joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf0412d9
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi + 0xa]
xor ebx, ebx
cmp al, 0xf0
mov byte [ebp + 0xb], al
mov word [esi + 4], 1
mov word [esi + 6], bx
mov dword [esi + 0xc], ebx
jne 0xf041306
cmp word [esi + 8], bx
je 0xf041306
mov byte [ebp + 0xb], bl
push 1
lea eax, [ebp + 0xb]
push eax
push ebx
push 2
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_RtlOemToUnicodeN]
test eax, eax
jge 0xf041324
xor eax, eax
jmp 0xf0414ea
mov cl, byte [ebp + 0xb]
cmp cl, bl
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
jne 0xf04136e
xor eax, eax
mov ax, word [esi + 8]
cmp ax, 0x54
jb 0xf04141f
cmp ax, 0xa6
ja 0xf04141f
add eax, 0xffffffac
mov word [esi + 8], ax
movzx eax, ax
shl eax, 3
mov ecx, dword [eax + 0xf065784]
mov dword [esi + 0xc], ecx
mov ax, word [eax + 0xf065780]
jmp 0xf0414be
cmp cl, 0xe0
jne 0xf04141f
mov ax, word [esi + 8]
cmp ax, bx
je 0xf04141f
movzx ecx, ax
mov eax, 0x84
cmp ecx, eax
mov dword [esi + 0xc], 0x108
jg 0xf0413da
je 0xf0413d2
sub ecx, 0x73
je 0xf0413ca
dec ecx
je 0xf0413c2
dec ecx
je 0xf0413ba
dec ecx
je 0xf0413b2
dec ecx
jne 0xf0413ed
mov word [esi + 8], 0x47
jmp 0xf041414
mov word [esi + 8], 0x51
jmp 0xf041414
mov word [esi + 8], 0x4f
jmp 0xf041414
mov word [esi + 8], 0x4d
jmp 0xf041414
mov word [esi + 8], 0x4b
jmp 0xf041414
mov word [esi + 8], 0x49
jmp 0xf041414
sub ecx, 0x8d
je 0xf04140e
sub ecx, 4
je 0xf041406
dec ecx
je 0xf0413fe
dec ecx
je 0xf0413f6
mov dword [esi + 0xc], 0x100
jmp 0xf041414
mov word [esi + 8], 0x53
jmp 0xf041414
mov word [esi + 8], 0x52
jmp 0xf041414
mov word [esi + 8], 0x50
jmp 0xf041414
mov word [esi + 8], 0x48
mov byte [ebp + 0xb], bl
mov dword [ebp - 4], ebx
jmp 0xf0414c2
mov ax, word [esi + 8]
cmp ax, 0xe0
jne 0xf04145d
cmp cl, 0x2f
mov dword [esi + 0xc], 0x100
jne 0xf041443
mov word [esi + 8], 0x35
mov word [esi + 6], 0x6f
jmp 0xf0414c2
cmp cl, 0xa
mov word [esi + 8], 0x1c
mov word [esi + 6], 0xd
jne 0xf0414c2
mov dword [esi + 0xc], 0x108
jmp 0xf0414c2
cmp cl, bl
je 0xf0414c2
cmp ax, 1
je 0xf0414c2
cmp ax, 0xe
je 0xf0414c2
cmp ax, 0xf
je 0xf0414c2
cmp ax, 0x1c
je 0xf0414c2
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_VkKeyScanW]
cmp ax, 0xffff
jne 0xf041494
mov word [esi + 8], bx
mov word [esi + 6], 0x12
jmp 0xf0414c2
test ah, 1
movzx cx, al
mov word [esi + 6], cx
je 0xf0414a5
or dword [esi + 0xc], 0x10
test ah, 2
je 0xf0414ae
or dword [esi + 0xc], 8
test ah, 4
je 0xf0414b7
or dword [esi + 0xc], 2
movzx eax, cx
push ebx
push eax
call edi
mov word [esi + 8], ax
cmp word [esi + 6], bx
jne 0xf0414de
movzx eax, word [esi + 8]
push 3
push eax
call edi
cmp ax, bx
mov word [esi + 6], ax
jne 0xf0414de
xor eax, eax
jmp 0xf0414e9
mov ax, word [ebp - 4]
mov word [esi + 0xa], ax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0xf041547
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0xf078210], 0
je 0xf041580
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [0xf078218]
shl eax, 2
push eax
push 0xf09bd40
push dword [0xf07820c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0xf041580
leave
ret
and dword [0xf078218], 0
xor eax, eax
inc eax
leave
ret

Function at 0xf042064
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
xor esi, esi
cmp dword [0xf078234], esi
jne 0xf0420c4
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
push 0xf09bce0
mov dword [0xf078234], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.0f0595ee
movzx ecx, word [0xf09be44]
mov edx, ecx
shr edx, 2
shl edx, 6
add edx, eax
mov dword [0xf09bcb0], eax
mov eax, ecx
mov dword [0xf09bc44], edx
push 4
cdq
pop ecx
idiv ecx
mov word [0xf09bcc0], dx
push 0x3000
mov dword [0xf09bc64], 0x200
call fcn.0f041eea
test eax, eax
je 0xf042130
push edi
push esi
push 0x64
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
push esi
push esi
push esi
mov dword [0xf09bc58], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf09bc4c], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf09bca0], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf09bc94], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf09bcb8], eax
call edi
mov dword [0xf09bcf8], eax
xor eax, eax
inc eax
pop edi
jmp 0xf042132
xor eax, eax
pop esi
leave
ret
Function at 0xf0432a1
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor edi, edi
cmp dword [0xf07823c], edi
mov dword [0xf078248], edi
jne 0xf043340
lea eax, [ebp - 4]
push eax
push 4
push edi
push 0xf043055
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, edi
jne 0xf0432de
xor eax, eax
jmp 0xf0433fd
mov eax, dword [0xf09bca8]
push esi
push dword [0xf09bc58]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
dec eax
mov dword [0xf07823c], 1
mov dword [0xf078254], edi
mov dword [0xf09bca4], eax
mov dword [0xf09bc80], edi
call esi
push edi
push 0x64
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 2
push ebx
mov dword [0xf09bc58], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call esi
push 0xffffffffffffffff
push dword [0xf09bc4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov eax, dword [0xf09bcb4]
sub eax, dword [0xf09bc64]
mov ecx, dword [0xf065a4c]
inc ecx
cmp ecx, eax
jbe 0xf04338a
cmp dword [0xf078238], edi
je 0xf043368
call fcn.0f04285c
call fcn.0f042a33
mov eax, dword [0xf09bc64]
mov ecx, dword [0xf065a4c]
lea eax, [eax + ecx + 1]
push eax
call fcn.0f041eea
cmp dword [0xf078238], edi
je 0xf04338a
call fcn.0f0429f9
cmp dword [ebp + 8], edi
jne 0xf0433d2
cmp dword [0xf078238], edi
je 0xf0433a3
cmp dword [0xf065a48], 0xffff
je 0xf0433ca
call fcn.0f042ee7
call fcn.0f042465
push edi
call fcn.0f042356
call fcn.0f0429f9
movzx eax, word [0xf09be2c]
push 0xf042fe1
push eax
call fcn.0f008f93
mov dword [0xf09bcc4], edi
jmp 0xf0433e9
cmp dword [0xf09bcc4], edi
jne 0xf0433df
call fcn.0f04301c
mov dword [0xf09bcc4], 1
push dword [0xf09bcc4]
mov dword [0xf078240], edi
call fcn.0f042c97
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 4

Function at 0xf0448ce
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, dword [ebp + 0xc]
shr edi, 0xe
je 0xf044925
push esi
mov esi, 0x4000
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
push 0x40
push 0x40000000
push 2
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
push dword [0xf078274]
mov dword [ebp + 0xc], esi
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
mov dword [ebp + 0xc], eax
jl 0xf044924
add dword [ebp + 8], esi
dec edi
jne 0xf0448e4
pop esi
xor eax, eax
cmp dword [ebp + 0xc], eax
pop edi
setge al
leave
ret 8
Function at 0xf044d27
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [0xf078280], 0
je 0xf044e0a
push edi
push 0xf002c6c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0xf044e09
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xf002d3c
push edi
call esi
push 0xf002d28
push edi
mov dword [0xf09cc48], eax
call esi
push 0xf002d14
push edi
mov dword [0xf09cc34], eax
call esi
push 0xf002d00
push edi
mov dword [0xf09cc50], eax
call esi
push 0xf002cec
push edi
mov dword [0xf09cc4c], eax
call esi
push 0xf002ce0
push edi
mov dword [0xf09cc5c], eax
call esi
push 0xf002cd4
push edi
mov dword [0xf09cc44], eax
call esi
push 0xf002cc4
push edi
mov dword [0xf09cc60], eax
call esi
push 0xf002cb0
push edi
mov dword [0xf09cc38], eax
call esi
push 0xf002c90
push edi
mov dword [0xf09cc3c], eax
call esi
push 0xf002c78
push edi
mov dword [0xf09cc40], eax
call esi
mov dword [0xf09cc64], eax
mov eax, dword [0xf09cc48]
test eax, eax
pop esi
je 0xf044e09
mov ecx, dword [0xf078510]
push 0xf09cc54
push dword [0xf078288]
add ecx, 0x714
push ecx
call eax
mov dword [0xf078284], eax
pop edi
ret

Function at 0xf045345
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0xf062038]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x10000
push eax
mov dword [ebp - 0x214], eax
call fcn.0f008238
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
cmp esi, 0xffffffff
je 0xf0453c4
push 0xd
push 1
lea eax, [ebp - 0x20d]
push eax
lea eax, [ebp - 0x224]
push eax
push esi
mov byte [ebp - 0x20d], 1
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
push esi
mov dword [ebp - 0x21c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x21c], ebx
jl 0xf0453c0
push ebx
jmp 0xf0453c2
push 5
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, ebx
je 0xf04548f
cmp eax, 1
jbe 0xf04547d
cmp eax, 3
jbe 0xf04548f
cmp eax, 5
je 0xf0453f4
cmp eax, 0x20
jne 0xf04547d
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push dword [ebp - 0x214]
call fcn.0f00965d
test eax, eax
je 0xf04548f
mov eax, dword [ebp - 0x218]
cmp eax, ebx
je 0xf045422
mov byte [eax], bl
lea eax, [ebp - 0x108]
push eax
push ebx
push 0xf003630
lea eax, [ebp - 0x20c]
push eax
call fcn.0f04f23d
test eax, eax
je 0xf04548f
push 1
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x214]
call fcn.0f04f7db
test eax, eax
je 0xf04548f
lea eax, [ebp - 0x108]
push eax
call fcn.0f04f6cc
test eax, eax
jne 0xf04548c
push dword [ebp - 0x214]
lea eax, [ebp - 0x108]
push eax
call fcn.0f04f731
push 5
jmp 0xf04548d
push dword [ebp - 0x214]
call fcn.0f04f6cc
test eax, eax
je 0xf04548f
push ebx
call edi
call esi
cmp eax, ebx
je 0xf0454a8
cmp eax, 1
jbe 0xf0454a4
cmp eax, 3
jbe 0xf0454a8
cmp eax, 5
je 0xf0454a8
push 5
call edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0f01b9b9
leave
ret 4
Function at 0xf045a01
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x18], 0xffffffff
jne 0xf045a1d
mov eax, 0x80000006
jmp 0xf045b41
mov ax, word [esi + 0x2c]
push ebx
mov ebx, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push edi
mov word [ebp - 0x10], ax
mov word [ebp - 0xe], ax
push 0xf003678
lea eax, [ebp - 8]
lea edi, [esi + 0x30]
push eax
mov dword [ebp - 0xc], edi
call ebx
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
test eax, eax
je 0xf045ad4
push 0xf003670
lea eax, [ebp - 8]
push eax
call ebx
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
test eax, eax
je 0xf045ad4
cmp byte [esi + 0x252], 0
je 0xf045ad4
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x24], eax
mov ax, word [esi + 0x2c]
mov word [ebp - 0x18], ax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 6
mov dword [ebp - 0x14], edi
call dword [sym.imp.ntdll.dll_NtVdmControl]
test eax, eax
jge 0xf045b3f
cmp eax, 0x80000006
je 0xf045b3f
cmp eax, 0xc000000f
je 0xf045b3f
mov byte [esi + 0x252], 1
xor ebx, ebx
mov edi, dword [esi + 0x20]
cmp edi, ebx
jne 0xf045afd
mov edi, dword [esi + 0x1c]
push ebx
push ebx
push ebx
push 3
push dword [esi + 0x24]
lea eax, [ebp - 0x20]
push edi
push eax
push ebx
push ebx
push ebx
push dword [esi + 0x18]
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
cmp eax, ebx
jl 0xf045b3f
mov eax, dword [edi]
cmp eax, ebx
je 0xf045b0a
add eax, edi
mov dword [esi + 0x20], eax
jmp 0xf045b0d
mov dword [esi + 0x20], ebx
mov eax, dword [edi + 4]
cmp eax, dword [esi + 0x28]
jne 0xf045ad6
mov ax, word [edi + 0x3c]
mov word [ebp - 8], ax
mov ax, word [edi + 0x3c]
mov word [ebp - 6], ax
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
add edi, 0x5e
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
test eax, eax
jne 0xf045ad6
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0xf045b4b
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x18], 0xffffffff
jne 0xf045b66
mov eax, 0x80000006
jmp 0xf045c21
mov ecx, dword [esi + 0x20]
test ecx, ecx
push ebx
push edi
je 0xf045baf
mov edx, dword [esi + 0x1c]
mov eax, ecx
sub eax, edx
je 0xf045b88
mov edi, dword [esi + 0x24]
sub edi, eax
push edi
push ecx
push edx
call fcn.0f01cfc0
add esp, 0xc
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x20], eax
mov ecx, eax
jmp 0xf045b94
add ecx, edx
mov edx, dword [ecx]
test edx, edx
jne 0xf045b92
mov edx, dword [ecx + 0x3c]
shr edx, 1
lea edi, [ecx + edx*2 + 0x65]
and edi, 0xfffffff8
sub eax, edi
add eax, dword [esi + 0x24]
mov ebx, ecx
jmp 0xf045c16
mov edi, dword [esi + 0x1c]
mov eax, dword [esi + 0x24]
xor ebx, ebx
jmp 0xf045c16
xor ecx, ecx
push ecx
push ecx
push ecx
push 3
push eax
push edi
lea eax, [ebp - 8]
push eax
push ecx
push ecx
push ecx
push dword [esi + 0x18]
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
cmp eax, 0x80000006
je 0xf045c1f
cmp eax, 0xc000000f
je 0xf045c1f
test eax, eax
jl 0xf045c1d
test ebx, ebx
je 0xf045bf0
mov eax, edi
sub eax, ebx
mov dword [ebx], eax
jmp 0xf045bfa
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x20], eax
jmp 0xf045bfa
add edi, eax
mov eax, dword [edi]
test eax, eax
jne 0xf045bf8
mov eax, dword [edi + 0x3c]
shr eax, 1
mov ebx, edi
lea edi, [edi + eax*2 + 0x65]
mov eax, dword [esi + 0x24]
and edi, 0xfffffff8
sub eax, edi
add eax, dword [esi + 0x1c]
cmp eax, 0x268
ja 0xf045bb9
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0xf0462df
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0xf062038]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], eax
mov eax, edi
sub ecx, edi
mov dl, byte [eax]
mov byte [ecx + eax], dl
inc eax
test dl, dl
jne 0xf046305
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.0f056f40
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0xf04634a
inc esi
lea edx, [ebp - 0x14]
mov byte [esi + 0xc], 0
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0xf046331
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov byte [esi], 0
jmp 0xf04634e
mov byte [ebp - 0x14], 0
cmp word [ebp + 0x10], 8
jne 0xf046392
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.0f056ca0
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0xf046392
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0xf046392
mov byte [esi + 1], 0
xor eax, eax
mov cl, byte [eax + str.________.___]
mov byte [ebp + eax - 0x14], cl
inc eax
test cl, cl
jne 0xf046383
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push 0xff
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0f010aa1
test eax, eax
je 0xf04643b
cmp byte [ebp - 0x114], 0
mov byte [ebp - 0x109], 0
je 0xf046433
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.0f046150
test eax, eax
je 0xf046433
lea esi, [ebx + 1]
mov eax, 0x20202020
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf0463f5
sub eax, edi
push eax
lea eax, [ebp - 0x114]
push eax
push esi
call fcn.0f01ccb0
push 8
push esi
lea esi, [ebx + 0x14]
push esi
call fcn.0f01ccb0
push 3
add ebx, 9
push ebx
add esi, 8
push esi
call fcn.0f01ccb0
add esp, 0x24
push 0
call sym.ntvdm.exe_setCF
jmp 0xf046447
push 0x12
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov al, byte [edi]
push eax
push 0xffffffffffffffff
call fcn.0f00807d
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0f01b9b9
leave
ret 0xc
Function at 0xf04645b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0xf062038]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
lea edx, [ebp - 0x218]
push edi
mov edi, dword [ebp + 0xc]
sub edx, eax
xor ebx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0xf046480
push esi
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.0f056f40
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0xf0464c4
inc esi
lea edx, [ebp - 0x14]
mov byte [esi + 0xc], bl
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0xf0464ac
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov byte [esi], bl
jmp 0xf0464c7
mov byte [ebp - 0x14], bl
cmp word [ebp + 0x10], 8
jne 0xf04650e
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.0f056ca0
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0xf04650e
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0xf04650e
inc esi
cmp byte [esi], bl
jne 0xf04650c
xor eax, eax
mov cl, byte [eax + str.________.___]
mov byte [ebp + eax - 0x14], cl
inc eax
cmp cl, bl
jne 0xf0464fd
mov byte [esi], bl
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xff
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0f010aa1
test eax, eax
pop esi
je 0xf046583
cmp byte [ebp - 0x114], bl
mov byte [ebp - 0x109], bl
je 0xf04657b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.0f046150
test eax, eax
je 0xf04657b
lea eax, [ebp - 0x114]
push eax
lea eax, [edi + 0x1e]
push eax
call fcn.0f045dda
xor eax, eax
mov byte [edi + 0x15], 8
mov word [edi + 0x1a], bx
mov word [edi + 0x1c], bx
mov word [edi + 0x16], bx
mov word [edi + 0x18], bx
inc eax
jmp 0xf046585
push 0x12
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.0f01b9b9
leave
ret 0xc

Function at 0xf046ad8
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0xf062038]
and word [ebp - 8], 0
mov dword [ebp - 4], eax
mov ax, word [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
movzx eax, word [esi + 2]
shr eax, 1
push eax
push dword [esi + 4]
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xa], 0x3a
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0xf046b77
push 1
push esi
lea eax, [eax + eax - 4]
push 0xf09cdc8
mov word [esi], ax
call fcn.0f04692a
test eax, eax
je 0xf046b4a
mov eax, dword [0xf09cdc8]
add eax, 0xfffffffc
push eax
push 0
push esi
call fcn.0f0469b5
mov eax, dword [esi + 4]
mov word [eax], 0x5c
jmp 0xf046b6c
push 1
push esi
push 0xf09cdb8
call fcn.0f04692a
test eax, eax
je 0xf046b70
xor eax, eax
mov ax, word [0xf09cdb8]
push eax
push 0
push esi
call fcn.0f0469b5
xor eax, eax
jmp 0xf046b82
mov eax, 0x80070089
jmp 0xf046b82
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0x80070000
mov ecx, dword [ebp - 4]
pop esi
call fcn.0f01b9b9
leave
ret 8
Function at 0xf0475b6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0xf0475d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0x80070000
jmp 0xf0475e9
and al, 0x10
neg al
sbb eax, eax
and eax, 0x7ff8fffd
add eax, 0x80070003
pop ebp
ret 4

Function at 0xf0475f2
Capabilities:
Check if file exists
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0xf062038]
and word [ebp - 8], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
add eax, 0x40
push edi
mov word [ebp - 0xc], ax
push 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xa], 0x3a
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0xf04766b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
jne 0xf04766e
push esi
call fcn.0f0475b6
test eax, eax
jl 0xf047673
push dword [esi + 4]
lea eax, [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
je 0xf047667
xor eax, eax
jmp 0xf047673
call edi
jmp 0xf04766e
mov eax, dword [ebp - 0xc]
or eax, 0x80070000
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0f01b9b9
leave
ret 8

Function at 0xf0477e9
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push esi
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0xf04784e
push dword [ebp + 0x18]
xor edi, edi
push dword [ebp + 0x14]
inc edi
push esi
call fcn.0f0477b4
test eax, eax
jne 0xf04783d
test edi, edi
je 0xf047846
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push dword [ebp + 0x18]
mov edi, eax
push dword [ebp + 0x14]
push esi
call fcn.0f0477b4
test eax, eax
je 0xf04781b
test edi, edi
je 0xf047846
mov eax, dword [ebp + 8]
mov dword [eax], ebx
xor eax, eax
jmp 0xf04786a
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
or esi, 0x80070000
cmp ebx, 0xffffffff
je 0xf047868
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0xf0478b5
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [0xf09ce20]
test edx, edx
jne 0xf04790c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x280
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, eax
test edx, edx
jne 0xf0478ec
mov eax, 0x80070008
jmp 0xf047996
and dword [0xf09ce2c], 0
push 0x20
pop ecx
or eax, 0xffffffff
mov dword [0xf09ce20], edx
mov dword [0xf09ce24], ecx
mov dword [0xf09ce28], eax
jmp 0xf047917
mov eax, dword [0xf09ce28]
mov ecx, dword [0xf09ce24]
cmp eax, 0xffffffff
push esi
push edi
je 0xf04792d
lea eax, [eax + eax*4]
lea ecx, [edx + eax*4]
mov eax, dword [ecx]
mov dword [0xf09ce28], eax
jmp 0xf047975
mov edi, dword [0xf09ce2c]
cmp edi, ecx
jb 0xf047968
lea esi, [ecx + 0x10]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea ecx, [esi + esi*4]
shl ecx, 2
push ecx
push edx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov edx, eax
test edx, edx
je 0xf04799a
mov dword [0xf09ce20], edx
mov dword [0xf09ce24], esi
lea eax, [edi + edi*4]
inc edi
lea ecx, [edx + eax*4]
mov dword [0xf09ce2c], edi
mov eax, ecx
sub eax, dword [0xf09ce20]
push 0x14
cdq
pop esi
idiv esi
mov edx, dword [ebp + 8]
or ax, 0x4000
mov word [edx], ax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
mov eax, 0x80070008
jmp 0xf047994

Function at 0xf047f94
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0xf09cde0]
movzx ax, byte [eax]
push ebx
mov bx, word [ebp + 8]
push esi
xor esi, esi
cmp bx, ax
jb 0xf047fe4
cmp bx, 0x19
ja 0xf048022
mov al, bl
add al, 0x41
mov byte [0xf065d04], al
mov eax, dword [0xf09cdec]
movzx ax, byte [eax]
cmp ax, bx
je 0xf047fdc
push 0xf065d04
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jbe 0xf048022
mov esi, dword [0xf09cde8]
jmp 0xf048022
mov al, bl
add al, 0x41
cmp bx, 1
mov byte [0xf065d04], al
jne 0xf048003
push 0xf065d04
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0xf048022
mov esi, dword [0xf09cde4]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp ax, 0x411
movzx eax, bx
jne 0xf04801d
imul eax, eax, 0x58
jmp 0xf048020
imul eax, eax, 0x47
add esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4