joyce8/EMBER2024-capa huggingface dataset:
Function at 0x88052c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10c
cmp byte [eax], 0
push esi
mov esi, ecx
je 0x880544
mov byte [esi + 0x14], 1
cmp byte [eax + 2], 0
je 0x88054e
mov byte [esi + 0x16], 1
cmp byte [eax + 3], 0
je 0x880558
mov byte [esi + 0x17], 1
xor eax, eax
cmp byte [esi + 0x14], al
je 0x880567
cmp byte [esi + 0x1a], al
je 0x880567
mov byte [esi + 0x14], al
cmp byte [esi + 0x15], al
je 0x880574
cmp byte [esi + 0x1b], al
je 0x880574
mov byte [esi + 0x15], al
cmp byte [esi + 0x16], al
je 0x880581
cmp byte [esi + 0x1c], al
je 0x880581
mov byte [esi + 0x16], al
cmp byte [esi + 0x17], al
je 0x88058e
cmp byte [esi + 0x1d], al
je 0x88058e
mov byte [esi + 0x17], al
cmp byte [esi + 0x18], al
je 0x88059b
cmp byte [esi + 0x1e], al
je 0x88059b
mov byte [esi + 0x18], al
cmp dword [esi + 0x20], eax
je 0x88061d
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.user32.dll_GetKeyboardState]
test eax, eax
je 0x880755
mov cl, byte [esi + 0x1a]
mov dl, byte [esi + 0x1b]
test cl, cl
sete al
dec al
and byte [ebp - 0x6c], al
test dl, dl
sete al
dec al
and byte [ebp - 0x6b], al
test cl, cl
jne 0x8805e0
test dl, dl
sete al
dec al
and byte [ebp - 0xfc], al
cmp byte [esi + 0x1c], 0
sete al
dec al
and byte [ebp - 0xfb], al
cmp byte [esi + 0x1d], 0
sete al
dec al
and byte [ebp - 0xfa], al
test cl, cl
sete al
dec al
and byte [ebp - 0xb1], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.user32.dll_SetKeyboardState]
jmp 0x880755
push ebx
push edi
lea ecx, [ebp - 0xc]
call fcn.00880195
mov ebx, dword [sym.imp.user32.dll_GetAsyncKeyState]
push 0xa0
call ebx
mov edi, dword [sym.imp.user32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x880655
push 0xa0
call edi
mov ecx, 0x8000
test cx, ax
je 0x880673
cmp byte [esi + 0x1a], 0
jne 0x880673
push 0xa0
lea ecx, [ebp - 0xc]
call fcn.0088189f
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00881121
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x880695
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
je 0x8806b3
cmp byte [esi + 0x1b], 0
jne 0x8806b3
push 0xa1
lea ecx, [ebp - 0xc]
call fcn.0088189f
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00881121
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x8806cf
push 0x11
call edi
mov ecx, 0x8000
test cx, ax
je 0x8806ea
cmp byte [esi + 0x1c], 0
jne 0x8806ea
push 0x11
lea ecx, [ebp - 0xc]
call fcn.0088189f
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00881121
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x880706
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
je 0x880721
cmp byte [esi + 0x1d], 0
jne 0x880721
push 0x12
lea ecx, [ebp - 0xc]
call fcn.0088189f
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00881121
push 0x5b
call ebx
mov ebx, 0x8000
test bx, ax
jne 0x880738
push 0x5b
call edi
test bx, ax
je 0x880753
cmp byte [esi + 0x1e], 0
jne 0x880753
push 0x5b
lea ecx, [ebp - 0xc]
call fcn.0088189f
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00881121
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x880f7b
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
movzx edi, al
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.user32.dll_GetKeyState]
mov bx, ax
and bl, 1
cmp byte [ebp + 0xc], bl
je 0x880fdc
push esi
mov esi, dword [sym.imp.user32.dll_MapVirtualKeyW]
push ecx
push 0
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.008817d7
mov ecx, dword [ebp - 4]
call fcn.008801fe
push ecx
push 2
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.008817d7
mov ecx, dword [ebp - 4]
call fcn.008801e5
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x880fe6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
movzx eax, word [edi + 8]
mov byte [ebp - 4], bl
mov byte [ebp + 8], bh
je 0x8810c1
cmp bl, 0x14
je 0x8810c1
cmp bl, 0x90
je 0x8810c1
cmp bl, 0x91
je 0x8810c1
cmp bl, 0xff
je 0x8810ae
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.user32.dll_GetKeyboardState]
test eax, eax
je 0x881059
movzx eax, bl
or byte [ebp + eax - 0x120], 0x80
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.user32.dll_SetKeyboardState]
movzx edx, bh
mov ecx, edi
shl edx, 0x10
or edx, 1
call fcn.0088042e
cmp al, 1
jne 0x881073
or edx, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x881084
cmp byte [esi + 0x1d], 0
jne 0x881084
cmp bl, 0x12
jne 0x8810a2
cmp byte [esi + 0x16], 0
jne 0x8810a2
cmp byte [esi + 0x1c], 0
jne 0x8810a2
or edx, 0x20000000
movzx eax, bl
push edx
push eax
push 0x104
jmp 0x8810b6
push edx
movzx eax, bl
push eax
push 0x100
jmp 0x8810b6
push 1
push eax
push 0x102
push dword [esi + 0x20]
call dword [sym.imp.user32.dll_PostMessageW]
jmp 0x881111
cmp bl, 0xff
je 0x8810e7
mov ecx, edi
call fcn.0088042e
push ecx
mov ecx, esi
cmp al, 1
jne 0x8810d8
push 1
jmp 0x8810da
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.008817d7
jmp 0x881111
mov word [ebp - 0x1a], ax
xor edx, edx
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 4
inc edx
xor ecx, ecx
and dword [ebp - 0x14], ecx
and dword [ebp - 0x10], ecx
push eax
push edx
mov dword [ebp - 0x20], edx
mov word [ebp - 0x1c], cx
call dword [sym.imp.user32.dll_SendInput]
mov ecx, esi
call fcn.008801fe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x881121
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
movzx eax, word [edi + 8]
mov byte [ebp - 4], bl
mov byte [ebp + 8], bh
je 0x8811f9
cmp bl, 0x14
je 0x8811f9
cmp bl, 0x90
je 0x8811f9
cmp bl, 0x91
je 0x8811f9
cmp bl, 0xff
je 0x881249
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.user32.dll_GetKeyboardState]
test eax, eax
je 0x881198
movzx eax, bl
xor byte [ebp + eax - 0x120], 0x80
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.user32.dll_SetKeyboardState]
movzx edx, bh
mov ecx, edi
shl edx, 0x10
or edx, 0xc0000001
call fcn.0088042e
cmp al, 1
jne 0x8811b5
or edx, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x8811c6
cmp byte [esi + 0x1d], 0
jne 0x8811c6
cmp bl, 0x12
jne 0x8811e4
cmp byte [esi + 0x16], 0
jne 0x8811e4
cmp byte [esi + 0x1c], 0
jne 0x8811e4
or edx, 0x20000000
movzx eax, bl
push edx
push eax
push 0x105
jmp 0x8811ee
push edx
movzx eax, bl
push eax
push 0x101
push dword [esi + 0x20]
call dword [sym.imp.user32.dll_PostMessageW]
jmp 0x881249
cmp bl, 0xff
je 0x88121f
mov ecx, edi
call fcn.0088042e
push ecx
mov ecx, esi
cmp al, 1
jne 0x881210
push 3
jmp 0x881212
push 2
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.008817d7
jmp 0x881249
mov word [ebp - 0x1a], ax
xor edx, edx
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 6
inc edx
xor ecx, ecx
and dword [ebp - 0x14], ecx
and dword [ebp - 0x10], ecx
push eax
push edx
mov dword [ebp - 0x20], edx
mov word [ebp - 0x1c], cx
call dword [sym.imp.user32.dll_SendInput]
mov ecx, esi
call fcn.008801e5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x881276
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [esi], 0
jne 0x8812a7
cmp byte [esi + 1], 0
jne 0x8812a7
cmp byte [esi + 2], 0
jne 0x8812a7
cmp byte [esi + 3], 0
jne 0x8812a7
cmp byte [esi + 4], 0
je 0x881455
cmp dword [edi + 0x20], 0
push ebx
je 0x8813dd
push dword [edi + 0x20]
call dword [sym.imp.user32.dll_GetParent]
test eax, eax
je 0x8813dd
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.user32.dll_GetKeyboardState]
test eax, eax
je 0x881331
cmp byte [esi], 0
mov ecx, 0x80
mov al, byte [ebp - 0xf0]
je 0x8812ef
or al, cl
or byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x881300
or al, cl
or byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x88130c
or byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x881318
or byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x881324
or byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.user32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.user32.dll_PostMessageW]
jne 0x881342
cmp byte [esi + 1], 0
je 0x881359
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 1
push eax
push 0x10
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x881376
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push 0x100
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x8813ba
cmp byte [esi + 2], 0
jne 0x88139f
cmp byte [edi + 0x1c], 0
jne 0x88139f
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0x20000001
push eax
push 0x12
push 0x104
jmp 0x8813b5
test al, al
je 0x8813ba
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 1
push eax
push 0x12
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x88144d
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 1
push eax
push 0x5b
push 0x100
push dword [edi + 0x20]
call ebx
jmp 0x88144d
xor ebx, ebx
cmp byte [esi], bl
je 0x8813f6
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.008817d7
cmp byte [esi + 1], bl
je 0x88140e
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.008817d7
cmp byte [esi + 2], bl
je 0x881423
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.008817d7
cmp byte [esi + 3], bl
je 0x881438
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.008817d7
cmp byte [esi + 4], bl
je 0x88144d
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.008817d7
mov ecx, edi
call fcn.008801fe
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x88145d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [esi], 0
jne 0x88148e
cmp byte [esi + 1], 0
jne 0x88148e
cmp byte [esi + 2], 0
jne 0x88148e
cmp byte [esi + 3], 0
jne 0x88148e
cmp byte [esi + 4], 0
je 0x88164a
cmp dword [edi + 0x20], 0
push ebx
je 0x8815cc
push dword [edi + 0x20]
call dword [sym.imp.user32.dll_GetParent]
test eax, eax
je 0x8815cc
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.user32.dll_GetKeyboardState]
test eax, eax
je 0x881518
cmp byte [esi], 0
mov ecx, 0x80
mov al, byte [ebp - 0xf0]
je 0x8814d6
xor al, cl
xor byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x8814e7
xor al, cl
xor byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x8814f3
xor byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x8814ff
xor byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x88150b
xor byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.user32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.user32.dll_PostMessageW]
jne 0x881529
cmp byte [esi + 1], 0
je 0x881542
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x10
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x881561
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x11
push 0x101
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x8815a7
cmp byte [esi + 2], 0
jne 0x88158a
cmp byte [edi + 0x1c], 0
jne 0x88158a
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
jmp 0x8815a2
test al, al
je 0x8815a7
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x881642
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push dword [edi + 0x20]
call ebx
jmp 0x881642
cmp byte [esi], 0
push 2
pop ebx
je 0x8815e7
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.008817d7
cmp byte [esi + 1], 0
je 0x881600
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.008817d7
cmp byte [esi + 2], 0
je 0x881616
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.008817d7
cmp byte [esi + 3], 0
je 0x88162c
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.008817d7
cmp byte [esi + 4], 0
je 0x881642
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.008817d7
mov ecx, edi
call fcn.008801e5
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x881652
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [ebp + 8]
test esi, esi
js 0x8816d7
jne 0x881666
push 0
jmp 0x8816d1
cmp esi, 0xf
jae 0x8816d0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x8816d0
mov dword [ebp + 8], esi
fild dword [ebp + 8]
test esi, esi
jns 0x881689
fadd qword [0x8dbac8]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fstp qword [ebp - 0x28]
push 0
call dword [sym.imp.kernel32.dll_Sleep]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
sbb eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fstp qword [ebp - 0x20]
call fcn.008407f6
fdivr qword [ebp - 0x20]
fcomp qword [ebp - 0x28]
fnstsw ax
test ah, 5
jnp 0x881692
jmp 0x8816d7
push esi
call dword [sym.imp.kernel32.dll_Sleep]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x881831
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
xor eax, eax
mov dword [esi + 4], eax
mov byte [esi + 0xa], al
mov eax, dword [ebp + 8]
mov dword [esi], 0xff
mov word [esi + 8], ax
test ax, ax
jne 0x881855
xor al, al
jmp 0x88189a
push eax
call dword [sym.imp.user32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
je 0x881851
push ebx
mov ebx, eax
mov byte [esi], al
push 0
movzx eax, al
push eax
sar ebx, 8
call dword [sym.imp.user32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
test bl, 1
je 0x881885
mov byte [esi + 1], 1
test bl, 2
je 0x88188e
mov byte [esi + 3], 1
test bl, 4
pop ebx
je 0x881898
mov byte [esi + 4], 1
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x883696
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.00883595
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.kernel32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x8838ad
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20030
call fcn.00851b90
push ebx
push esi
lea eax, [esp + 0x10038]
mov esi, edx
push eax
mov edx, 0x7fff
call fcn.008848aa
lea eax, [esp + 0x3c]
mov edx, 0x7fff
push eax
mov ecx, esi
call fcn.008848aa
pop ecx
pop ecx
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
jne 0x88393b
cmp byte [ebp + 8], al
je 0x883934
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call fcn.0084378c
pop ecx
pop ecx
test eax, eax
je 0x88392d
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call dword [sym.imp.kernel32.dll_MoveFileW]
mov al, 1
jmp 0x8839e7
xor al, al
jmp 0x8839e7
lea ecx, [esp + 0x10038]
call fcn.00884cd3
test al, al
je 0x883934
lea ecx, [esp + 0x38]
call fcn.00884cd3
test al, al
je 0x8839ed
cmp byte [ebp + 8], 0
je 0x883934
lea eax, [esp + 0x10038]
push str..
push eax
call fcn.00842fcd
lea eax, [esp + 0x10040]
push eax
call fcn.00842e3c
xor ecx, ecx
mov word [esp + eax*2 + 0x10046], cx
lea eax, [esp + 0x44]
push eax
call fcn.00842e3c
xor ecx, ecx
mov dword [esp + 0x1c], 2
add esp, 0x10
mov word [esp + eax*2 + 0x3a], cx
lea eax, [esp + 0x10038]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 8], eax
mov eax, 0x614
mov word [esp + 0x18], ax
lea eax, [esp + 8]
push eax
call dword [sym.imp.shell32.dll_SHFileOperationW]
neg eax
sbb al, al
inc al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x2c]
call fcn.00827f41
lea ecx, [esp + 0x28]
call fcn.00883c66
mov bl, al
lea ecx, [esp + 0x28]
neg bl
sbb bl, bl
call fcn.00825a64
inc bl
jne 0x883934
lea ecx, [esp + 0x38]
call fcn.00884cd3
test al, al
jmp 0x883960
Function at 0x883a2b
Capabilities:
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x34]
mov byte [ebp - 1], bl
mov edi, edx
call fcn.008277c7
lea ecx, [ebp - 0x44]
call fcn.008277c7
lea ecx, [ebp - 0x24]
call fcn.008277c7
lea ecx, [ebp - 0x14]
call fcn.008277c7
lea edx, [ebp - 0x34]
mov ecx, esi
call fcn.008248ae
lea edx, [ebp - 0x44]
mov ecx, edi
call fcn.008248ae
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x34]
call fcn.00884c69
mov ecx, dword [ebp - 0x34]
mov byte [ebp - 3], al
call fcn.00884cd3
mov esi, str..
test al, al
je 0x883a9c
push esi
lea ecx, [ebp - 0x34]
call fcn.00827e0b
mov ecx, dword [ebp - 0x44]
call fcn.00884cd3
test al, al
je 0x883ab1
push esi
lea ecx, [ebp - 0x44]
call fcn.00827e0b
lea ecx, [ebp - 0x54]
call fcn.008277c7
lea ecx, [ebp - 0x64]
call fcn.008277c7
push ebx
lea eax, [ebp - 0x64]
push ebx
push eax
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x34]
call fcn.008246f9
add esp, 0xc
lea eax, [ebp - 0x2c8]
push eax
push dword [ebp - 0x34]
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [ebp - 2], al
cmp esi, 0xffffffff
je 0x883bfd
mov edi, dword [sym.imp.kernel32.dll_DeleteFileW]
cmp al, 1
jne 0x883bfd
test byte [ebp - 0x2c8], 0x10
jne 0x883bd1
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x74]
call fcn.00827f41
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x74]
call fcn.008842ad
pop ecx
lea ecx, [ebp - 0x74]
call fcn.00825a64
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x14]
call fcn.008281a7
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x14]
call fcn.00827c8e
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00827e0b
lea ecx, [ebp - 0x24]
call fcn.00883e73
test al, al
je 0x883b89
cmp byte [ebp + 8], bl
je 0x883bf4
push ebx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
call fcn.00827a68
push dword [ebp - 0x24]
test eax, eax
je 0x883b97
call edi
cmp byte [ebp + 0xc], 1
jne 0x883bbb
cmp byte [ebp - 3], bl
jne 0x883ba2
push dword [ebp - 0x24]
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_MoveFileW]
jmp 0x883bc9
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x14]
call fcn.00883c40
movzx eax, al
test eax, eax
je 0x883bf4
push dword [ebp - 0x14]
call edi
jmp 0x883bc9
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x14]
call fcn.00883c40
movzx eax, al
test eax, eax
je 0x883bf4
mov byte [ebp - 1], 1
lea eax, [ebp - 0x2c8]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
mov al, byte [ebp - 2]
jne 0x883afb
mov al, bl
mov byte [ebp - 2], al
jmp 0x883afb
push esi
call dword [sym.imp.kernel32.dll_FindClose]
jmp 0x883c07
push esi
call dword [sym.imp.kernel32.dll_FindClose]
mov bl, byte [ebp - 1]
lea ecx, [ebp - 0x64]
call fcn.00825a64
lea ecx, [ebp - 0x54]
call fcn.00825a64
lea ecx, [ebp - 0x14]
call fcn.00825a64
lea ecx, [ebp - 0x24]
call fcn.00825a64
lea ecx, [ebp - 0x44]
call fcn.00825a64
lea ecx, [ebp - 0x34]
call fcn.00825a64
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x883c66
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
mov dword [esp], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
mov eax, dword [ecx + 8]
push ebx
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 4]
push esi
push 0x8afac0
mov dword [esp + 0x18], eax
inc dword [eax]
call fcn.00827886
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x883d33
call dword [sym.imp.kernel32.dll_GetLastError]
xor ebx, ebx
cmp eax, 2
jne 0x883cca
push ebx
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x883ccf
jmp 0x883d37
cmp eax, 3
jne 0x883d3b
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], eax
push 0x8afac0
inc dword [eax]
call fcn.00827e2f
cmp eax, 0xffffffff
je 0x883d28
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x20]
call fcn.00827e8c
lea ecx, [esp + 0x18]
call fcn.00883c66
test al, al
je 0x883d26
push ebx
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
setne al
mov bl, al
lea ecx, [esp + 0x18]
call fcn.00825a64
jmp 0x883d3d
test al, 0x10
je 0x883d3b
mov bl, 1
jmp 0x883d3d
xor bl, bl
lea ecx, [esp + 8]
call fcn.00825a64
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x883d4e
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x288
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0xf], bl
call fcn.008277c7
lea ecx, [esp + 0x20]
call fcn.008277c7
lea ecx, [esp + 0x30]
call fcn.008277c7
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.008248ae
mov ecx, dword [esp + 0x10]
call fcn.00884cd3
test al, al
je 0x883da5
push str..
lea ecx, [esp + 0x14]
call fcn.00827e0b
push ebx
lea eax, [esp + 0x34]
push ebx
push eax
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x1c]
call fcn.008246f9
add esp, 0xc
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x14]
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [esp + 0xe], al
cmp esi, 0xffffffff
je 0x883e45
cmp al, 1
jne 0x883e45
test byte [esp + 0x40], 0x10
jne 0x883e20
mov byte [esp + 0xf], al
lea ecx, [esp + 0x10]
lea eax, [esp + 0x20]
push eax
call fcn.008281a7
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.00827c8e
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x14]
call fcn.00827e0b
push dword [esp + 0x10]
call dword [sym.imp.kernel32.dll_DeleteFileW]
cmp eax, 1
jne 0x883e3c
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
mov al, byte [esp + 0xe]
jne 0x883dd8
mov al, bl
mov byte [esp + 0xe], al
jmp 0x883dd8
push esi
call dword [sym.imp.kernel32.dll_FindClose]
jmp 0x883e50
push esi
call dword [sym.imp.kernel32.dll_FindClose]
mov bl, byte [esp + 0xf]
lea ecx, [esp + 0x30]
call fcn.00825a64
lea ecx, [esp + 0x20]
call fcn.00825a64
lea ecx, [esp + 0x10]
call fcn.00825a64
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret