joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41094c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor byte [eax], al
add byte [eax], al
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x410944
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.0040e780
fisttp qword [ebx]
or dword [ebx], 0xffffff8b
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.0040e780
mov al, 0xd2
in eax, dx
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x41096d
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x41096d
call fcn.0040e780
loopne 0x410931
invalid

Function at 0x4114a6
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
xor esi, esi
neg eax
sbb eax, eax
and eax, 7
add eax, 0x1c
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call fcn.004312d0
mov ebx, eax
cmp ebx, esi
jge 0x4114f8
mov eax, 0x43e720
cmp dword [ebp + 8], esi
jne 0x4114e7
mov eax, 0x43e716
push eax
push 0x43e6ea
push ebx
call fcn.00430a6a
add esp, 0xc
jmp 0x411562
mov dword [ebp - 0x10], esi
cmp dword [edi + 4], esi
jbe 0x411562
mov dword [ebp + 8], esi
mov esi, dword [edi]
add esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
push dword [ebp - 0xc]
call fcn.00431306
mov ebx, eax
test ebx, ebx
js 0x411553
lea eax, [ebp - 8]
push eax
push dword [esi]
push dword [ebp - 4]
call fcn.00431306
mov ebx, eax
test ebx, ebx
js 0x411553
push dword [ebp - 8]
call fcn.00434de6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add dword [ebp + 8], 0xc
cmp eax, dword [edi + 4]
jb 0x411503
jmp 0x411560
push 0x43e6c4
push ebx
call fcn.00430a6a
pop ecx
pop ecx
xor esi, esi
cmp dword [ebp - 8], esi
je 0x41156f
push dword [ebp - 8]
call fcn.0042eb62
cmp dword [ebp - 4], esi
je 0x41157c
push dword [ebp - 4]
call fcn.0042eb62
cmp dword [ebp - 0xc], esi
je 0x411589
push dword [ebp - 0xc]
call fcn.0042eb62
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x412b58
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push 0
lea eax, [ebp - 4]
push eax
push dword [edi + 0x14]
push dword [ebp + 8]
call fcn.00414064
mov esi, eax
test esi, esi
jns 0x412b81
push 0x43f454
jmp 0x412bed
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x412bce
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x412ba3
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
je 0x412bf7
cmp esi, 0x80070003
je 0x412bf7
test esi, esi
jns 0x412c0d
push dword [ebp - 4]
push dword [edi]
push 0x43f41c
push esi
call fcn.00430a6a
add esp, 0x10
jmp 0x412c0d
test al, 0x10
jne 0x412bf7
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 8]
call fcn.00415a3a
mov esi, eax
test esi, esi
jns 0x412ba5
push 0x43f3f0
push esi
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x412c0d
push dword [ebp - 4]
push dword [edi]
push 0x43f376
push 1
call fcn.004306ba
add esp, 0x10
xor esi, esi
cmp dword [ebp - 4], 0
je 0x412c1b
push dword [ebp - 4]
call fcn.0042eb62
mov eax, esi
pop esi
leave
ret 4
Function at 0x412c22
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], 1
cmp dword [edi + 0x24], ebx
je 0x412c4d
mov dword [ebp - 0xc], 0x101
push ebx
lea eax, [ebp - 4]
push eax
push dword [edi + 0x1c]
push dword [ebp + 8]
call fcn.00414064
mov esi, eax
cmp esi, ebx
jge 0x412c6d
push 0x43f5aa
jmp 0x412d71
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [edi + 0x18]
call fcn.0043259a
mov esi, eax
cmp esi, ebx
jl 0x412cb5
mov eax, dword [edi + 0x20]
mov dword [ebp - 0xc], 1
cmp eax, ebx
je 0x412d54
push ebx
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 8]
call fcn.00414064
mov esi, eax
cmp esi, ebx
jge 0x412ce4
push 0x43f58a
jmp 0x412d71
push dword [ebp - 4]
cmp esi, 0x80070002
jne 0x412cd1
push 0x43f566
push 1
call fcn.004306ba
add esp, 0xc
jmp 0x412d48
push 0x43f53c
push esi
call fcn.00430a6a
add esp, 0xc
jmp 0x412d79
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
sub ecx, ebx
je 0x412d4d
dec ecx
dec ecx
je 0x412d33
cmp eax, ebx
je 0x412d54
jle 0x412d11
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x412d1c
mov esi, 0x80004005
push esi
push 0x30f
push 0x43f504
call fcn.004315c0
push 0x43f4e0
jmp 0x412d71
push dword [ebp - 8]
push dword [ebp - 4]
push 0x43f4aa
push 1
call fcn.004306ba
add esp, 0x10
mov dword [ebp - 0xc], ebx
jmp 0x412d54
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
push ebx
cdq
push edx
push eax
push dword [edi + 4]
push dword [ebp + 8]
call fcn.004159f8
mov esi, eax
cmp esi, ebx
jge 0x412d90
push 0x43f3a0
push esi
call fcn.00430a6a
pop ecx
pop ecx
cmp esi, ebx
jge 0x412d90
push esi
push dword [ebp - 4]
push 0x43f476
push 1
call fcn.004306ba
add esp, 0x10
cmp dword [ebp - 4], ebx
je 0x412d9d
push dword [ebp - 4]
call fcn.0042eb62
cmp dword [ebp - 8], ebx
je 0x412daa
push dword [ebp - 8]
call fcn.0042eb62
cmp dword [ebp - 0x10], ebx
je 0x412db8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x413c5a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push dword [edi + 0x14]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call fcn.00414064
mov esi, eax
cmp esi, ebx
jge 0x413c88
push 0x43f454
jmp 0x413d01
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x413cc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x413caa
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
je 0x413cbc
cmp esi, 0x80070003
jne 0x413ccb
xor esi, esi
jmp 0x413ccb
test al, 0x10
je 0x413ccb
mov dword [ebp - 8], 1
cmp esi, ebx
jge 0x413ce4
push dword [ebp - 4]
push dword [edi]
push 0x43ff04
push esi
call fcn.00430a6a
add esp, 0x10
jmp 0x413d09
mov eax, dword [ebp - 8]
push ebx
cdq
push edx
push eax
push dword [edi + 4]
push dword [ebp + 8]
call fcn.004159f8
mov esi, eax
cmp esi, ebx
jge 0x413d09
push 0x43f3a0
push esi
call fcn.00430a6a
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
je 0x413d16
push dword [ebp - 4]
call fcn.0042eb62
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x413d1e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push 0
lea eax, [ebp - 4]
push eax
push dword [edi + 0x14]
push dword [ebp + 8]
call fcn.00414064
mov esi, eax
test esi, esi
jns 0x413d47
push 0x43f454
jmp 0x413d8c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x413d6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x413d69
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x413d9b
test al, 0x10
je 0x413d96
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 8]
call fcn.00415a3a
mov esi, eax
test esi, esi
jns 0x413d9b
push 0x43ff7c
push esi
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x413ddb
mov esi, 0x80070003
cmp esi, 0x80070002
je 0x413dc4
cmp esi, 0x80070003
je 0x413dc4
test esi, esi
jns 0x413ddb
push dword [ebp - 4]
push dword [edi]
push 0x43ff04
push esi
call fcn.00430a6a
add esp, 0x10
jmp 0x413ddb
push esi
push dword [ebp - 4]
push dword [edi]
push 0x43ff40
push 1
call fcn.004306ba
add esp, 0x14
xor esi, esi
cmp dword [ebp - 4], 0
je 0x413de9
push dword [ebp - 4]
call fcn.0042eb62
mov eax, esi
pop esi
leave
ret 4
Function at 0x413df0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push dword [edi + 0x14]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.00414064
mov esi, eax
test esi, esi
jns 0x413e1d
push 0x43f454
jmp 0x413eb6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x413e8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x413e79
cmp eax, 3
je 0x413e79
test eax, eax
je 0x413e99
jle 0x413e4b
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x413e56
mov esi, 0x80004005
push esi
push 0x27d
push 0x43f504
call fcn.004315c0
push dword [edi + 0x14]
push 0x43ffaa
push esi
call fcn.00430a6a
add esp, 0xc
jmp 0x413ebe
push dword [ebp - 4]
push dword [edi]
push 0x43f376
push 1
call fcn.004306ba
add esp, 0x10
jmp 0x413e99
and eax, 0x10
cmp al, 0x10
je 0x413e99
xor ebx, ebx
inc ebx
push 0
mov eax, ebx
cdq
push edx
push eax
push dword [edi + 4]
push dword [ebp + 8]
call fcn.004159f8
mov esi, eax
test esi, esi
jns 0x413ebe
push 0x43f3a0
push esi
call fcn.00430a6a
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x413ecc
push dword [ebp - 4]
call fcn.0042eb62
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x4193cc
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp + 0x198], eax
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x70]
push edi
push eax
call fcn.00408720
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
mov esi, 0x104
push esi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x419458
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x419433
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x41943e
mov esi, 0x80004005
push esi
push 0x251
push 0x4428bc
call fcn.004315c0
push 0x4428a0
jmp 0x419506
lea eax, [ebp - 0x78]
push eax
push esi
lea eax, [ebp - 0x70]
push eax
call fcn.00419314
mov esi, eax
cmp esi, edi
jge 0x419476
push 0x44287a
jmp 0x419506
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4194ee
push dword [ebp - 0x80]
lea eax, [ebp - 0x74]
push 0x442872
push eax
call fcn.0043007e
mov esi, eax
add esp, 0xc
cmp esi, edi
jge 0x4194ac
push 0x442848
jmp 0x419506
lea eax, [ebp - 0x7c]
push eax
push SysReAllocString
push dword [ebp - 0x74]
call fcn.00419314
mov esi, eax
cmp esi, edi
jge 0x4194ca
push 0x44281c
jmp 0x419506
push dword [ebp - 0x7c]
mov esi, dword [ebp - 0x78]
push dword [ebp - 0x74]
sub esi, dword [ebp - 0x7c]
push dword [ebp - 0x7c]
lea eax, [ebp + esi*2 - 0x70]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x4194ee
mov dword [ebp - 0x78], esi
push dword [ebp - 0x78]
lea eax, [ebp - 0x70]
push eax
push ebx
call fcn.0042fb1a
mov esi, eax
cmp esi, edi
jge 0x41950e
push 0x442800
push esi
call fcn.00430a6a
pop ecx
pop ecx
cmp dword [ebp - 0x74], edi
je 0x41951b
push dword [ebp - 0x74]
call fcn.0042eb62
mov ecx, dword [ebp + 0x198]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00408498
add ebp, 0x19c
leave
ret
Function at 0x41a9f4
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
push ebx
push ebx
stosd dword es:[edi], eax
push 1
push ebx
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x41aa5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x41aa39
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x41aa47
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x3e
push 0x44319c
call fcn.004315c0
push 0x443220
jmp 0x41aabc
mov esi, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 0x41a83e
push ebx
push ebx
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x41aac8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x41aa9a
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x41aaa8
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x47
push 0x44319c
call fcn.004315c0
push 0x443200
push dword [ebp - 4]
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x41aae3
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [ebp - 8]
mov dword [esi + 0x1e0], eax
mov dword [ebp - 8], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x41aaf6
push dword [ebp - 8]
call esi
mov dword [ebp - 8], ebx
cmp dword [ebp - 0xc], ebx
je 0x41ab00
push dword [ebp - 0xc]
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x41ccf4
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push edi
push edi
push 1
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xc], eax
cmp eax, edi
jne 0x41cd58
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x41cd39
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x41cd44
mov esi, 0x80004005
push esi
push 0x44
push 0x4441ea
call fcn.004315c0
push 0x44428a
jmp 0x41cdbb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
push 0x41cb30
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x41cdc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x41cd9e
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x41cda9
mov esi, 0x80004005
push esi
push 0x4d
push 0x4441ea
call fcn.004315c0
push 0x44426e
push esi
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x41cdd4
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], edi
je 0x41cde7
push dword [ebp - 8]
call esi
mov dword [ebp - 8], edi
cmp dword [ebp - 0xc], edi
je 0x41cdf1
push dword [ebp - 0xc]
call esi
pop edi
pop esi
leave
ret 0xc

Function at 0x41df30
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
mov esi, ecx
call fcn.00408720
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x41dfaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41df88
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x41df93
mov esi, 0x80004005
push esi
push 0x41e
push 0x444898
call fcn.004315c0
push 0x44486c
jmp 0x41dfcb
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x43e63e
push edi
call fcn.0043007e
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x41dfd3
push 0x44482c
push esi
call fcn.00430a6a
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00408498
leave
ret
Function at 0x41e0de
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
mov ecx, 0x20000004
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x41e16b
lea eax, [ebp - 4]
push eax
push 0x1a
call fcn.0041e02e
mov esi, eax
cmp esi, edi
jge 0x41e116
push 0x44496e
jmp 0x41e15c
push 2
push 8
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x41e166
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x41e13c
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x41e147
mov esi, 0x80004005
push esi
push 0x55a
push 0x444898
call fcn.004315c0
push 0x444954
push esi
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x41e196
mov ecx, 0x20000005
push 0x7d0
push 3
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 4]
push ecx
push 1
push dword [ebp + 0xc]
call fcn.004364ea
push 0x80
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 4], edi
je 0x41e1a3
push dword [ebp - 4]
call fcn.004318fe
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x41f458
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x1e0]
sub esp, 0x260
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp + 0x1dc], eax
push ebx
push esi
mov esi, dword [ebp + 0x1ec]
xor ebx, ebx
push 0x250
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
call fcn.00408720
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push 0x4030ac
push dword [ebp + 0x1e8]
call fcn.0041ddaa
test eax, eax
js 0x41f4bc
push 7
push dword [ebp - 0x78]
call fcn.00435908
cmp dword [ebp + 0x1e8], ebx
jne 0x41f57a
push edi
lea edi, [ebp - 0x78]
mov ecx, esi
call fcn.0041df30
pop edi
test eax, eax
js 0x41f57a
lea eax, [ebp - 0x80]
push eax
push 0x445454
push dword [ebp - 0x78]
call fcn.00431306
test eax, eax
js 0x41f57a
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41f57a
test byte [ebp - 0x74], 0x10
jne 0x41f564
xor eax, eax
mov word [ebp + 0x1be], ax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jbe 0x41f548
push 0x2e
add eax, eax
pop ecx
cmp cx, word [ebp + eax - 0x4c]
jne 0x41f548
movzx eax, word [ebp + eax - 0x4a]
push 0x52
pop ecx
cmp cx, ax
je 0x41f564
push 0x72
pop ecx
cmp cx, ax
je 0x41f564
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x78]
call fcn.00431306
test eax, eax
js 0x41f564
push dword [ebp - 0x7c]
call fcn.00434de6
lea eax, [ebp - 0x74]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41f509
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x7c], ebx
je 0x41f587
push dword [ebp - 0x7c]
call fcn.0042eb62
cmp dword [ebp - 0x80], ebx
je 0x41f594
push dword [ebp - 0x80]
call fcn.0042eb62
cmp dword [ebp - 0x78], ebx
pop esi
pop ebx
je 0x41f5a3
push dword [ebp - 0x78]
call fcn.0042eb62
mov ecx, dword [ebp + 0x1dc]
xor ecx, ebp
call fcn.00408498
add ebp, 0x1e0
leave
ret 8
Function at 0x422ad4
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 0x2c
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.00408720
push 0x2c
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.00408720
mov esi, dword [ebp + 0x1c]
xor eax, eax
mov ebx, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x34]
add esp, 0x18
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x1c], esi
xor esi, esi
push esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x28]
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x40], ebx
mov ebx, dword [ebp + 0x28]
push 0x422824
mov dword [ebp - 0x5c], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebp + 0x2c]
push esi
push esi
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
jne 0x422bc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x422b98
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp ebx, esi
jl 0x422ba3
mov ebx, 0x80004005
push ebx
push 0x3c0
push 0x44622a
call fcn.004315c0
push 0x44732c
push ebx
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x422c09
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x4228d4
push dword [ebp + 0xc]
call fcn.0040dc24
mov ebx, eax
cmp ebx, esi
jge 0x422bec
push 0x44727c
push ebx
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x422c02
push edi
call fcn.004207e2
mov eax, dword [ebp + 0x38]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x3c]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x38
Function at 0x429676
Capabilities:
Copy file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 4]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
mov edi, 0x43b720
cmp eax, ebx
je 0x429696
mov ecx, dword [eax]
jmp 0x4296a3
mov ecx, dword [esi + 8]
cmp ecx, ebx
je 0x4296a1
mov ecx, dword [ecx]
jmp 0x4296a3
mov ecx, edi
mov edx, dword [esi + 0xc]
test edx, edx
je 0x4296ac
mov edi, dword [edx]
test eax, eax
je 0x4296be
xor eax, eax
test edx, edx
setne al
add eax, 0x20000150
jmp 0x4296cd
mov eax, dword [esi + 8]
neg eax
sbb eax, eax
and eax, 3
add eax, 0x2000014f
push dword [ebp + 8]
push 0x44a6c0
push edi
push ecx
push eax
push 1
call fcn.0040bfb2
add esp, 0x18
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.00434c1c
test eax, eax
je 0x429751
test byte [ebp - 4], 1
je 0x429751
and dword [ebp - 4], 0xfffffffe
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x429751
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x429720
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
js 0x42972b
mov ebx, 0x80004005
push ebx
push 0x4e2
push 0x44a4cc
call fcn.004315c0
push dword [ebp + 0xc]
push 0x44a682
push ebx
call fcn.00430a6a
add esp, 0xc
jmp 0x4297d9
push 0
lea edi, [esi + 0x20]
push edi
push esi
push fcn.00428ed2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x4297d9
cmp dword [edi], ebx
je 0x429796
mov esi, 0x80070642
push esi
push 0x4ec
push 0x44a4cc
mov ebx, esi
call fcn.004315c0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x44a652
push esi
jmp 0x4297d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4297aa
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
js 0x4297b5
mov ebx, 0x80004005
push ebx
push 0x4f0
push 0x44a4cc
call fcn.004315c0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x44a61e
push ebx
call fcn.00430a6a
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8