with generic packer

Disassembly:
call fcn.010c2dfe
jnp 0x10bf9ea
outsd dx, dword [esi]
mov byte [ebx + 0x65], dh
popal
fstp dword [edx + 0xdec194f]
sub ch, byte [ebx]
and al, 9
invalid
pop ebp
js 0x10bfa60
mov ds, word [esi + 9]
int 5
rol dword [ecx - 0x71536a68], 1
aad 0x24
iretd
or esi, ecx
lea ebx, [ecx + 0x2c]

Function at 0x10c1646
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg dword [esp + 0x34], ecx
not ch
mov ecx, 0x109e766
mov dword [esp], 0x2d4b634f
mov dword [esp + 0x10], 0x2f3e7049
pushfd
mov ecx, dword [ecx + 0x374e6]
mov byte [esp + 0xc], 0x24
mov word [esp], bp
lea ecx, [ecx + 0x1b0c6682]
call fcn.010dadc6

Function at 0x10c856a
Capabilities:
Packed with generic packer

Disassembly:
push 0x35f7bf10
lea edi, [edi + 1]
push 0xa567ab63
call fcn.010cee34
cmpsd dword [esi], dword es:[edi]
sbb byte [0x1934130e], ah
push es
pop ss
xor byte [ecx], ch
sub ah, byte [edi]
cmp dl, dh
sbb al, 0x80
invalid

Function at 0x10d6fa5
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov dword [esp + 0x2c], eax
pop eax
cwde
pop eax
mov eax, 0x102efed
jmp 0x112f5a8
mov eax, dword [eax + 0xf57a8]
push 0x3d066d4
pushal
call fcn.01131746
in eax, dx
xor byte [0x2a1b293e], bh
fcmovnbe st(0), st(3)
or eax, 0x5b625d5b
dec esp
pop ebp
pop edx
dec edi
push 0x503b526d
pop ebx
jo 0x112f62b
popal
invalid
add byte [edx + ecx - 0x3a], 3
push es
insb byte es:[edi], dx
jge 0x112f6ac
jge 0x112f6a6
xchg dword [esi + 0x32afa085], edx
push ecx
pop ebx
cmp eax, 0xef00b57
mov esi, 0x23bc6cad
int3
enter 0x5d39, 0xffffffffffffffb7
test al, 0xaa
stosd dword es:[edi], eax
xchg edx, eax
movsd dword es:[edi], dword [esi]
imul esp, dword [eax - 0x1504488d], 0xfffffff4
cmc
div ch
adc al, 0x2b
sub dword ds:[edi + esi], ebx
xor eax, 0xc2105e2c
mov bl, 0xb5

Function at 0x10e0f5d
Capabilities:
Packed with generic packer

Disassembly:
push esp
and al, 0x38
cmp dh, al
add al, 0x24
scasb al, byte es:[edi]
jmp 0x10f2405
push es
add byte [eax + 0x66], dl
push eax
movzx ax, bl
call fcn.01137e82
popal
movsb byte es:[edi], byte [esi]
mov cl, 0xb6
mov eax, dword [0x73d82a93]
jno 0x10e0fac
inc ecx
push esi
jo 0x10e0f03
mov gs, word [edi - 0x6c7d6e58]
jl 0x10e0f01
xchg edx, eax
pushfd
xchg dword [edx + esi*8 - 0x2ddd7d3c], edx
rol esi, cl
fmul st(7)
xlatb
mov ecx, 0xb33025e1
cld
bound esp, qword [ebx + 0x62]
jnp 0x10e0ff9
pop ecx
jo 0x10e0f28
xchg ecx, eax
jae 0x10e100b
jle 0x10e0f30
wait
loopne 0x10e101b
jo 0x10e101a
ret
sar dword [esi - 0x74af1538], cl
xor eax, 0xd4f2dbf4
invalid
sahf
xor edx, dword [eax - 9]
or dword [eax - 0x3de1d0d3], ebx
fistp qword [edx + 0x3c5139c5]
cmpsb byte [esi], byte es:[edi]
mov ebp, 0xacb1bcc7
lds edi, [eax - 0x1b221939]
fucom st(4)
jmp 0x10e0fdf
invalid
or dword [edi + esi*8], edx
adc al, 0xf7
ficomp word [esi + 0xc]
and al, 0xd5
invalid
invalid
Function at 0x10e248f
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushfd
xchg dword [esp + 0x1c], eax
lea esp, [esp + 0x1c]
jno 0x1148f85
push edi
mov dword [esp], eax
push eax
setnp al
lahf
mov eax, 0x106292e
call fcn.0110ec42
invalid
pushfd
mov dword [esp], eax
pushal
bswap ax
mov eax, 0x106292e
mov byte [esp + 4], 0xd2
call fcn.0103e1f0
outsd dx, dword [esi]
scasd eax, dword es:[edi]
mov al, byte [0xd0bbaa89]
invalid

Function at 0x10e5ac0
Capabilities:
Packed with generic packer

Disassembly:
and al, 0x30
mov byte [esp + 0xc], 6
lea esi, [esi + 1]
pushfd
mov dword [esp + 0x34], esi
bswap esi
lea esp, [esp + 0x30]
jae 0x114a955
pushfd
pushfd
mov esi, 0x107290a
mov byte [esp + 4], ch
call fcn.010a3b1a
inc dword [edx + 0x53]
push eax
outsd dx, dword [esi]
popal
xchg esp, eax
out 0x23, eax
insd dword es:[edi], dx
outsd dx, dword [esi]
je 0x10e5b77
jb 0x10e5a8b
jl 0x10e5a93
jle 0x10e5b77
cmp byte [ebp + 0x62], 0x71
jl 0x10e5af8
adc dword [edi + 0x6d0eea96], eax
inc esp
pop ss
and al, byte [eax - 0x7f]
fld qword [esi]
mov ecx, 0xd1d0c6bb
sar byte [ecx - 0x68], cl
movsb byte es:[edi], byte [esi]
pop ebx
xor byte [ebx + eax*4 + 0x65], dh
leave
mov ch, 0xe
add byte [ebp + 0x6f], ch
je 0x10e5ba0
mov bh, byte [edi + ebx - 0x79]
invalid
ja fcn.010e5b55
lodsd eax, dword [esi]
mov bp, 0x1bb0
mov ebp, 0x1051bb0
pushal
invalid
jo 0x10e5b71
invalid
pop esp
and al, 0x50
push 0x3577cb0d
mov byte [esp], 0xc5
call fcn.0110332f
push eax
mov dword [esp], eax
mov esi, dword [esi + 0xa7713]
call fcn.010c2573
pushal
call fcn.01142ce8
pushal
pushfd
push eax
mov dword [esp + 0x24], 0x787f09cf
jmp 0x1111e6d
bswap si
mov esi, 0x107290a
jmp 0x1129a24

Function at 0x110a8df
Capabilities:
Encode data using xor

Disassembly:
push es
popfd
inc ebx
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x10], ebp
movzx bp, cl
bswap bp
push 0x60cc4044
mov ebp, 0x101f282
push dword [esp + 4]
call fcn.011156d9
and dword [esi], 0x2d3b3c2b
sub bl, dh
mov word [edi], gs
xor dl, 1
add edi, edi
je 0x110a91b
add al, 0xe8
fsubr qword [ebp + 0x26810000]
sub edi, dword [ebx + edi]
sub eax, 0x2f8cde2a
jns 0x110a8c6
salc
fnstsw ax
leave
mov esi, 0xdabdd8b7
jecxz 0x110a8f0
invalid
lodsb al, byte [esi]
push 0x24
div esi
sub dword [0xd3d14c2d], ecx
into
fsub dword [ecx]
xchg dword [edx + 0x344540b4], edx
and esp, dword [esi]
cmpsb byte [esi], byte es:[edi]
test eax, 0xb9ca9e9b
ja 0x110a93d
inc ecx
cmp al, 0xb2
aam 0x3a
mov eax, dword [0x2b44de1f]
cmp ah, byte [ecx + 0x2b44de1f]
sbb bh, bh
push ss
insd dword es:[edi], dx
hlt

Function at 0x11156d9
Capabilities:
Packed with generic packer

Disassembly:
mov ebp, dword [ebp + 0xb81fd]
jmp 0x10e5aaf

Function at 0x111621f
Capabilities:
Packed with generic packer

Disassembly:
push edi
call fcn.0110276b
pop ecx
dec byte [edi]
clc
or esi, dword [edx - 0x39055bf5]
cdq
lea esp, [esp + 0x50]
ja 0x10cd807
push ebp
xchg dword [esp + 4], edi
push 0xce55b286
push dword [esp]
push dword [esp + 0xc]
ret 0x10
lea edi, [edi + 0x246fe02]
mov word [esp + 0xc], 0xdf48
jmp 0x10ec790
Function at 0x1131577
Capabilities:
Encode data using xor

Disassembly:
call fcn.010c01ef
aad 0x38
sub eax, 0xdf4ff12
push es
sbb ebx, dword [ecx + eax]
invalid
Function at 0x4075e1
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x408156
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x28], 0x10
jb 0x408161
mov ecx, dword [ecx + 0x14]
jmp 0x408164
add ecx, 0x14
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret

Function at 0x4091c9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x42a54f
call fcn.0041c1e4
sub esp, 0x50
push esi
mov esi, ecx
cmp dword [esi + 0x28], 0x10
push edi
jb 0x4091e5
mov eax, dword [esi + 0x14]
jmp 0x4091e8
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
push 0x42d3b8
lea ecx, [ebp - 0x5c]
mov edi, eax
call fcn.00408f3d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
push eax
xor eax, eax
cmp edi, 0xffffffff
setne al
mov ecx, esi
push eax
call fcn.00408b39
lea ecx, [ebp - 0x5c]
call fcn.00403cad
mov ecx, dword [ebp - 0xc]
mov eax, edi
shr eax, 4
not eax
pop edi
and eax, 1
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40923f
Capabilities:
Get file size

Disassembly:
mov eax, 0x42a569
call fcn.0041c1e4
sub esp, 0x60
push ebx
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x1c], esi
lea edi, [ebp - 0x18]
mov ebx, ecx
stosd dword es:[edi], eax
call fcn.004091c9
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x409302
cmp dword [ebx + 0x28], 0x10
mov dword [ebp - 0x14], ecx
jb 0x40927a
mov edi, dword [ebx + 0x14]
jmp 0x40927d
lea edi, [ebx + 0x14]
push ebx
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push 3
call fcn.0040ad22
push eax
push 3
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040f176
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.0040a81a
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
jne 0x4092cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4092d0
xor esi, esi
inc esi
push 0x42d3b8
lea ecx, [ebp - 0x6c]
call fcn.00408f3d
lea ecx, [ebp - 0x24]
push ecx
push eax
push esi
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.00408b39
lea ecx, [ebp - 0x6c]
call fcn.00403cad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040abca
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40939e
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x42a54f
call fcn.0041c1e4
sub esp, 0x50
push esi
mov esi, ecx
cmp dword [esi + 0x28], 0x10
push edi
jb 0x4093ba
mov eax, dword [esi + 0x14]
jmp 0x4093bd
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
push 0x42d3b8
lea ecx, [ebp - 0x5c]
mov edi, eax
call fcn.00408f3d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
push eax
xor eax, eax
cmp edi, 0xffffffff
setne al
mov ecx, esi
push eax
call fcn.00408b39
lea ecx, [ebp - 0x5c]
call fcn.00403cad
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
and eax, 1
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4093ab
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x42a54f
call fcn.0041c1e4
sub esp, 0x50
push esi
mov esi, ecx
cmp dword [esi + 0x28], 0x10
push edi
jb 0x4093ba
mov eax, dword [esi + 0x14]
jmp 0x4093bd
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
push 0x42d3b8
lea ecx, [ebp - 0x5c]
mov edi, eax
call fcn.00408f3d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
push eax
xor eax, eax
cmp edi, 0xffffffff
setne al
mov ecx, esi
push eax
call fcn.00408b39
lea ecx, [ebp - 0x5c]
call fcn.00403cad
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
and eax, 1
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40940f
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov eax, 0x42a5a0
call fcn.0041c1e4
sub esp, 0x9c
push esi
mov esi, ecx
cmp dword [esi + 0x28], 0x10
jb 0x40942d
mov eax, dword [esi + 0x14]
jmp 0x409430
lea eax, [esi + 0x14]
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
mov edi, 0x42d3b8
push edi
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00408f3d
lea ecx, [ebp - 0x18]
push ecx
push eax
xor eax, eax
cmp dword [ebp - 0x10], 0xffffffff
mov ecx, esi
setne al
mov dword [ebp - 4], ebx
push eax
call fcn.00408b39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.00403cad
cmp byte [ebp + 8], bl
je 0x409482
or dword [ebp - 0x10], 1
jmp 0x409486
and dword [ebp - 0x10], 0xfffffffe
push edi
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00408f3d
cmp dword [esi + 0x28], 0x10
pop edi
mov dword [ebp - 4], 1
pop ebx
jb 0x4094ac
mov ecx, dword [esi + 0x14]
jmp 0x4094af
lea ecx, [esi + 0x14]
lea edx, [ebp - 0x18]
push edx
push eax
push dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push eax
mov ecx, esi
call fcn.00408b39
lea ecx, [ebp - 0xa8]
call fcn.00403cad
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x409560
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x42a5ba
call fcn.0041c1e4
sub esp, 0x6c
push esi
mov esi, ecx
call fcn.00403f89
cmp eax, 1
jbe 0x409646
push ebx
push edi
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
call fcn.00401824
mov eax, dword [esi + 8]
mov edi, dword [esi + 4]
mov dword [ebp - 4], ebx
add eax, 0xffffffe4
jmp 0x409631
push 0xffffffffffffffff
push ebx
push edi
call fcn.00403a93
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4095b8
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40961c
push ebx
push 0x42ecc4
mov ecx, edi
call fcn.00408176
test eax, eax
je 0x40961c
push 0x42d3b8
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00408f3d
cmp dword [ebp - 0x18], 0x10
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 1
jae 0x4095f8
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x14]
push edx
push eax
mov eax, dword [ebp + 8]
push dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push eax
mov ecx, esi
call fcn.00408b39
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], bl
call fcn.00403cad
push 0x5c
push 1
lea ecx, [ebp - 0x30]
call fcn.004038fc
mov eax, dword [esi + 8]
add edi, 0x1c
sub eax, 0x1c
cmp edi, eax
lea ecx, [ebp - 0x30]
jne 0x4095a3
push ebx
push 1
call fcn.00401ef6
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40a393
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x42a752
call fcn.0041c1e4
sub esp, 0x1d8
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
push edi
mov edi, ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
call fcn.004091c9
test eax, eax
jne 0x40a4f4
push str..
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0040870f
add esp, 0xc
cmp dword [ebp - 0x28], 0x10
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 1
jae 0x40a3ea
lea eax, [ebp - 0x3c]
push esi
lea ecx, [ebp - 0x1e4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x40a4b6
push dword [0x43925c]
lea eax, [ebp - 0x1b8]
push eax
call fcn.0041cab4
test eax, eax
pop ecx
pop ecx
je 0x40a483
push dword [0x439258]
lea eax, [ebp - 0x1b8]
push eax
call fcn.0041cab4
test eax, eax
pop ecx
pop ecx
je 0x40a483
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00402848
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0xa4]
push edi
push eax
mov byte [ebp - 4], 2
call fcn.0040974d
add esp, 0xc
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.0040a353
lea ecx, [ebp - 0xa4]
call fcn.00403cad
push ebx
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.00401ef6
lea eax, [ebp - 0x1e4]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a405
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
je 0x40a405
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40a4be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x12
je 0x40a4e5
cmp esi, 2
je 0x40a4e5
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp + 8], esi
call fcn.0040ab77
push 0x433620
lea eax, [ebp - 0x14]
push eax
call fcn.0041c394
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.00401ef6
pop esi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call fcn.0040a2e5
lea ecx, [ebp - 0x24]
call fcn.00404e4a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40a51b
Capabilities:
Delete directory
Delete file

Disassembly:
mov eax, 0x42a76c
call fcn.0041c1e4
sub esp, 0x58
push ebx
push esi
xor ebx, ebx
cmp byte [ebp + 8], bl
push edi
mov esi, ecx
je 0x40a566
lea eax, [ebp - 0x1c]
push eax
call fcn.0040a393
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], ebx
jmp 0x40a555
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call fcn.0040a51b
add edi, 0x48
cmp edi, dword [ebp - 0x14]
jne 0x40a545
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404e4a
cmp byte [ebp + 0xc], bl
je 0x40a573
push ebx
mov ecx, esi
call fcn.0040940f
mov ecx, esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.004091c9
test eax, eax
jne 0x40a59b
cmp dword [esi + 0x28], 0x10
jb 0x40a58f
mov eax, dword [esi + 0x14]
jmp 0x40a592
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x40a5b0
cmp dword [esi + 0x28], 0x10
jb 0x40a5a6
mov eax, dword [esi + 0x14]
jmp 0x40a5a9
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x42d3b8
lea ecx, [ebp - 0x64]
mov edi, eax
call fcn.00408f3d
lea ecx, [ebp - 0x14]
push ecx
push eax
push edi
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00408b39
lea ecx, [ebp - 0x64]
call fcn.00403cad
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40a5ec
Capabilities:
Copy file

Disassembly:
mov eax, 0x42a786
call fcn.0041c1e4
sub esp, 0x58
push ebx
push esi
mov esi, ecx
call fcn.004091c9
xor ebx, ebx
sub eax, ebx
je 0x40a656
dec eax
jne 0x40a6c8
mov eax, dword [ebp + 8]
cmp dword [eax + 0x28], 0x10
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
jb 0x40a624
mov edi, dword [eax + 0x14]
jmp 0x40a627
lea edi, [eax + 0x14]
cmp dword [esi + 0x28], 0x10
jb 0x40a632
mov ecx, dword [esi + 0x14]
jmp 0x40a635
lea ecx, [esi + 0x14]
lea edx, [ebp - 0x14]
push edx
push eax
xor eax, eax
cmp byte [ebp + 0xc], bl
sete al
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push eax
mov ecx, esi
call fcn.00408b39
pop edi
jmp 0x40a6c8
call fcn.00401388
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call fcn.004094e0
cmp byte [ebp + 0x10], bl
je 0x40a6c8
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.0040a393
mov esi, dword [ebp - 0x18]
mov dword [ebp - 4], ebx
jmp 0x40a6bb
mov eax, dword [esi + 8]
add eax, 0xffffffe4
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x64]
push eax
call fcn.0040974d
add esp, 0xc
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
push eax
call fcn.0040a5ec
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.00403cad
add esi, 0x48
cmp esi, dword [ebp - 0x14]
jne 0x40a685
lea ecx, [ebp - 0x1c]
call fcn.00404e4a
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc