joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417a85
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x218
mov eax, dword [0x5107c0]
xor eax, ebp
mov dword [ebp + 0x198], eax
push ebx
push esi
push edi
call fcn.00417be7
push 0x23
lea edx, [ebp - 0x70]
pop ecx
call fcn.00416882
push 0x8b7e77eb
mov edx, 0x8c2a6a0f
mov ecx, 0x732b8c19
mov esi, eax
call fcn.0040160e
pop ecx
push eax
lea eax, [ebp - 0x70]
lea eax, [eax + esi*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor ebx, ebx
lea eax, [ebp - 0x70]
push ebx
push 0x80
push 3
push ebx
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x417b59
mov ecx, dword [ebp + 0x1a4]
mov word [ebp - 0x77], bx
mov byte [ebp - 0x75], bl
mov word [ebp - 0x74], 0x8b88
lea eax, [ecx - 1]
mov byte [ebp - 0x72], 0x8d
cmp eax, 2
ja 0x417b20
mov al, byte [ebp + ecx - 0x75]
jmp 0x417b22
mov al, 1
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov byte [ebp - 0x78], al
lea eax, [ebp - 0x7c]
push eax
push 4
lea eax, [ebp - 0x78]
push eax
push edi
call esi
push ebx
lea eax, [ebp - 0x7c]
mov word [ebp - 0x73], bx
push eax
push 4
lea eax, [ebp - 0x74]
mov byte [ebp - 0x71], bl
push eax
push edi
mov byte [ebp - 0x74], 0x8c
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b35e5
lea esp, [ebp + 0x19c]
pop ebp
ret 4

Function at 0x417be7
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x417b73
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x417c1d
push 0
push 0
push 2
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
xor eax, eax
test ecx, ecx
setne al
mov esp, ebp
pop ebp
ret
Function at 0x417c28
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x120
mov eax, dword [0x5107c0]
xor eax, esp
mov dword [esp + 0x11c], eax
push edi
mov edi, dword [esp + 0x128]
xor eax, eax
push 0x10c
push eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
mov dword [edi + 4], 6
mov dword [esp + 0x18], 0x114
call fcn.004b6030
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x10], 5
jne 0x417d0e
push ebx
push ebp
push 4
pop ebp
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebp
push eax
lea eax, [edi + 0xc]
mov edx, 0xaf59d492
push eax
push 0xa80dc943
mov ecx, 0x5058325a
call fcn.0040160e
pop ecx
push eax
mov ebx, 0x80000000
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebp
push eax
lea eax, [esp + 0x14]
mov edx, 0x58d95233
push eax
push 0x5f8d4fe2
mov ecx, 0xa7d8b497
call fcn.0040160e
pop ecx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
dec eax
je 0x417d07
dec eax
je 0x417cfe
dec eax
dec eax
jne 0x417d0e
mov dword [edi + 8], 3
jmp 0x417d0e
mov dword [edi + 8], 2
jmp 0x417d0e
mov dword [edi + 8], 1
mov ecx, dword [esp + 0x120]
mov al, 1
pop edi
xor ecx, esp
call fcn.004b35e5
add esp, 0x120
ret 4
Function at 0x417d28
Capabilities:
Delete file
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2b4]
sub esp, 0x334
mov eax, dword [0x5107c0]
xor eax, ebp
mov dword [ebp + 0x2b0], eax
and dword [ebp - 0x74], 0
lea eax, [ebp - 0x70]
push ebx
push esi
push 0x10c
push 0
push eax
mov dword [ebp - 0x78], 0x114
call fcn.004b6030
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 5
pop eax
cmp dword [ebp - 0x74], eax
jne 0x417e6a
push 0x69577047
mov edx, 0x6e036dba
mov dword [ebp - 0x80], eax
mov ecx, 0x91028df8
call fcn.0040160e
mov edx, 0x3f347fb3
mov dword [esp], 0x38606262
mov ecx, 0xc0359855
mov ebx, eax
call fcn.0040160e
pop ecx
lea ecx, [ebp - 0x7c]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x417ddc
push 4
lea eax, [ebp - 0x80]
push eax
push 4
push 0
push ebx
push dword [ebp - 0x7c]
call esi
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0x2bc]
xor ecx, ecx
push 2
pop ebx
inc ecx
mov dword [ebp + 0xa0], ebx
lea eax, [edx - 1]
mov dword [ebp + 0x9c], ecx
mov dword [ebp + 0xa4], 4
cmp eax, ebx
ja 0x417e0c
mov ecx, dword [ebp + edx*4 + 0x98]
mov dword [ebp - 0x80], ecx
mov edx, 0x93b89507
push 0x94ec88fa
mov ecx, 0x6cb97525
call fcn.0040160e
push 0xa8f138d0
mov edx, 0xafa52501
mov ecx, 0x50a4c547
mov ebx, eax
call fcn.0040160e
pop ecx
pop ecx
lea ecx, [ebp - 0x7c]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x417ead
push 4
lea eax, [ebp - 0x80]
push eax
push 4
push 0
push ebx
push dword [ebp - 0x7c]
call esi
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x417ead
push 0x23
lea edx, [ebp + 0xa8]
pop ecx
call fcn.00416882
push 0x550d6d28
mov edx, 0x525970f4
mov ecx, 0xad5890d2
mov esi, eax
call fcn.0040160e
pop ecx
push eax
lea eax, [ebp + 0xa8]
lea eax, [eax + esi*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp + 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 0x2b0]
pop esi
xor ecx, ebp
pop ebx
call fcn.004b35e5
lea esp, [ebp + 0x2b4]
pop ebp
ret 4
Function at 0x417ee4
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x414
mov eax, dword [0x5107c0]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x428]
lea edx, [esp + 0x218]
push 0x1a
pop ecx
call fcn.00416882
push dword [esp + 0x42c]
mov esi, eax
mov edx, 0x1cbd7162
xor eax, eax
mov ecx, 0xe3bc918a
push 0x1be96cb8
xor ebp, ebp
mov word [esp + 0x18], ax
xor ebx, ebx
call fcn.0040160e
pop ecx
push eax
lea eax, [esp + 0x220]
lea eax, [eax + esi*2]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x10]
xor esi, esi
mov edx, 0x6e0737c8
inc esi
mov ecx, 0x9106d77e
push ebx
push eax
push 0x417ec6
push esi
push 0x69532a38
call fcn.0040160e
pop ecx
push eax
lea eax, [esp + 0x22c]
push eax
call fcn.00419a81
add esp, 0x18
cmp word [esp + 0x10], bx
je 0x418010
lea eax, [esp + 0x10]
push eax
call fcn.00419cdb
pop ecx
test al, al
je 0x418010
cmp dword [esp + 0x42c], 6
jne 0x417fb2
mov dword [edi + 4], 3
jmp 0x417fd2
cmp dword [esp + 0x42c], 5
jne 0x417fc5
mov dword [edi + 4], 2
jmp 0x417fd2
cmp dword [esp + 0x42c], 3
jne 0x417fd2
mov dword [edi + 4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [esp + 0x10]
push eax
push 0
push str.BDRegionCode
mov ebx, str.General
push ebx
call esi
mov ebp, eax
mov edx, 0x8594f023
lea eax, [esp + 0x10]
mov ecx, 0x7a951173
push eax
push 0
push 0x82c0edd3
call fcn.0040160e
pop ecx
push eax
push ebx
call esi
mov ebx, eax
dec ebp
je 0x41802c
dec ebp
je 0x418023
dec ebp
dec ebp
jne 0x418033
mov dword [edi + 8], 3
jmp 0x418033
mov dword [edi + 8], 2
jmp 0x418033
mov dword [edi + 8], 1
cmp ebx, 0xaf01cec2
je 0x418088
cmp ebx, 0xbc110012
je 0x41807f
cmp ebx, 0xd3a535fb
je 0x418076
cmp ebx, 0xdcab1f36
je 0x41806d
cmp ebx, 0xf0cc1274
je 0x418064
test ebx, ebx
jne 0x41808f
and dword [edi + 0xc], ebx
jmp 0x41808f
mov dword [edi + 0xc], 3
jmp 0x41808f
mov dword [edi + 0xc], 4
jmp 0x41808f
mov dword [edi + 0xc], 5
jmp 0x41808f
mov dword [edi + 0xc], 1
jmp 0x41808f
mov dword [edi + 0xc], 2
mov ecx, dword [esp + 0x420]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b35e5
add esp, 0x414
ret 8
Function at 0x41888f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5107c0]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 4
push esi
push edi
mov edi, dword [ebp + 8]
jne 0x4188bc
push ecx
mov cl, byte [ebp + 0x10]
call fcn.004167da
pop ecx
push 5
pop eax
jmp 0x41899f
cmp dword [ebp + 0xc], 5
jne 0x41899d
push 0x30
pop ecx
push 0x32
pop eax
push 0x50
mov word [ebp - 0x16], ax
pop eax
push 0x47
mov word [ebp - 0x14], ax
pop eax
push 0x31
mov word [ebp - 0x12], ax
pop eax
mov word [ebp - 0x10], ax
push 0x56
pop eax
mov word [ebp - 0xe], ax
xor eax, eax
cmp dword [ebp + 0x10], 1
mov word [ebp - 0x18], cx
mov word [ebp - 0xc], cx
mov word [ebp - 0xa], ax
je 0x418917
cmp dword [ebp + 0x10], 2
jne 0x41890a
push 0x37
jmp 0x418912
cmp dword [ebp + 0x10], 3
jne 0x418917
push 0x42
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1c]
mov edx, 0x30d6c17a
push eax
push 0x3782dc8b
mov ecx, 0xcfd722dc
call fcn.0040160e
pop ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4189b1
push 0x10
lea eax, [ebp - 0x18]
mov edx, 0x114c8f4b
push eax
push 1
push 0
push 0x161892b1
mov ecx, 0xee4d6309
call fcn.0040160e
pop ecx
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 5
jne 0x4189b1
push 0x10
push 0x4e8940
push 0x6fc0d5c6
mov edx, 0x6894c817
mov ecx, 0x97952447
call fcn.0040160e
pop ecx
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.004b35e5
mov esp, ebp
pop ebp
ret 0xc
push 4
jmp 0x4188b6
Function at 0x418eb8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x84
mov eax, dword [0x5107c0]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push ebp
push esi
push str.InitRegister2
mov ebx, ecx
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBegin]
mov ecx, dword [0x521818]
push 0x3c
pop esi
push 0x61
pop eax
push 0x3e
mov word [esp + 0x12], ax
pop eax
mov word [esp + 0x10], ax
lea eax, [esp + 0x12]
push esi
push eax
push 0x42
mov word [esp + 0x18], si
call fcn.0041c148
test eax, eax
jne 0x418f2a
movzx edx, word [0x517870]
lea eax, [esp + 0x12]
push esi
push eax
xor edx, 0xc7c7
mov ecx, 0x517872
call fcn.00415bfb
pop ecx
pop ecx
push 0xbba09848
mov edx, 0xa532b5e2
mov ecx, 0xf7bc3d46
call fcn.0040169c
mov edx, eax
xor ebp, ebp
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, bp
jne 0x418f45
push edi
lea edi, [esp + 0x10]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bp
jne 0x418f5a
mov ecx, edx
lea eax, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, edx
and ecx, 3
push 0x33
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x418fc5
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
lea edi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x418fa3
sub edx, edi
cmp edx, 0xac
jb 0x418fbe
push eax
push 0x32
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esi, dword [0x521978]
pop edi
test esi, esi
jne 0x418fdd
call fcn.00419698
mov esi, eax
push 0x32
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push esi
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
mov ecx, dword [esp + 0x8c]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b35e5
add esp, 0x84
ret
Function at 0x4190ed
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x204
mov eax, dword [0x5107c0]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push ebp
push esi
push edi
push str.DoRegister
mov ebp, ecx
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBegin]
push 0x32
push ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, 0x400
mov edi, eax
push ebx
call fcn.00407458
pop ecx
push ebx
mov esi, eax
push esi
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push esi
call fcn.0045eb2d
cmp byte [esi], 0
pop ecx
je 0x4191f7
mov ecx, esi
call fcn.00418b7e
mov ecx, dword [0x521818]
mov ebx, 0x100
test eax, eax
lea eax, [esp + 0x10]
push ebx
push eax
jne 0x4191af
push 0x46
call fcn.0041c148
test eax, eax
jne 0x41918a
movzx edx, word [0x517922]
lea eax, [esp + 0x10]
push ebx
push eax
xor edx, 0xc7c7
mov ecx, 0x517924
call fcn.00415bfb
pop ecx
pop ecx
push 0x40
push 0x4e8940
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push ebp
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, esi
call fcn.00419094
jmp 0x419207
push 0x47
call fcn.0041c148
test eax, eax
jne 0x4191d9
movzx edx, word [0x517954]
lea eax, [esp + 0x10]
push ebx
push eax
xor edx, 0xc7c7
mov ecx, 0x517956
call fcn.00415bfb
pop ecx
pop ecx
push 0x10
push 0x4e8940
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x419207
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push esi
call fcn.0040746c
pop ecx
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
mov ecx, dword [esp + 0x210]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b35e5
add esp, 0x204
ret

Function at 0x4198e7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x50]
push esi
push eax
call fcn.004b6030
add esp, 0xc
mov dword [ebp - 0x54], 0x44
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp byte [ebp + 0x10], 1
mov edi, eax
jne 0x41993e
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x419956
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x5107c0]
xor eax, ebp
mov dword [ebp + 0x94], eax
and dword [ebp - 0x7c], 0
lea eax, [ebp - 0x78]
push 0x10c
push 0
push eax
mov dword [ebp - 0x80], 0x114
call fcn.004b6030
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
mov ecx, dword [ebp + 0x94]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.004b35e5
lea esp, [ebp + 0x98]
pop ebp
ret
Function at 0x4199b5
Capabilities:
Create process on windows

Disassembly:
push 1
xor eax, eax
push eax
push eax
push dword [esp + 0x10]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x4199c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x3c]
push 0x38
push 0
push eax
call fcn.004b6030
mov eax, dword [ebp + 0x14]
add esp, 0xc
neg eax
mov dword [ebp - 0x40], 0x3c
sbb eax, eax
and eax, 0x40
mov dword [ebp - 0x3c], eax
call fcn.00419956
test eax, eax
mov dword [ebp - 0x24], 1
mov eax, dword [ebp + 8]
mov edx, str.open
mov dword [ebp - 0x30], eax
mov ecx, str.runas
mov eax, dword [ebp + 0xc]
cmove ecx, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x34], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp + 0x14], 0
je 0x419a61
test eax, eax
je 0x419a61
cmp dword [ebp - 0x20], 0x20
jle 0x419a61
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x419b1b
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
mov eax, dword [0x5107c0]
xor eax, esp
mov dword [esp + 0x258], eax
mov eax, dword [esp + 0x264]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x270]
mov bl, 1
mov ecx, edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x27c]
xor ebp, ebp
mov dword [esp + 0x10], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bp
jne 0x419b59
sub ecx, edx
sar ecx, 1
push 0x2a
pop eax
lea esi, [edi + ecx*2]
mov word [esi], ax
xor eax, eax
mov word [esi + 2], ax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x419cad
push 0x2e
pop eax
test byte [esp + 0x18], 0x10
je 0x419c35
cmp byte [esp + 0x278], 0
je 0x419c8b
cmp word [esp + 0x44], ax
jne 0x419bd0
cmp word [esp + 0x46], 0
je 0x419c8f
cmp word [esp + 0x46], ax
jne 0x419bd0
cmp word [esp + 0x48], 0
je 0x419c8f
lea ecx, [esp + 0x44]
mov edx, esi
mov eax, ecx
sub edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x419bda
mov ecx, esi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x419bf0
push 0x5c
pop eax
push dword [esp + 0x284]
sub ecx, edx
push dword [esp + 0x284]
sar ecx, 1
push dword [esp + 0x18]
push dword [esp + 0x284]
mov word [esi + ecx*2], ax
xor eax, eax
push dword [esp + 0x24]
mov word [esi + ecx*2 + 2], ax
push edi
call fcn.00419b1b
add esp, 0x18
jmp 0x419c84
mov eax, dword [esp + 0x14]
test eax, eax
je 0x419c4c
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00419cf3
pop ecx
pop ecx
jmp 0x419c4f
xor eax, eax
inc eax
test eax, eax
je 0x419c8b
lea ecx, [esp + 0x44]
mov edx, esi
mov eax, ecx
sub edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x419c5d
push dword [esp + 0x284]
lea eax, [esp + 0x1c]
push dword [esp + 0x284]
push edi
push eax
call dword [esp + 0x20]
mov bl, al
xor eax, eax
mov word [esi], ax
test bl, bl
je 0x419ca6
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x419b91
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x268]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b35e5
add esp, 0x25c
ret

Function at 0x419cc8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
ret

Function at 0x419cdb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
ret

Function at 0x419cee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x419a7e
shr eax, 4
and eax, 1
ret
xor al, al
ret
jmp 0x419a68
Function at 0x41a241
Capabilities:
Clear file content

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.004b683a
push dword [esp + 0x10]
call fcn.004b656b
push eax
call fcn.004b70be
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov al, 1
ret
Function at 0x41b6d6
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx], 0xffffffff
jne 0x41b6e2
xor eax, eax
jmp 0x41b72a
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
xor edi, edi
test esi, esi
je 0x41b725
and dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push 0
push eax
mov eax, 0x400
cmp esi, eax
cmovb eax, esi
push eax
push ebp
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b725
add ebp, dword [esp + 0x14]
add edi, dword [esp + 0x14]
sub esi, dword [esp + 0x14]
jne 0x41b6f3
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x41bab8
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x570
mov eax, dword [0x5107c0]
xor eax, esp
mov dword [esp + 0x56c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x580]
lea eax, [esp + 0x370]
xor ebp, ebp
mov dword [esp + 0x18], ecx
push edi
inc ebp
mov dword [esp + 0x14], esi
push eax
mov dword [esp + 0x1c], ebp
call fcn.0041bd2b
push dword [0x5218cc]
mov ebx, eax
push str._s___.ini
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
xor edi, edi
push str.English
push edi
push 0x143
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x554e45
push eax
push 0x151
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push edi
push 0x14e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x24c
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], edi
push edi
push eax
call fcn.004b6030
add esp, 0xc
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [esp + 0x20], edi
cmp edi, 0xffffffff
je 0x41bc9c
or dword [esp + 0x10], 0xffffffff
test byte [esp + 0x24], 0x10
jne 0x41bc81
lea eax, [esp + 0x50]
push 0x5f
push eax
call fcn.004b4e46
pop ecx
pop ecx
test eax, eax
je 0x41bc81
lea eax, [esp + 0x50]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [0x5218cc]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x41bbb4
sub esi, ecx
sar esi, 1
cmp word [ebx + esi*2], 0x45
jne 0x41bbde
cmp word [ebx + esi*2 + 2], 0x4e
jne 0x41bbde
cmp word [ebx + esi*2 + 4], 0x55
je 0x41bc81
lea eax, [esp + 0x374]
push eax
push 0x80
lea eax, [esp + 0x27c]
push eax
push 0x4e8cf8
push str.Name
push str.INFO
call fcn.0041c197
add esp, 0x18
lea eax, [esp + 0x274]
push eax
xor eax, eax
push eax
push 0x143
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
movzx edi, byte [ebx + esi*2 + 4]
mov ebp, eax
movzx eax, byte [ebx + esi*2 + 2]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + esi*2]
mov esi, dword [esp + 0x14]
shl edi, 8
or edi, eax
push edi
push ebp
push 0x151
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x10], 0xffffffff
jne 0x41bc74
mov eax, dword [esp + 0x1c]
cmp edi, dword [eax + 4]
jne 0x41bc74
xor eax, eax
mov dword [esp + 0x10], ebp
push eax
push ebp
push 0x14e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x20]
inc ebp
mov dword [esp + 0x18], ebp
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41bb7c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x57c]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b35e5
add esp, 0x570
ret 4