joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a850
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x110]
call fcn.0048a650
pop edi
add esp, 0x104
ret 4

Function at 0x495e20
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x495e53
push esi
call fcn.0049ab50
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x495e4c
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x495ed9
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x495ec2
mov eax, dword [esi + 8]
test eax, eax
je 0x495e77
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x495ebe
cmp eax, 2
je 0x495ec2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x495e6a
cmp eax, 3
je 0x495e9d
cmp eax, 1
jne 0x495e6a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x495e6a
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x495e6a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00495f10
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x495ef9
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.00495f10
add esp, 4
pop esi
ret

Function at 0x4ddb47
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4ddb7f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004dbbd4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004dbbac
jmp 0x4ddb8b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4df238
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4df27a
call fcn.004e4fad
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4df27a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4df271
xor eax, eax
jmp 0x4df282
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004df288
pop edi
pop esi
pop ebx
ret 4
Function at 0x4e54dd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4e550b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4e5529
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004e5443
jmp 0x4e5529
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4e5529
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004e5443
test edi, edi
mov eax, edi
jne 0x4e5513
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4ad01624
Capabilities:
Set environment variable

Disassembly:
xor esi, esi
jmp 0x4ad01651
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
mov byte [0x4ad24045], 0
je 0x4ad01651
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad0163d
sub eax, edx
sar eax, 1
je 0x4ad0140a
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push dword [0x4ad2416c]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.4ad0168d
mov dword [0x4ad2416c], eax
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret 8

Function at 0x4ad0168d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
xor esi, esi
test edi, edi
je 0x4ad016d1
push ebx
push edi
call fcn.4ad016db
mov ebx, eax
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4ad016c9
push ebx
push edi
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
pop edi
mov eax, esi
pop esi
ret

Function at 0x4ad01d0c
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4ad2406c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [ebp + 8]
and word [ebp - 6], 0
mov word [ebp - 0xc], ax
mov ax, word [0x4ad40604]
mov word [ebp - 8], ax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xa], 0x3a
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.4ad013fa
leave
ret 4
Function at 0x4ad01e9d
Capabilities:
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x4ad01eb6
cmp dword [0x4ad24074], 0
je 0x4ad09afc
leave
ret 4
cmp dword [0x4ad2409c], 0
jne 0x4ad01eb6
push edi
push 0x20c
call fcn.4ad01e3d
mov edi, eax
test edi, edi
mov dword [ebp - 4], edi
je 0x4ad09bbb
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
test eax, eax
je 0x4ad09bbb
mov ecx, dword [ebp + 8]
push esi
lea esi, [ecx + 2]
mov dx, word [ecx]
inc ecx
inc ecx
test dx, dx
jne 0x4ad09b3c
mov edx, dword [0x4ad24100]
sub ecx, esi
sar ecx, 1
add edx, ecx
lea esi, [edx + eax + 0xa]
lea eax, [esi + esi]
push eax
push edi
call fcn.4ad020f1
mov edi, eax
test edi, edi
je 0x4ad09bb2
cmp byte [0x4ad24043], 0
mov dword [ebp - 4], edi
jne 0x4ad193f1
push 0x4ad09bc4
push esi
push edi
call fcn.4ad014d2
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad09b87
push dword [ebp + 8]
sub eax, edx
push esi
sar eax, 1
push edi
mov dword [0x4ad24100], eax
call fcn.4ad014d2
mov byte [0x4ad24043], 1
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push dword [ebp - 4]
call fcn.4ad01773
pop esi
pop edi
jmp 0x4ad01eb6
mov eax, dword [0x4ad24100]
push dword [ebp + 8]
sub esi, eax
push esi
lea eax, [edi + eax*2]
push eax
call fcn.4ad01416
jmp 0x4ad09bab

Function at 0x4ad02163
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and word [0x4ad305e0], 0
push esi
push edi
mov edi, 0x2000
push edi
mov esi, 0x4ad305e0
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4ad033d9
mov eax, esi
pop edi
pop esi
pop ebp
ret 4
cmp byte [0x4ad24041], 0
push ebx
je 0x4ad034a6
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x4ad24580
push dword [ebp + 8]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x4ad10496
push str.ERRORLEVEL
push dword [ebp + 8]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x4ad04f23
push str.CMDEXTVERSION
push dword [ebp + 8]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x4ad14c48
push 0x4ad0347c
push dword [ebp + 8]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x4ad14c4f
push str.DATE
push dword [ebp + 8]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x4ad1207f
push str.TIME
push dword [ebp + 8]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x4ad03492
push edi
push esi
push 1
push eax
call fcn.4ad1024b
and word [eax*2 + 0x4ad305e0], 0
mov eax, esi
pop ebx
jmp 0x4ad02191
push 0x4ad034ac
push dword [ebp + 8]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x4ad0883c
xor eax, eax
jmp 0x4ad03476
push 0x4ad04234
push edi
push esi
call fcn.4ad01710
add esp, 0x10
jmp 0x4ad03474
push dword [0x4ad24130]
jmp 0x4ad04f0f
call dword [sym.imp.msvcrt.dll_rand]
push eax
jmp 0x4ad04f0f
push eax
push edi
push esi
call fcn.4ad0363f
jmp 0x4ad03474
push edi
push esi
push 1
push eax
call fcn.4ad11d1c
jmp 0x4ad0346b
push 2
jmp 0x4ad04f0f
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x4ad03476
Function at 0x4ad034bf
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
xor ebx, ebx
cmp byte [0x4ad405ec], bl
pop ecx
mov dword [ebp + 8], eax
jne 0x4ad17efa
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp + 0xc], eax
mov edi, 0x4ad265e0
mov esi, 0x2000
cmp dword [ebp + 0x10], esi
ja 0x4ad17f0e
cmp dword [ebp + 0x10], ebx
je 0x4ad12524
push ebx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push dword [0x4ad24160]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
mov ebx, dword [ebp + 0x14]
mov esi, eax
push ebx
dec esi
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ad1252c
cmp dword [ebx], esi
jne 0x4ad1252c
mov eax, dword [ebp - 8]
mov dword [ebx], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
mov ebx, dword [ebp + 0x14]
jmp 0x4ad03545
xor eax, eax
jmp 0x4ad0354d
push ebx
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4ad0354e
push ebx
push ebx
push esi
push edi
push 0x1000
push dword [ebp + 0xc]
push ebx
push dword [0x4ad24160]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add dword [ebp + 0xc], esi
sub dword [ebp + 0x10], esi
push ebx
push dword [ebp + 0x14]
mov dword [ebp - 4], eax
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ad1252c
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], eax
je 0x4ad034fa
jmp 0x4ad1252c

Function at 0x4ad0363f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4ad2406c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [ebp + 0x10], 0
push esi
mov esi, dword [ebp + 8]
jne 0x4ad0d906
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.4ad013fa
leave
ret 0xc
push edi
push dword [ebp + 0x10]
mov edi, dword [sym.imp.msvcrt.dll_towupper]
mov word [ebp - 0xc], 0x3d
call edi
and word [ebp - 6], 0
mov word [ebp - 0xa], ax
pop ecx
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 8], 0x3a
call fcn.4ad02163
test eax, eax
je 0x4ad194dc
push eax
push dword [ebp + 0xc]
push esi
call fcn.4ad01416
xor eax, eax
pop edi
jmp 0x4ad0366c
push dword [ebp + 0x10]
call edi
mov word [esi], ax
inc esi
inc esi
mov word [esi], 0x3a
inc esi
inc esi
mov word [esi], 0x5c
and word [esi + 2], 0
xor eax, eax
pop ecx
inc eax
jmp 0x4ad0d945
Function at 0x4ad03de7
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4ad2406c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [ebp + 8]
mov word [ebp - 0x10], ax
mov ax, word [0x4ad40604]
push esi
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x10]
xor esi, esi
push eax
mov word [ebp - 0xe], 0x3a
mov word [ebp - 0xa], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4ad191b7
cmp eax, 2
je 0x4ad03e61
cmp eax, 5
je 0x4ad03e61
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4ad191bf
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.4ad013fa
leave
ret 4
xor eax, eax
inc eax
jmp 0x4ad03e63
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4ad03e61
jmp 0x4ad191b7
Function at 0x4ad03f22
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
push edi
inc ebx
xor edi, edi
and eax, 3
cmp eax, 2
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0xc
ja 0x4ad06378
test byte [ebp + 0xc], bl
jne 0x4ad0636e
cmp eax, edi
mov esi, 0x80000000
jne 0x4ad06333
mov dword [ebp - 8], esi
push 3
cmp dword [ebp + 0xc], 0x10a
pop eax
push edi
je 0x4ad05f7c
push 0x80
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ad104d0
push 8
push ebx
call dword [sym.imp.msvcrt.dll__open_osfhandle]
test byte [ebp + 0xc], 8
pop ecx
pop ecx
mov dword [ebp + 0x10], eax
jne 0x4ad05fae
push dword [ebp + 0x10]
call fcn.4ad03fcb
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc
mov edi, 0x80
push edi
push 3
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp - 8]
or eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
push dword [ebp + 8]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ad104b1
xor edi, edi
jmp 0x4ad03f9c
push eax
call fcn.4ad015ca
test eax, eax
jne 0x4ad03fb4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x4ad03fb4
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
or dword [ebp - 4], 0xffffffff
push 2
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0xc], edi
call esi
cmp eax, 0xffffffff
je 0x4ad191f4
push edi
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ad19228
cmp word [ebp - 0xc], 0x1a
jne 0x4ad03fb4
jmp 0x4ad1923a
push 0x4ad04270
push dword [ebp + 8]
mov dword [ebp - 8], 0x40000000
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x4ad06351
mov dword [ebp + 0x10], ebx
push 2
jmp 0x4ad03f69
test byte [ebp + 0xc], 8
je 0x4ad03f57
or eax, 0xffffffff
jmp 0x4ad03fbf
push 0
push edi
push 4
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4ad05fa7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6e
mov dword [0x4ad240e0], eax
jne 0x4ad06378
jmp 0x4ad191e5
mov dword [0x4ad240e0], 2
jmp 0x4ad06378
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
mov dword [0x4ad240e0], eax
je 0x4ad05fed
cmp dword [ebp + 0x10], 0xffffffff
je 0x4ad1921c
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll__close]
pop ecx
jmp 0x4ad06378
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4ad06378
push 2
lea eax, [ebp - 4]
push eax
push edi
push ebx
mov dword [ebp - 4], edi
call esi
jmp 0x4ad06007
or dword [ebp - 4], 0xffffffff
push 2
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push ebx
call esi
jmp 0x4ad03fb4
Function at 0x4ad048cc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 1
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
mov edi, 0x4ad265e0
mov esi, edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xc], eax
mov eax, 0x1fff
cmp dword [ebp + 0x10], eax
jae 0x4ad04990
push ebx
push dword [ebp + 0x14]
mov dword [0x4ad240b0], 1
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
mov dword [0x4ad240b0], ebx
je 0x4ad0537d
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, ebx
je 0x4ad0537d
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
jle 0x4ad0496c
nop
nop
nop
nop
cmp dword [ebp - 4], 3
jl 0x4ad04954
mov al, byte [esi]
cmp al, 0xa
je 0x4ad05384
cmp al, 0xd
je 0x4ad049a6
movzx eax, byte [esi]
cmp byte [eax + 0x4ad24de0], bl
jne 0x4ad13e66
dec dword [ebp - 4]
inc esi
cmp dword [ebp - 4], ebx
jg 0x4ad04940
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
push edi
push 1
push dword [0x4ad24160]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
leave
ret 0x10
mov dword [ebp + 0x10], eax
jmp 0x4ad048fe
cmp byte [esi + 1], 0xa
jne 0x4ad04954
mov eax, dword [ebp - 0xc]
mov byte [esi + 2], bl
sub esi, edi
inc esi
inc esi
push ebx
push ebx
mov dword [ebp - 8], esi
add esi, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4ad0496c
xor eax, eax
jmp 0x4ad04989
cmp byte [esi + 1], 0xd
jne 0x4ad04950
jmp 0x4ad049ac
xor eax, eax
inc eax
cmp dword [ebp - 4], eax
je 0x4ad13e79
sub dword [ebp - 4], 2
inc esi
inc esi
jmp 0x4ad04967
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
inc esi
push esi
push dword [ebp + 8]
mov dword [0x4ad240b0], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
mov dword [0x4ad240b0], 1
je 0x4ad13eaa
cmp dword [ebp - 4], ebx
je 0x4ad13eaa
inc dword [ebp - 8]
jmp 0x4ad0496c
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
jmp 0x4ad0537d
Function at 0x4ad05ebf
Capabilities:
Manipulate console buffer
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xffff7fff
cmp eax, 2
je 0x4ad13f68
pop ebp
jmp fcn.4ad048cc
pop ebp
jmp fcn.4ad1b3d6
Function at 0x4ad07544
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x66c
mov eax, dword [0x4ad2406c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4ad19419
push esi
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x208
push edi
call fcn.4ad0156d
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov esi, eax
test esi, esi
je 0x4ad07624
push 4
lea eax, [ebp - 0x414]
push 0x4ad07638
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x4ad19420
mov eax, dword [ebp - 0x668]
test eax, eax
je 0x4ad0fedb
cmp word [eax], 0
je 0x4ad0fedb
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x664]
push eax
push 0x37
lea eax, [ebp - 0x414]
push eax
call fcn.4ad01c2d
push dword [ebp - 0x66c]
movzx esi, al
call fcn.4ad01c51
test esi, esi
jne 0x4ad07624
cmp word [ebp - 0x412], 0x5c
je 0x4ad08848
cmp word [ebp - 0x412], 0x3a
jne 0x4ad07624
cmp word [ebp - 0x410], 0x5c
jne 0x4ad07624
cmp word [ebp - 0x40e], si
je 0x4ad08848
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.4ad013fa
leave
ret 4
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4ad07624
jmp 0x4ad19476
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
jmp 0x4ad07624
xor eax, eax
jmp 0x4ad07627
lea eax, [ebp - 0x40c]
push eax
push edi
mov dword [ebp - 0x668], eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x668], eax
je 0x4ad19461
cmp eax, edi
jbe 0x4ad19461
movzx esi, word [eax]
and word [eax], 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov eax, dword [ebp - 0x668]
mov word [eax], si
mov eax, ecx
jmp 0x4ad1946a
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
inc eax
neg eax
sbb eax, eax
and eax, ecx
jmp 0x4ad07626
xor esi, esi
inc esi
jmp 0x4ad07624
Function at 0x4ad08468
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4ad2406c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x24
call fcn.4ad01f03
mov esi, eax
push esi
mov dword [esi], edi
call fcn.4ad082c6
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0xc]
mov dword [ebp - 0x214], eax
mov eax, dword [esi]
push 0x208
mov dword [ebp - 0x210], eax
call fcn.4ad01f03
push 0
mov edi, 0x104
push edi
push eax
mov dword [0x4ad240dc], eax
call fcn.4ad0363f
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.4ad01a75
test eax, eax
jne 0x4ad119b3
movzx eax, word [0x4ad40604]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad01a11
and word [eax + 2], 0
lea eax, [ebp - 0x20c]
push eax
push edi
push 0x4ad25200
call fcn.4ad01416
test ebx, ebx
je 0x4ad08586
movzx eax, word [ebx]
cmp ax, 0x3a
je 0x4ad08586
cmp ax, word [0x4ad40604]
jne 0x4ad08553
cmp ebx, dword [ebp - 0x210]
je 0x4ad119bb
push ebx
push dword [ebp - 0x210]
call fcn.4ad085ad
movzx eax, word [eax]
cmp ax, 0x3a
je 0x4ad119bb
cmp ax, word [0x4ad40604]
je 0x4ad119bb
movzx edi, word [ebx]
push dword [ebp - 0x210]
and word [ebx], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad119c2
and dword [0x4ad240e0], 0
mov word [ebx], di
cmp dword [0x4ad240e0], 0
jne 0x4ad119b3
push esi
call fcn.4ad082c6
mov eax, dword [ebp - 0x214]
mov dword [esi + 0x18], eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad013fa
leave
ret 4
xor eax, eax
inc eax
jmp 0x4ad08597
inc ebx
inc ebx
jmp 0x4ad08553
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad240e0], eax
jmp 0x4ad08576
Function at 0x4ad09061
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
and dword [esi], 0
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push 0x4ad09098
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4ad169a4
pop esi
leave
ret 4
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push 0x4ad169d4
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ad09092
Function at 0x4ad0cc6b
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
push ebx
push esi
push edi
push 2
pop esi
jne 0x4ad0cc81
push 3
pop esi
mov ebx, dword [ebp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
and dword [ebx], 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
je 0x4ad153cd
xor eax, eax
inc eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4ad15414
push 0x400023d4
push 0x400023d3
push dword [ebp + 0xc]
call fcn.4ad1f563
sub eax, 0
je 0x4ad1540c
dec eax
dec eax
jne 0x4ad153fb
mov eax, dword [ebp + 0x10]
and dword [eax], 0
or esi, 1
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
jmp 0x4ad0cca1
xor eax, eax
inc eax
jmp 0x4ad0cca3
xor eax, eax
jmp 0x4ad0cca3