joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fbf20
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
sub esp, 4
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], 0
mov edi, dword [0x540870]
jmp 0x4fbf47
mov edi, dword [edi + 8]
test edi, edi
je 0x4fbf54
mov esi, dword [edi]
mov eax, dword [ebp + 8]
cmp dword [esi], eax
ja 0x4fbf44
test edi, edi
jne 0x4fbf60
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
mov ebx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
xor edx, edx
cmp eax, 1
mov ecx, eax
je 0x4fbf9d
lea eax, [eax]
lea esi, [edx + ecx]
mov edi, dword [ebp + 8]
sar esi, 1
add edi, 0xffffffff
cmp dword [ebx + esi*8], edi
ja 0x4fbf94
mov edx, esi
jmp 0x4fbf96
mov ecx, esi
lea esi, [edx + 1]
cmp esi, ecx
jne 0x4fbf80
mov edi, dword [ebp + 8]
add edi, 0xffffffff
cmp edi, dword [ebx + edx*8]
jb 0x4fc099
lea esi, [edx + 1]
cmp esi, eax
je 0x4fbfc3
mov ecx, dword [ebp + 8]
add ecx, 0xffffffff
cmp ecx, dword [ebx + edx*8 + 8]
jae 0x4fc099
mov esi, dword [ebx + edx*8 + 4]
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
movsx eax, byte [ecx]
test eax, 1
mov edi, esi
jne 0x4fc08f
movzx eax, word [ecx + 5]
add edi, 7
xor esi, esi
test eax, eax
mov dword [ebp - 0x10], eax
jle 0x4fc08f
mov ebx, dword [edi]
movzx ecx, byte [ebx]
cmp cl, 0xe8
je 0x4fc004
cmp cl, 0xcc
jne 0x4fc010
add ebx, 5
jmp case.default.0x4fc048
cmp cl, 0xff
jne 0x4fc060
movzx edx, byte [ebx + 1]
mov ecx, edx
sar ecx, 6
and edx, 7
add ebx, 2
cmp ecx, 3
je case.default.0x4fc048
cmp edx, 4
jne 0x4fc031
add ebx, 1
test ecx, ecx
jne 0x4fc040
cmp edx, 5
jne 0x4fc040
add ebx, 4
jmp case.default.0x4fc048
lea eax, [ecx - 1]
cmp eax, 1
ja case.default.0x4fc048
jmp dword [eax*4 + 0x4ff344]
add ebx, 1
jmp case.default.0x4fc048
add ebx, 4
jmp case.default.0x4fc048
call fcn.004fcae0
cmp ebx, dword [ebp + 8]
jne 0x4fc080
mov esi, dword [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], esi
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
add esi, 1
add edi, 8
cmp esi, dword [ebp - 0x10]
jl 0x4fbff5
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], 0
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4fc04f
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
sub esp, 4
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], 0
mov edi, dword [0x540870]
jmp 0x4fbf47
mov edi, dword [edi + 8]
test edi, edi
je 0x4fbf54
mov esi, dword [edi]
mov eax, dword [ebp + 8]
cmp dword [esi], eax
ja 0x4fbf44
test edi, edi
jne 0x4fbf60
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
mov ebx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
xor edx, edx
cmp eax, 1
mov ecx, eax
je 0x4fbf9d
lea eax, [eax]
lea esi, [edx + ecx]
mov edi, dword [ebp + 8]
sar esi, 1
add edi, 0xffffffff
cmp dword [ebx + esi*8], edi
ja 0x4fbf94
mov edx, esi
jmp 0x4fbf96
mov ecx, esi
lea esi, [edx + 1]
cmp esi, ecx
jne 0x4fbf80
mov edi, dword [ebp + 8]
add edi, 0xffffffff
cmp edi, dword [ebx + edx*8]
jb 0x4fc099
lea esi, [edx + 1]
cmp esi, eax
je 0x4fbfc3
mov ecx, dword [ebp + 8]
add ecx, 0xffffffff
cmp ecx, dword [ebx + edx*8 + 8]
jae 0x4fc099
mov esi, dword [ebx + edx*8 + 4]
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
movsx eax, byte [ecx]
test eax, 1
mov edi, esi
jne 0x4fc08f
movzx eax, word [ecx + 5]
add edi, 7
xor esi, esi
test eax, eax
mov dword [ebp - 0x10], eax
jle 0x4fc08f
mov ebx, dword [edi]
movzx ecx, byte [ebx]
cmp cl, 0xe8
je 0x4fc004
cmp cl, 0xcc
jne 0x4fc010
add ebx, 5
jmp case.default.0x4fc048
cmp cl, 0xff
jne 0x4fc060
movzx edx, byte [ebx + 1]
mov ecx, edx
sar ecx, 6
and edx, 7
add ebx, 2
cmp ecx, 3
je case.default.0x4fc048
cmp edx, 4
jne 0x4fc031
add ebx, 1
test ecx, ecx
jne 0x4fc040
cmp edx, 5
jne 0x4fc040
add ebx, 4
jmp case.default.0x4fc048
lea eax, [ecx - 1]
cmp eax, 1
ja case.default.0x4fc048
jmp dword [eax*4 + 0x4ff344]
add ebx, 1
jmp case.default.0x4fc048
add ebx, 4
jmp case.default.0x4fc048
call fcn.004fcae0
cmp ebx, dword [ebp + 8]
jne 0x4fc080
mov esi, dword [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], esi
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
add esi, 1
add edi, 8
cmp esi, dword [ebp - 0x10]
jl 0x4fbff5
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], 0
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4fc410
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x14c
or ecx, 0xffffffff
mov edx, dword [0x54c300]
mov ebx, dword [0x54c2fc]
mov esi, dword [edx + ebx*4 - 4]
mov edi, esi
repne scasb al, byte es:[edi]
mov edi, 0xfffffffe
sub edi, ecx
add edi, esi
jmp 0x4fc443
sub edi, 1
cmp edi, esi
jbe 0x4fc45c
movsx edx, byte [edi - 1]
push edx
push 0x540918
call fcn.004f6c20
pop ecx
test eax, eax
pop ecx
je 0x4fc440
lea ecx, [ebp - 0x150]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x154], eax
je 0x4fc515
mov dword [ebp - 0x10], edi
sub dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
lea ebx, [ebp - 0x124]
mov dword [ebp - 0x158], eax
mov eax, eax
xor eax, eax
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
mov edx, 0xfffffffe
sub edx, ecx
add edx, dword [ebp - 0x158]
add edx, 1
push edx
call fcn.004f4810
mov edi, eax
pop ecx
push esi
push edi
call fcn.004f6b50
pop ecx
pop ecx
push ebx
mov ecx, edi
add ecx, dword [ebp - 0x10]
push ecx
call fcn.004f6b50
pop ecx
pop ecx
call fcn.004fc3c0
test eax, eax
je 0x4fc509
mov eax, dword [0x54c300]
mov edx, dword [0x54c2fc]
lea ecx, [ebp - 0x150]
mov dword [eax + edx*4 - 4], edi
push ecx
push dword [ebp - 0x154]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4fc509
mov edx, dword [0x54c2fc]
add dword [0x54c2fc], 1
test edx, edx
jne 0x4fc490
push dword [ebp - 0x154]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4fc520
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 8
mov dword [0x54bc90], 1
push 4
mov dword [0x54c2fc], 0
call fcn.004f4810
mov dword [0x54c300], eax
test eax, eax
pop ecx
mov dword [0x54c2e0], 0
jne 0x4fc565
call fcn.004fc3a0
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x14], eax
mov esi, eax
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
mov edx, 0xfffffffe
sub edx, ecx
add edx, 1
push edx
call fcn.004f4810
mov ebx, eax
test ebx, ebx
pop ecx
mov dword [0x54bc88], eax
jne 0x4fc5a5
call fcn.004fc3a0
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
add esi, 1
movsx eax, byte [esi]
push eax
push 0x54091c
call fcn.004f6c20
pop ecx
test eax, eax
pop ecx
jne 0x4fc5a2
cmp byte [esi], 0
je 0x4fc73c
call fcn.004fc3c0
test eax, eax
je 0x4fc73c
cmp dword [0x54c2fc], 1
mov dword [ebp - 0x10], 0
jne 0x4fc5ea
mov ecx, esi
sub ecx, dword [ebp - 0x14]
mov dword [0x54c2e0], ecx
mov edx, dword [0x54c300]
mov eax, dword [0x54c2fc]
mov dword [edx + eax*4], ebx
add dword [0x54c2fc], 1
movzx ecx, byte [esi]
xor edi, edi
test cl, cl
je 0x4fc728
lea eax, [eax]
test edi, edi
jne 0x4fc666
movsx ecx, cl
push ecx
push 0x540924
call fcn.004f6c20
pop ecx
test eax, eax
pop ecx
je 0x4fc651
add esi, 1
movzx ecx, byte [esi]
test cl, cl
je 0x4fc646
movsx edx, cl
push edx
push str.__t_r_n_v
call fcn.004f6c20
pop ecx
test eax, eax
pop ecx
jne 0x4fc628
mov byte [ebx], 0
add ebx, 1
jmp 0x4fc728
movzx ecx, byte [esi]
cmp cl, 0x22
jne 0x4fc690
add esi, 1
mov edi, 1
jmp 0x4fc71d
cmp cl, 0x22
jne 0x4fc680
cmp byte [esi + 1], 0x22
jne 0x4fc680
mov byte [ebx], 0x22
add ebx, 1
add esi, 2
jmp 0x4fc71d
cmp cl, 0x22
jne 0x4fc690
add esi, 1
xor edi, edi
jmp 0x4fc71d
cmp cl, 0x5c
jne 0x4fc6e4
cmp byte [esi + 1], 0x5c
jne 0x4fc6e4
cmp byte [esi + 2], 0x5c
mov eax, 2
jne 0x4fc6af
add eax, 1
cmp byte [esi + eax], 0x5c
je 0x4fc6a6
cmp byte [esi + eax], 0x22
jne 0x4fc6dd
and eax, 0xfffffffe
je 0x4fc71d
lea eax, [eax]
movzx ecx, byte [esi]
mov byte [ebx], cl
add ebx, 1
add esi, 2
sub eax, 2
jne 0x4fc6c0
jmp 0x4fc71d
movzx edx, byte [esi]
mov byte [ebx], dl
add esi, 1
add ebx, 1
sub eax, 1
jae 0x4fc6d2
jmp 0x4fc71d
cmp cl, 0x5c
jne 0x4fc700
cmp byte [esi + 1], 0x22
jne 0x4fc700
mov byte [ebx], 0x22
add ebx, 1
add esi, 2
jmp 0x4fc71d
test edi, edi
jne 0x4fc715
cmp cl, 0x2a
je 0x4fc70e
cmp cl, 0x3f
jne 0x4fc715
mov dword [ebp - 0x10], 1
mov byte [ebx], cl
add esi, 1
add ebx, 1
movzx ecx, byte [esi]
test cl, cl
jne 0x4fc610
cmp dword [ebp - 0x10], 0
je 0x4fc733
call fcn.004fc410
cmp byte [esi], 0
jne 0x4fc5c2
mov byte [ebx], 0
cmp dword [0x54c2fc], 1
jne 0x4fc752
mov eax, esi
sub eax, dword [ebp - 0x14]
mov dword [0x54c2e0], eax
mov ecx, dword [0x54c300]
mov edx, dword [0x54c2fc]
mov dword [ecx + edx*4], 0
push 0x4fc360
call fcn.004f95a0
pop ecx
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x2e014b3c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e0302bf
call fcn.2e00153c
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014b76
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014bdc
lea eax, [ebp - 0x14]
mov edi, 0x2e032941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014bd3
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014bd3
inc eax
push eax
call fcn.2e01784b
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014bc5
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010c49
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e01784b
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001586
ret 8
Function at 0x438cad
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x438a14
or edi, edi
add edi, 0xfb2cedd1
call fcn.00438cf2
add edi, 0x81415655
mov edi, edx
sub edi, 0xe3fa7ce6
xor dword [esi], ecx
sub esp, 4
mov dword [esp], 0xa0979ed1
pop edi
mov edx, edi
inc esi
and edx, edi
add edi, edi
and edx, edi
cmp esi, ebx
jne fcn.00438cad
push edi
pop edx
push edi
pop edi
ret
Function at 0x412565
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004123e4

Function at 0x41695c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004162ca

Function at 0x416967
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416505

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..00cfg
mov ebx, 0x408ecc
nop
mov ecx, 0x29037d28
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x3b34279f
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x404
mov eax, dword [0x40e004]
xor eax, esp
mov dword [esp + 0x400], eax
mov ecx, dword [esp + 0x408]
lea eax, [esp + 0x40c]
push eax
push ecx
lea edx, [esp + 8]
push 0x400
push edx
call fcn.004016f0
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00401456
add esp, 0x404
ret

Function at 0x401060
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
xor eax, eax
push 0x44
push eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
call fcn.00406900
mov ecx, dword [esp + 0x68]
add esp, 0xc
lea edx, [esp]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
mov dword [ecx], 0
mov ecx, dword [esp + 0x74]
push 0
push ecx
push 0
mov dword [esp + 0x38], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4010d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed._Error:_0x_08X_r_n
call fcn.00401000
add esp, 8
xor eax, eax
add esp, 0x54
ret
mov edx, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
mov eax, 1
pop esi
add esp, 0x54
ret
Function at 0x401456
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e004]
jne 0x401460
repz ret
jmp fcn.0040193a

Function at 0x4073b5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040483b
and dword [ebp - 4], 0
cmp dword [0x40f95c], 0
mov ebx, eax
jne 0x407466
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407517
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407517
push eax
call fcn.004047c9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40f95c], eax
call esi
push eax
call fcn.004047c9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40f960], eax
call esi
push eax
call fcn.004047c9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40f964], eax
call esi
push eax
call fcn.004047c9
pop ecx
mov dword [0x40f96c], eax
test eax, eax
je 0x407466
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004047c9
pop ecx
mov dword [0x40f968], eax
mov eax, dword [0x40f968]
cmp eax, ebx
je 0x4074be
cmp dword [0x40f96c], ebx
je 0x4074be
push eax
call fcn.00404844
push dword [0x40f96c]
mov esi, eax
call fcn.00404844
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4074be
test edi, edi
je 0x4074be
call esi
test eax, eax
je 0x4074b5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4074b5
test byte [ebp - 0xc], 1
jne 0x4074be
or dword [ebp + 0x10], 0x200000
jmp 0x4074f7
mov eax, dword [0x40f960]
cmp eax, ebx
je 0x4074f7
push eax
call fcn.00404844
pop ecx
test eax, eax
je 0x4074f7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4074f7
mov eax, dword [0x40f964]
cmp eax, ebx
je 0x4074f7
push eax
call fcn.00404844
pop ecx
test eax, eax
je 0x4074f7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40f95c]
call fcn.00404844
pop ecx
test eax, eax
je 0x407517
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407519
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401a60
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b6ad
mov eax, dword fs:[0]
push eax
sub esp, 0x4dc
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [ebp - 0x4e0]
push eax
push edi
mov bl, 1
call esi
cmp eax, 0xffffffff
je 0x401bf6
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x4e0]
shr eax, 4
test bl, al
je 0x401bf6
push edi
lea ecx, [ebp - 0x40]
call fcn.00402d30
push 0x433e48
lea edx, [ebp - 0x40]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004037a0
add esp, 4
cmp dword [eax + 0x14], 7
jbe 0x401aee
mov eax, dword [eax]
lea ecx, [ebp - 0x290]
push ecx
push eax
call esi
mov ecx, dword [ebp - 0x14]
mov esi, eax
cmp ecx, 7
jbe 0x401b34
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401b2a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401c14
push ecx
push edx
call fcn.0040fabb
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp esi, 0xffffffff
jne 0x401b51
mov bl, 1
jmp 0x401bc0
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop word [eax + eax]
lea ecx, [ebp - 0x264]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401b70
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x401b8e
cmp word [ebp - 0x264], 0x2e
jmp 0x401ba5
cmp ecx, 2
jne 0x401bb7
cmp word [ebp - 0x264], 0x2e
jne 0x401bb7
cmp word [ebp - 0x262], 0x2e
jne 0x401bb7
lea eax, [ebp - 0x290]
push eax
push esi
call edi
test eax, eax
jne 0x401b60
jmp 0x401bb9
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x2c]
cmp ecx, 7
jbe 0x401bf6
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401bec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401c19
push ecx
push edx
call fcn.0040fabb
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f784
mov esp, ebp
pop ebp
ret
call fcn.00414b5e
call fcn.00414b5e
int3
Function at 0x404e40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ba25
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0xe], 0
mov ecx, dword [ebp + 0xc]
je 0x404f4f
push ecx
lea ecx, [ebp - 0x30]
call fcn.004031f0
lea edx, [ebp - 0x30]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00401200
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push dword [eax]
call fcn.00404fa0
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov edx, dword [ebp - 0x2c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404ec4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x404ee3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edx, 0xf
mov esi, dword [esi + 8]
cmova eax, ecx
cmp esi, 0xffffffff
jne 0x404efe
xor bl, bl
jmp 0x404f21
push 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push ecx
push dword [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x14]
test eax, eax
mov ecx, dword [ebp - 0x28]
setg bl
cmp edx, 0xf
jbe 0x404f4b
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404f41
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404f96
push edx
push ecx
call fcn.0040fabb
add esp, 8
mov al, bl
jmp 0x404f78
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
jne 0x404f5b
xor al, al
jmp 0x404f78
push 0
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push edx
push dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setg al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f784
mov esp, ebp
pop ebp
ret 8
call fcn.00414b5e
int3

Function at 0x4057e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x438aa4]
cmp ecx, 0xffffffff
jne 0x4057f7
xor al, al
mov esp, ebp
pop ebp
ret 8
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], esi
push 0
lea eax, [ebp - 4]
push eax
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x40583b
cmp eax, 0xea
je 0x40583e
cmp esi, edi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 8
add esi, dword [ebp - 4]
cmp esi, edi
jae 0x40582f
test ebx, ebx
je 0x40582d
mov ecx, dword [0x438aa4]
jmp 0x405802
Function at 0x405d20
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ba5d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x438040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.004031f0
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.00405880
mov ecx, dword [ebp - 0x10]
call fcn.00405930
test al, al
je 0x405d7c
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x405d7c
mov esi, 1
jmp 0x405d7e
xor esi, esi
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x405da0
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4072a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bd90
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, edx
mov esi, ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x4072e8
xor al, al
jmp 0x4073db
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov dword [ebp - 0x228], eax
test eax, eax
js 0x4073f7
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, eax
mov dword [ebp - 0x228], esi
test esi, esi
js 0x40740e
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.00411750
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x407425
mov eax, dword [ebp - 0x224]
push dword [ebp - 0x220]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x21c]
lea edi, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x407390
sub edx, edi
lea eax, [ebp - 0x21c]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.00403530
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x4073d0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4073d0
call dword [sym.imp.ole32.dll_CoUninitialize]
test esi, esi
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040f784
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x22c]
push 0x436a68
push eax
call fcn.004118aa
push 0x436a68
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], esi
push eax
call fcn.004118aa
push 0x436a68
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 0x80004005
push eax
call fcn.004118aa
int3