joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408439
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
cmp dword [0x5de7a2], 0
jne 0x408670
push 0x80000301
push 0
push 0x40
push 1
mov ebx, 0x184
call fcn.00511260
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40848b
push ebx
call fcn.0050fbf4
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x4084b8
push 0xb8
push 0x40161e9
push 6
call fcn.0050fc00
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00510f20
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.0040107b
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4084fd
push ebx
call fcn.0050fbf4
add esp, 4
mov dword [ebp - 0x18], esp
push 0x40
push dword [ebp - 4]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x408531
push 0xb8
push 0x40161e9
push 6
call fcn.0050fc00
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x408541
push ebx
call fcn.0050fbf4
add esp, 4
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x408554
mov eax, 0x537282
push eax
push 1
mov ebx, 0x164
call fcn.005112a0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
fld qword [ebp - 0x14]
call fcn.0040148c
mov dword [0x5de7a2], eax
cmp dword [0x5de7a2], 0
jne 0x408670
call fcn.00408690
mov dword [0x5de7a2], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x4085ba
push 0x1c1
push 0x40161e9
push 6
call fcn.0050fc00
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00510f20
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.0040107b
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4085ff
push ebx
call fcn.0050fbf4
add esp, 4
push 0x80000301
push 0
push dword [0x5de7a2]
push 1
mov ebx, 0x168
call fcn.00510f20
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x408650
push 0x1d6
push 0x40161e9
push 6
call fcn.0050fc00
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x408660
push ebx
call fcn.0050fbf4
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x408670
push ebx
call fcn.0050fbf4
add esp, 4
mov eax, dword [0x5de7a2]
jmp 0x40867a
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40868b
push ebx
call fcn.0050fbf4
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40958f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push str.ntdll.dll
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
cmp dword [ebp - 8], esp
je 0x4095cd
push 0x36
push 0x4016113
push 6
call fcn.0050fc00
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push str.NtQueryInformationThread
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x409601
push 0x36
push 0x4016113
push 6
call fcn.0050fc00
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4096fb
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
nop
nop
cmp dword [ebp - 8], esp
je 0x409637
push 0x94
push 0x4016113
push 6
call fcn.0050fc00
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
mov eax, 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 9
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x409680
push 0x94
push 0x4016113
push 6
call fcn.0050fc00
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4096fb
mov dword [ebp - 8], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
cmp dword [ebp - 8], esp
je 0x4096b8
push 0x132
push 0x4016113
push 6
call fcn.0050fc00
add esp, 0xc
push eax
call fcn.0040972f
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x14], eax
jne 0x4096fb
mov dword [ebp - 8], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 8], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x40a0cc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 4], 0
call fcn.00408f50
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x40a1f8
mov eax, 0x537736
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00403898
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40a112
push ebx
call fcn.0050fbf4
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysStringLen
push 0
push dword [0x5de796]
push 1
mov ebx, 0x9dc
call fcn.00511720
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
push 0
push dword [ebp - 0x30]
mov dword [ebp - 0x34], 0
push 0
push dword [ebp - 0x34]
mov dword [ebp - 0x38], 0
push 0
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0
push 0
push dword [ebp - 0x3c]
mov dword [ebp - 0x40], 0
push 0
push dword [ebp - 0x40]
push 1
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004038b4
lea eax, [ebp - 4]
push eax
call fcn.0040394c
call fcn.004094fc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x40a214
push 0
call fcn.0040958f
mov dword [ebp - 8], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40c356
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x208
push 1
mov ebx, 0x1bc
call fcn.00511940
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40c39b
push ebx
call fcn.0050fbf4
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0
push dword [ebp + 8]
mov eax, dword [ebp - 4]
test eax, eax
je 0x40c3b4
add eax, 8
push eax
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
nop
nop
cmp dword [ebp - 8], esp
je 0x40c3e0
push 0x48
push 0x4014fa8
push 6
call fcn.0050fc00
add esp, 0xc
test eax, eax
je 0x40c4b6
lea eax, [ebp - 4]
push eax
call fcn.0040c163
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40c420
push 0xe4
push 0x4014fa8
push 6
call fcn.0050fc00
add esp, 0xc
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x537400]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fmul qword [0x53746f]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.0040148c
push 0x80000301
push 0
push eax
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40c464
mov eax, 0x537293
push eax
push 2
mov ebx, 0x1a0
call fcn.00511970
add esp, 0x1c
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40c48e
push ebx
call fcn.0050fbf4
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x40c4ac
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0050fbee
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40c4c0
mov eax, 0x5377bc
jmp 0x40c4c0
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40c4d1
push ebx
call fcn.0050fbf4
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x41673a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0x14]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x416784
push 0x12
push 0x4015a48
push 6
call fcn.0050fc00
add esp, 0xc
jmp 0x416789
mov esp, ebp
pop ebp
ret 0x14

Function at 0x41af23
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 1
push 0x537282
push 0x537282
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
cmp dword [ebp - 4], esp
je 0x41af73
push 0x24
push 0x40122c4
push 6
call fcn.0050fc00
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x1f
mov eax, 0
setg al
jmp 0x41af87
mov esp, ebp
pop ebp
ret 4
Function at 0x41eb57
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [0x5de7de]
call fcn.0041ebe1
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
nop
cmp dword [ebp - 4], esp
je 0x41eb99
push 0x5d
push 0x40110eb
push 6
call fcn.0050fc00
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov eax, 0
sete al
test eax, eax
je 0x41ebb7
mov eax, 0
jmp 0x41ebba
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 1
push dword [ebp - 8]
push dword [ebp + 8]
push dword [0x5de7e2]
call fcn.0041ec1c
push dword [0x5de7de]
call fcn.0041f737
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4760b5
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x4760ed
push 0x12
push 0x4014fb2
push 6
call fcn.0050fc00
add esp, 0xc
jmp 0x4760f2
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4770a6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysStringLen
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.00511720
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x477116
push 0x3d
push 0x4014fb1
push 6
call fcn.0050fc00
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x477154
mov dword [ebp - 8], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 8], esp
je 0x47714f
push 0x9d
push 0x4014fb1
push 6
call fcn.0050fc00
add esp, 0xc
jmp 0x47715c
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov eax, dword [ebp - 4]
jmp 0x477164
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4810f7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x40
push 0x1000
push 0x1000
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 8], esp
je 0x481144
push 0x19
push 0x4015a46
push 6
call fcn.0050fc00
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp]
mov eax, dword [eax + 8]
mov ecx, eax
mov ebx, dword [ebp + 8]
dec ebx
imul ebx, ebx, 4
mov eax, dword [eax]
mov eax, dword [eax]
add eax, ebx
mov ebx, dword [eax]
mov eax, dword [ebp - 4]
mov word [eax], 0xb85b
mov dword [eax + 2], ebx
mov byte [eax + 6], 0x68
mov dword [eax + 7], ecx
mov word [eax + 0xb], 0xff53
mov byte [eax + 0xd], 0xe0
mov eax, dword [ebp - 4]
jmp 0x481182
mov esp, ebp
pop ebp
ret 4

Function at 0x4ca159
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 4], esp
je 0x4ca19d
push 0x12
push 0x4016246
push 6
call fcn.0050fc00
add esp, 0xc
jmp 0x4ca1a2
mov esp, ebp
pop ebp
ret 4
Function at 0x5048bc
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x5048f6
push 0x24
push 0x4015a49
push 6
call fcn.0050fc00
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x50490a
mov esp, ebp
pop ebp
ret 4

Function at 0x510d60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5df080]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x108], ecx
lea eax, [ecx - 1]
cmp eax, 0xa
ja 0x510d8d
mov edx, dword [ecx*4 + 0x5dee20]
lea eax, [ebp - 0x108]
mov eax, dword [eax - 4]
test eax, eax
je 0x510dcb
push esi
mov esi, 0xc483
cmp si, word [eax]
pop esi
jne 0x510dcb
cmp byte [eax + 2], 0xc
jl 0x510dcb
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push dword [ebp + 0xc]
push edx
push ecx
push 0x52e5a4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
jmp 0x510de2
push edx
push ecx
lea eax, [ebp - 0x104]
push str.program_internal_error_number_is__d.__r_n_s_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [0x5df9d0]
test eax, eax
je 0x510e1b
cmp dword [0x5df9e4], 0
jne 0x510e1b
lea ecx, [ebp - 0x104]
mov dword [0x5df9e4], 1
push ecx
push dword [ebp - 0x108]
call eax
mov dword [0x5df9e4], 0
test eax, eax
jne 0x510e31
push 0x10
push 0x52e60c
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.005109b0
cmp dword [0x5df9c8], 0
jne 0x510e47
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0
mov ebp, dword [0x5df9cc]
mov esp, dword [0x5df9c8]
sub esp, 4
ret
Function at 0x511cd0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x5df080]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ecx]
push edi
xor edi, edi
mov dword [ebp - 0x14c], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x148], eax
test eax, eax
je 0x511d70
push eax
call dword [0x5df050]
add esp, 4
test eax, eax
je 0x511d6d
test esi, esi
je 0x511d24
cmp esi, 0xffffffff
je 0x511d24
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], esi
cmp esi, 0xffffffff
je 0x511dac
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x511d5d
mov edi, dword [ebp - 0x144]
shr edi, 4
not edi
and edi, 1
jmp 0x511d70
test dword [ebp - 0x144], ebx
mov eax, 1
cmovne edi, eax
jmp 0x511d70
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x511dac
cmp esi, 0xffffffff
je 0x511dac
test edi, edi
jne 0x511dec
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x144]
push eax
push esi
test ecx, ecx
je 0x511dbf
call edi
test eax, eax
je 0x511dac
test byte [ebp - 0x144], 0x10
je 0x511dec
lea eax, [ebp - 0x144]
push eax
push esi
call edi
test eax, eax
jne 0x511d95
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00517f5f
mov esp, ebp
pop ebp
ret
call edi
test eax, eax
je 0x511dac
test dword [ebp - 0x144], ebx
jne 0x511dec
lea eax, [ebp - 0x144]
push eax
push esi
call edi
test eax, eax
jne 0x511dc5
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00517f5f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x118]
push eax
call dword [0x5df050]
inc eax
push eax
call fcn.00510bd0
lea edx, [ebp - 0x118]
mov esi, eax
mov ecx, edx
add esp, 8
sub esi, ecx
nop
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], cl
test cl, cl
jne 0x511e10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00517f5f
mov esp, ebp
pop ebp
ret
Function at 0x511f80
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x5df080]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x108]
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x511fa0
push ebx
lea eax, [ebp - 0x108]
push edi
push eax
call dword [0x5df050]
add esp, 4
cmp byte [ebp + eax - 0x109], 0x5c
je 0x511fe3
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x511fd0
mov ax, word [0x52e644]
mov word [edi], ax
xor ecx, ecx
mov al, byte [ebp + ecx - 0x108]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x20d], al
test al, al
jne 0x511fe5
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x512001
mov ax, word [0x52e648]
mov word [edi], ax
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
test ebx, ebx
je 0x51216f
cmp ebx, 0xffffffff
je 0x51216f
push esi
mov esi, 1
mov ecx, 0x52e64c
lea eax, [ebp - 0x320]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x512070
test dl, dl
je 0x51206c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x512070
add eax, 2
add ecx, 2
test dl, dl
jne 0x512050
xor eax, eax
jmp 0x512075
sbb eax, eax
or eax, 1
test eax, eax
je 0x51213f
mov ecx, 0x52e650
lea eax, [ebp - 0x320]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5120a8
test dl, dl
je 0x5120a4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5120a8
add eax, 2
add ecx, 2
test dl, dl
jne 0x512088
xor eax, eax
jmp 0x5120ad
sbb eax, eax
or eax, 1
test eax, eax
je 0x51213b
xor eax, eax
nop word [eax + eax]
mov cl, byte [ebp + eax - 0x20c]
lea eax, [eax + 1]
mov byte [ebp + eax - 0x109], cl
test cl, cl
jne 0x5120c0
lea edx, [ebp - 0x320]
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x5120e0
lea edi, [ebp - 0x108]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x5120f0
mov ecx, edx
lea eax, [ebp - 0x108]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test byte [ebp - 0x34c], 0x10
rep movsb byte es:[edi], byte [esi]
push eax
je 0x512133
call fcn.00511f80
mov esi, eax
add esp, 4
test esi, esi
je 0x512155
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x512139
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
test esi, esi
je 0x512155
lea eax, [ebp - 0x34c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x512041
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00517f5f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.00517f5f
mov esp, ebp
pop ebp
ret
Function at 0x512190
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x5121ca
push esi
call dword [0x5df050]
add esp, 4
test eax, eax
je 0x5121ca
cmp eax, 1
jne 0x5121b3
cmp byte [esi], 0x5c
je 0x5121ca
push esi
call fcn.00511f80
add esp, 4
test eax, eax
je 0x5121cc
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x512800
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x400
call fcn.005180d2
mov ebx, dword [ebp + 0xc]
add esp, 4
mov edi, eax
push ebx
push 0x400
push edi
push dword [ebp + 0x30]
push dword [ebp + 0x24]
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, eax
cmp ecx, 0x3ff
jl 0x512872
nop dword [eax + eax]
push edi
lea esi, [ecx + 0x400]
call fcn.005180db
push esi
call fcn.005180d2
add esp, 8
mov edi, eax
push ebx
push esi
push edi
push dword [ebp + 0x30]
push dword [ebp + 0x24]
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, eax
lea eax, [esi - 1]
cmp ecx, eax
jge 0x512840
push edi
xor esi, esi
call dword [0x5df050]
add esp, 4
test eax, eax
je 0x51288e
push eax
push edi
call fcn.005177e0
add esp, 8
mov esi, eax
push edi
call fcn.005180db
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x515480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp ecx, 0xffffffff
je 0x51550f
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, 1
mov dword [ebp - 8], 1
cmp ebx, esi
jle 0x5154ff
push edi
lea edi, [ebp + 0x18]
mov eax, dword [edi]
lea edx, [ebp - 0xc]
push 0
push edx
push dword [eax + 4]
add eax, 8
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
test eax, eax
je 0x5154f7
inc esi
add edi, 0xc
cmp esi, ebx
jl 0x5154c1
pop edi
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], 0
pop edi
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret