joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c660
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45c6ca
mov eax, ebx
call fcn.0045e6a0
test al, al
jne 0x45c6ca
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040547c
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x45c6b7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x45c6d7
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004053e0
jmp 0x45c6d7
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004053e0
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x45d8b4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45d922
mov eax, esi
call fcn.0044a24c
test al, al
je 0x45d922
mov eax, dword [ebx + 0x84]
call fcn.00449f40
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45d922
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45d916
push 0
mov eax, dword [ebx + 0x84]
call fcn.00449f40
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004420fc
jmp 0x45d922
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045d6f0
pop esi
pop ebx
ret
Function at 0x461b78
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040580c
xor eax, eax
push ebp
push 0x461cfe
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x461cca
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.004055fc
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409dcc
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409350
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409350
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004057b4
je 0x461c9d
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.004055fc
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409350
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409350
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004057b4
jne 0x461cb7
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x461bf8
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461d05
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004053b0
lea eax, [ebp - 4]
call fcn.0040538c
ret
Function at 0x461d98
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040580c
mov eax, dword [ebp - 8]
call fcn.0040580c
xor eax, eax
push ebp
push 0x461ea2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 1
call sub.kernel32.dll_Sleep_2
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403ab0
push 1
call sub.kernel32.dll_Sleep_2
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], 0x540
cmp byte [0x489c00], 0
je 0x461e0e
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x461e16
mov eax, 0x461eb4
mov dword [ebp - 0x38], eax
push 1
call sub.kernel32.dll_Sleep_2
lea ecx, [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00461d10
mov eax, dword [ebp - 0x48]
call fcn.00405cf8
mov dword [ebp - 0x34], eax
push 1
call sub.kernel32.dll_Sleep_2
lea ecx, [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00461d10
mov eax, dword [ebp - 0x4c]
call fcn.00405cf8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x461e7a
push 1
call sub.kernel32.dll_Sleep_2
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcessId
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461ea9
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00405b80
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053b0
ret

Function at 0x461fe0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push esi
call sub.kernel32.dll_lstrlenA_1
mov edx, eax
dec edx
test edx, edx
jl 0x462015
inc edx
xor ecx, ecx
movzx ebx, byte [esi + ecx]
mov edi, eax
and edi, 0xff
xor ebx, edi
mov ebx, dword [ebx*4 + 0x489dfc]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0x461ff5
pop edi
pop esi
pop ebx
ret

Function at 0x46201c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4620a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
jne 0x462080
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x110]
call fcn.0040c734
mov ecx, dword [ebp - 0x110]
mov dl, 1
mov eax, dword [0x408720]
call fcn.0040cf48
call fcn.00404cf8
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.0040a0f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4620ad
lea eax, [ebp - 0x110]
call fcn.0040538c
ret
Function at 0x462294
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x46239c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x46237a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004230f0
lea eax, [ebp - 8]
mov edx, 0x4623b0
call fcn.00405658
mov eax, dword [ebp - 8]
call fcn.0040581c
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405584
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.004623e0
push 0x20
lea eax, [ebp - 0xc]
call fcn.004230f0
lea eax, [ebp - 0xc]
mov edx, 0x4623b0
call fcn.00405658
mov eax, dword [ebp - 0xc]
call fcn.0040581c
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x10]
call fcn.004230f0
lea eax, [ebp - 0x10]
mov edx, 0x4623b0
call fcn.00405658
mov eax, dword [ebp - 0x10]
call fcn.0040581c
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x5a50d0]
mov edx, 0x4623cc
call fcn.00424654
lea eax, [ebp - 0x14]
call fcn.004230f0
lea eax, [ebp - 0x14]
mov edx, 0x4623b0
call fcn.00405658
mov eax, dword [ebp - 0x14]
call fcn.0040581c
push eax
push 0x4623d8
call sub.kernel32.dll_MoveFileA
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462381
ret

Function at 0x4626b4
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x462782
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00405584
mov eax, dword [ebp - 0x10]
call fcn.00409d20
test al, al
je 0x4626f6
push ebx
call sub.kernel32.dll_DeleteFileA
push 0
push 0x80
push 1
push 0
push 2
push 0x40000000
push ebx
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x462765
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x46274e
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 0xc]
push eax
push edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46276c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x462d6c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x462e0b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x109]
xor ecx, ecx
mov edx, 0x104
call fcn.00403ab0
lea eax, [ebp - 0x109]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.0040a0f4
mov ebx, dword [ebp - 0x110]
lea edx, [ebp - 4]
mov dword [ebp - 0x114], ebx
mov eax, dword [ebp - 0x114]
call fcn.0040dc7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004053e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462e12
lea eax, [ebp - 0x110]
call fcn.0040538c
lea eax, [ebp - 4]
call fcn.0040538c
ret

Function at 0x462e18
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x462e83
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00462d6c
lea eax, [ebp - 0x103]
push eax
push 0
push 0x462e90
mov eax, dword [ebp - 4]
call fcn.0040581c
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, ebx
lea edx, [ebp - 0x103]
mov ecx, 0xff
call fcn.004055fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462e8a
lea eax, [ebp - 4]
call fcn.0040538c
ret

Function at 0x463384
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.004053e0
mov eax, esi
test eax, eax
je 0x4633a5
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test edi, edi
jbe 0x4633dc
mov ebx, 1
mov eax, dword [ebp - 4]
call fcn.0040587c
movzx edx, byte [esi + ebx - 1]
xor dl, 4
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp - 4]
call fcn.0040587c
movzx edx, byte [esi + ebx - 1]
xor dl, 0xc
mov byte [eax + ebx - 1], dl
inc ebx
dec edi
jne 0x4633b0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4634c0
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
push 1
call sub.kernel32.dll_Sleep_2
push esp
push 0
push 0
push 0x4633ec
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x463538
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, edx
push 0xff
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetWindowTextA
mov eax, ebx
mov edx, esp
mov ecx, 0xff
call fcn.004055fc
add esp, 0x100
pop ebx
ret

Function at 0x4647f8
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
xor ecx, ecx
mov eax, dword [0x5a27f8]
test eax, eax
je 0x46483b
movzx edx, word [eax]
not dx
cmp dx, 0x5a4d
je 0x46483b
mov esi, eax
mov edx, esi
mov ebx, dword [eax + 0x3c]
add edx, ebx
mov edx, dword [edx]
not edx
cmp edx, 0x4550
je 0x46483b
mov edx, ebx
add edx, 0x18
add edx, 0x34
sub edx, 8
add edx, 0x14
add edx, esi
mov eax, edx
mov ecx, dword [eax]
mov eax, ecx
pop esi
pop ebx
ret
Function at 0x46d4a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], edx
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.0040580c
xor eax, eax
push ebp
push 0x46d545
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x1c]
mov edx, dword [ebp - 8]
call fcn.004650c0
mov esi, dword [ebx + 0x1c]
mov dword [esi + 0x53c], ebx
mov dword [esi + 0x538], 0x46d408
mov dword [esi + 0x544], ebx
mov dword [esi + 0x540], 0x46d468
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push 0x46d420
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [ebp - 4], eax
push ebp
call fcn.0046d47c
pop ecx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetExitCodeThread
cmp dword [ebp - 0xc], 0
je 0x46d52f
mov eax, ebx
call fcn.0046d304
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d54c
lea eax, [ebp - 8]
call fcn.0040538c
ret

Function at 0x46ed00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov edi, eax
mov dword [0x48bad8], 0xffffffff
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
mov ebx, 0xff
jmp 0x46ed44
cmp dword [0x48bad8], 0
je 0x46ed56
mov eax, edi
call fcn.0046ec6c
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, ebp
jbe 0x46ed44
mov ebx, 0x102
jmp 0x46ed56
cmp ebx, 0xff
jne 0x46ed56
mov eax, dword [0x59e948]
cmp byte [eax], 0
je 0x46ed20
xor eax, eax
mov dword [0x48bad8], eax
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47178c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, edx
mov byte [ebx + 0x1c], al
mov edx, eax
mov eax, ebx
call fcn.0046f588
mov eax, ebx
call fcn.0046f180
movzx eax, byte [ebx + 0x1c]
add al, 0xfd
sub al, 2
jb 0x4717b3
dec al
jne 0x4717c3
push 5
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_ShowWindow
jmp 0x4717ff
push 0
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x60]
xor ecx, ecx
mov edx, 0x471814
call fcn.00426260
mov ecx, 0x32
mov edx, 0xc4
call fcn.00425918
mov esi, eax
mov dword [ebx + 0x5c], esi
mov edx, esi
mov eax, ebx
xor ecx, ecx
call fcn.00471940
mov eax, dword [ebx + 0x60]
call fcn.00425c90
pop esi
pop ebx
ret

Function at 0x472474
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], edx
mov ebx, eax
or ebp, 0xffffffff
cmp dword [esp], 0x32
jne 0x472554
mov esi, ebx
movzx eax, word [esi + 2]
cmp ax, 0x2417
jbe 0x472554
cmp ax, 0x241d
jae 0x472554
push 0x32
call fcn.00406f68
pop ecx
mov esi, eax
mov ecx, 0x32
mov edx, ebx
mov eax, esi
call fcn.004081e0
movzx ebp, word [esi + 2]
sub ebp, 0x2012
sub ebp, 6
sub ebp, 0x400
dec ebp
cmp ebp, 0xffffffff
jne 0x472529
mov dword [esp + 4], 4
mov ebx, 0x5a7c6c
mov eax, dword [ebx]
call fcn.0047224c
push 0x32
call fcn.00406f68
pop ecx
mov edi, eax
mov ecx, 0x32
mov edx, esi
mov eax, edi
call fcn.004081e0
mov eax, dword [ebx]
mov edx, edi
call fcn.00423bb0
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebx]
mov dword [edx + 4], eax
add ebx, 4
dec dword [esp + 4]
jne 0x4724e5
push esi
call fcn.00406f78
pop ecx
jmp 0x472554
mov eax, ebp
sub eax, 4
jae 0x47254f
mov eax, dword [ebp*4 + 0x5a7c6c]
mov edx, esi
call fcn.00423bb0
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp*4 + 0x5a7c6c]
mov dword [edx + 4], eax
jmp 0x472554
mov ebp, 0xfffffffe
mov eax, ebp
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47405c
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
mov word [0x48bb60], ax
cmp byte [0x48bb5c], 0
jne 0x474071
xor ebx, ebx
jmp 0x4740d4
call fcn.00474020
push esp
push 0
push 0
push 0x473b7c
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov ebx, eax
test ebx, ebx
je 0x4740c8
cmp dword [0x48bb58], 0
je 0x4740a9
push 0x64
mov eax, dword [0x48bb58]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x47408f
cmp dword [0x48bb6c], 0
jbe 0x4740ba
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
push ebx
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [0x48bb6c]
jmp 0x4740d4
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
call fcn.00473764
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x47546c
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
mov word [0x48bc48], ax
cmp byte [0x48bc44], 0
jne 0x475481
xor ebx, ebx
jmp 0x4754e4
call fcn.00475430
push esp
push 0
push 0
push 0x474f8c
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov ebx, eax
test ebx, ebx
je 0x4754d8
cmp dword [0x48bc40], 0
je 0x4754b9
push 0x64
mov eax, dword [0x48bc40]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x47549f
cmp dword [0x48bc54], 0
jbe 0x4754ca
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
push ebx
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [0x48bc54]
jmp 0x4754e4
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
call fcn.00474b74
mov eax, ebx
pop edx
pop ebx
ret
Function at 0x475dc8
Capabilities:
Create thread
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x475f84
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 8]
mov byte [eax + 0x45], 0
xor eax, eax
push ebp
push 0x475f54
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x475da0]
call fcn.00406758
add esp, 4
test esi, esi
je 0x475e4b
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.00405584
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0047652c
jmp 0x475e90
mov ebx, 0x41
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00405574
lea eax, [ebp - 0x14]
mov edx, 0x475f9c
call fcn.00405658
mov esi, dword [ebp - 0x14]
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x475e8a
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.00405584
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.0047652c
inc ebx
cmp ebx, 0x5b
jne 0x475e50
mov eax, dword [ebp - 8]
mov byte [eax + 0x44], 0
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x475edf
inc esi
xor ebx, ebx
mov edx, dword [0x475d08]
xor eax, eax
call fcn.00423aa8
mov edi, eax
mov eax, dword [ebp - 4]
mov dword [eax + ebx*4], edi
mov eax, dword [ebp - 8]
mov dword [edi + 0x6c], eax
lea eax, [edi + 0x30]
push eax
push 4
push edi
push 0x475d44
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov edx, dword [ebp - 4]
mov edx, dword [edx + ebx*4]
mov dword [edx + 0x20], eax
inc ebx
dec esi
jne 0x475ea2
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x475f00
inc esi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.00424da8
push 1
call main
inc ebx
dec esi
jne 0x475eea
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x475f25
inc esi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.00424e00
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.00423ac8
inc ebx
dec esi
jne 0x475f0b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475f5b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.00476594
mov eax, dword [ebp - 8]
mov byte [eax + 0x44], 1
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 8]
mov byte [eax + 0x45], 1
ret
Function at 0x476bc8
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040580c
xor eax, eax
push ebp
push 0x476de5
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x14c]
mov ecx, 0x476dfc
mov edx, dword [ebp - 4]
call fcn.004056a4
mov eax, dword [ebp - 0x14c]
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x476dba
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.004055fc
cmp dword [ebp - 0x150], 0
jne 0x476cb4
push dword [ebp - 4]
push 0x476e0c
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004055fc
push dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00405720
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 8]
call fcn.00476af8
jmp 0x476cf3
push dword [ebp - 4]
push 0x476e0c
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.004055fc
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00405720
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 8]
call fcn.00476af8
push 0x20
mov eax, dword [ebp - 8]
call fcn.0040581c
mov ebx, eax
push ebx
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x148]
call fcn.00476b98
test al, al
je 0x476d1e
mov eax, dword [ebp - 8]
call fcn.00476bc8
jmp 0x476d24
push ebx
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x148]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x476c54
push esi
call sub.kernel32.dll_FindClose_1
mov eax, dword [ebp - 4]
call fcn.0040581c
push eax
call sub.kernel32.dll_RemoveDirectoryA
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x476d5f
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x476dba
lea eax, [ebp - 0x164]
mov ecx, 0x476e0c
mov edx, dword [ebp - 4]
call fcn.004056a4
mov eax, dword [ebp - 0x164]
call fcn.0040581c
call fcn.00422b84
test al, al
je 0x476dba
lea eax, [ebp - 0x168]
mov ecx, 0x476e0c
mov edx, dword [ebp - 4]
call fcn.004056a4
mov eax, dword [ebp - 0x168]
call fcn.0040581c
push eax
call sub.kernel32.dll_RemoveDirectoryA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476dec
lea eax, [ebp - 0x168]
mov edx, 8
call fcn.004053b0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053b0
ret