joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cc7b1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4cc7e9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004ca82c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004ca804
jmp 0x4cc7f5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4cdfa8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4cdfea
call fcn.004d41dc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4cdfea
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4cdfe1
xor eax, eax
jmp 0x4cdff2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004cdff8
pop edi
pop esi
pop ebx
ret 4

Function at 0x4d470c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d473a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d4758
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d4672
jmp 0x4d4758
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d4758
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d4672
test edi, edi
mov eax, edi
jne 0x4d4742
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7a64156d
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2c4441aa
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x35831ea6
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..data_1
nop
nop
mov ebx, 0x42f314
mov ecx, 0x94b7fa3
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x52d090
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd6000]
push edi
jmp 0x52d0aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52d0b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d0a0
mov eax, 1
add ebx, ebx
jne 0x52d0c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52d0d4
jne 0x52d0f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d0f3
dec eax
add ebx, ebx
jne 0x52d0e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x52d0b8
add ebx, ebx
jne 0x52d0ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52d145
xor ecx, ecx
sub eax, 3
jb 0x52d10b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52d17a
sar eax, 1
mov ebp, eax
jmp 0x52d116
add ebx, ebx
jne 0x52d116
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d0e4
inc ecx
add ebx, ebx
jne 0x52d124
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d0e4
add ebx, ebx
jne 0x52d131
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52d126
jne 0x52d142
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52d126
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52d164
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52d156
jmp 0x52d0a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52d164
add edi, ecx
jmp 0x52d0a6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52d182
cmp byte [edi], 0x11
jne 0x52d182
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52d187
lea edi, [esi + 0x126000]
mov eax, dword [edi]
or eax, eax
je 0x52d1ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18146c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1815e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52d1b4
mov ecx, edi
jns 0x52d1e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1815ec]
or eax, eax
je 0x52d1f9
mov dword [ebx], eax
add ebx, 4
jmp 0x52d1d1
call dword [esi + 0x1815fc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x52d230
cmp al, 0xef
ja 0x52d223
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x52d205
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x52d212
mov ebp, dword [esi + 0x1815f0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52d264
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x1012e753
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x118c40
jmp 0x1012e7d5
push 0xa7b405ae
into
pop ecx
mov eax, 0x48f6650
and al, 0x60
sbb ch, al
pop eax
add byte [eax], al
add byte [edi + ebx - 0x6be61571], dl
loop 0x1012e765
out 0x81, al
jo 0x1012e6c8
in eax, dx
cld
iretd
push cx
xchg dword [esp + 0xc], esi
lea esi, [esi + 0x17]
call fcn.1012e72a
push word [esp + 4]
ja 0x1012e7a5
jbe 0x1012e788
clc
outsd dx, dword [esi]
call [edx - 0x7fe93997]
push ss
jno 0x1012e6e7
mov ebp, 0x2244c88
call 0x1012e753
pushal
lea esp, [esp + 2]
jmp 0x1012e7b5
pop dword [esp]
mov byte [esp + 4], dh
push dword [esp + 4]
jmp 0x1012e772
pop dword [esp]
mov byte [esp + 4], dh
push dword [esp + 4]
pushal
lea esp, [esp + 2]
mov dword [esp + 0x68], edi
lea esp, [esp + 0x68]
jmp 0x1012e7fa
mov edi, dword [esp + 0x2c]
neg al
jo 0x1012e7df
rdtsc
jmp 0x1012e82f
rdtsc
rdtsc
bswap eax
rdtsc
jmp 0x1012e7bf
rdtsc
mov bp, dx
add ah, ch
jmp 0x1012e816
pushfd
jmp 0x1012d7b1
btc ax, si
jmp 0x1012e862
lea ebp, [esp]
shl bh, cl
jp 0x1012e800
btc ax, si
shl bx, cl
clc
jmp 0x1012e866
mov bp, dx
add ah, ch
jmp 0x1012e816
mov esi, esp
mov ebx, 0xa4e06785
sub esp, 0x1c
jmp 0x1012e884
lea ebx, [ebx*4]
lea ebx, [eax + esi]
mov edx, edi
call fcn.1012e8d2
sub al, 0xb7
daa
inc edx
mov cl, 1
sub al, byte [ebp - 0xc]
out 0xe, eax
shl bx, cl
clc
sub esp, 0xc0
jmp 0x1012e836
jae 0x1012e846
lea ebx, [ebx*4]
lea ebx, [eax + esi]
jmp 0x1012e850

Function at 0x101380d3
Capabilities:
Encode data using xor

Disassembly:
popal
call fcn.10137d17
jmp 0x1011bf66
pushal
mov edi, 0x79e36dd9
jmp 0x10137de0

Function at 0x1015a932
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 2]
lea esp, [esp + 8]
cmp ecx, 0x34
jmp 0x10119bd7

Function at 0x1034dcbe
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec esi
mov eax, 0xd0716e9c
std
btc edi, edi
lea esp, [esp + 4]
jmp 0x1034dca1
mov dl, 0xf6
setp cl
pushfd
mov ch, 0x4c
pop edi
mov ch, 0x9e
jmp 0x1034dc7e
xchg byte [esp + 1], ah
mov byte [esp + 2], ch
shl esi, 3
rdtsc
mov eax, 0xcf0ee690
dec ebp
jmp 0x1034dd5e
xchg word [esp + 3], si
xchg bx, dx
pop ebx
setb ah
mov bl, 0xf0
jmp 0x1034dc94
shr ah, cl
rdtsc
bsf bp, di
add esp, 0
rcr si, cl
call fcn.1034dd2c
pop word [esp + 6]
mov di, sp
mov di, bp
std
jmp 0x1034ddb4
bswap ebp
setne ch
rcr bp, cl
pushal
btr si, bx
pop ecx
jmp 0x1034ddfb
pop word [esp + 1]
pop word [esp + 4]
add esp, 0xa
sbb bh, bl
mov ah, 0x2f
push word [esp]
jmp 0x1034dd9e
pop ebx
push dword [esp + 2]
dec edx
mov dh, ch
mov edi, 0x55997873
jmp 0x1034de59
sub esp, 0xc
push word [esp + 0x19]
inc dh
xchg byte [esp], cl
neg cx
lea ecx, [edx + edi]
jmp 0x1034dde5
cpuid
or di, bx
cld
call fcn.1034de1e
mov di, 0x774a
rdtsc
mov ax, word [esp + 0x1e]
xchg byte [esp + 0x18], dl
neg al
pop bp
jmp 0x1034de34
Function at 0x1034dd2c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg esi, ebx
lea esp, [esp]
not eax
xchg dword [esp], edi
lea ecx, [edx + ebx]
sets dh
jmp 0x1034dd09
pop word [esp + 1]
rdtsc
mov eax, edx
not cl
mov eax, dword [esp + 2]
neg ch
jmp 0x1034dd33
rdtsc
not dl
mov eax, 0x428ac88f
xchg ecx, edi
pop di
bsf eax, edx
jmp 0x1034dcce
bt esi, edi
bsr dx, dx
mov bh, 0xa6
mov di, word [esp]
add bp, 0x18
mov ch, cl
jmp 0x1034dce0
mov ebp, 0xb5991ea5
jmp 0x1034dcf7
bsf edi, ebp
pop si
mov ebx, 0x4041eb
xchg dl, bh
btr eax, esi
mov bl, ah
jmp 0x1034ddd1
push ebx
mov ax, word [esp + 0xf]
xchg word [esp + 0xf], si
mov eax, dword [esp]
mov bl, byte [esp + 0xa]
setno dh
jmp 0x1034dd71
xchg word [esp], di
xchg byte [esp + 1], bh
xchg ecx, esi
sub esp, 0x13
pop dword [esp + 8]
pop ebp
jmp 0x1034dd87

Function at 0x1034e0bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x19
mov ebp, 0xcdf90a82
mov ch, bh
mov dword [esp + 4], ecx
jmp 0x1034e0f3
mov edx, dword [esp + 9]
lea edx, [ecx + ebx]
push word [esp + 1]
mov si, 0x32bf
xchg dword [esp + 4], ecx
xchg dword [esp + 0x1b], eax
jmp 0x1034e0dd
Function at 0x1034e5dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, eax
xchg dword [esp], ebp
xchg di, bp
jmp 0x1034e5ea
lea ebp, [ebx*4]
mov si, 0x8234
pop di
cpuid
mov dh, byte [esp + 0xd]
rdtsc
jmp 0x1034e637
mov esi, dword [esp + 0xf]
mov ah, ch
pop dword [esp]
bt bp, bx
mov bl, cl
push word [esp]
rdtsc
push word [esp + 9]
pop eax
xchg dword [esp + 0xc], esi
mov cl, bl
jmp 0x1034e61e

Function at 0x1034e695
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 7], ebp
xchg dword [esp + 0x17], esi
mov dh, 0x82
mov bp, 0x891e
jmp 0x1034e6a0
bt ecx, edi
cpuid
push dword [esp + 8]
jmp 0x1034e67f
mov dword [esp + 0x15], edx
rdtsc
mov ecx, dword [esp + 0x1c]
Function at 0x401040
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4e06b8]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x401060
xor al, al
jmp 0x40118b
mov byte [ebp - 1], 1
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x401188
mov dword [ebp - 0x240], 0
push 0x228
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.00487e90
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x4010c1
xor al, al
jmp 0x40118b
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x40116f
mov edx, dword [ebp - 0x238]
push edx
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x40116f
push 0
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne cl
mov byte [ebp - 1], cl
mov dword [ebp - 0x248], 0
push 0x64
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401162
mov eax, dword [ebp - 0x248]
add eax, 1
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xa
jg 0x401162
push 0
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne dl
mov byte [ebp - 1], dl
jmp 0x40111e
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4010c1
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00482469
mov esp, ebp
pop ebp
ret

Function at 0x401320
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 1
push 0
mov ecx, dword [ebp + 8]
call fcn.00404260
push eax
mov ecx, dword [ebp + 8]
call fcn.00404260
push eax
push 0x4c5d04
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
ja 0x401372
push 1
push 0
mov ecx, dword [ebp + 8]
call fcn.00404260
push eax
push str.IEXPLORE.EXE
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], eax
mov eax, 0x20
cmp eax, dword [ebp - 4]
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret
Function at 0x402e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4e06b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x33
mov byte [ebp - 0x10], 0x34
mov byte [ebp - 0xf], 0x35
mov byte [ebp - 0xe], 0x36
mov byte [ebp - 0xd], 0x37
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 0x39
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x62
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x66
movzx eax, byte [ebp + 8]
movzx cx, byte [ebp + eax - 0x14]
mov word [ebp - 0x18], cx
mov ax, word [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00482469
mov esp, ebp
pop ebp
ret

Function at 0x404d30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8edb
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x4e06b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x23c], 0
lea ecx, [ebp - 0x238]
call fcn.004025b0
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.00487e90
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x404dbe
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x238]
call fcn.004026c0
lea ecx, [ebp - 0x238]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004025e0
mov edx, dword [ebp - 0x23c]
or edx, 1
mov dword [ebp - 0x23c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.00404310
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00482469
mov esp, ebp
pop ebp
ret

Function at 0x404ff0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9c68
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4e06b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x238], 0
lea ecx, [ebp - 0x2c]
call fcn.004025b0
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x234], ax
push 0x206
push 0
lea ecx, [ebp - 0x232]
push ecx
call fcn.00487e90
add esp, 0xc
push 0
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x234]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40507b
lea ecx, [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.004026c0
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004025e0
mov eax, dword [ebp - 0x238]
or eax, 1
mov dword [ebp - 0x238], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404310
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00482469
mov esp, ebp
pop ebp
ret
Function at 0x4050d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
pop ebp
ret

Function at 0x4050f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40511a
mov ecx, dword [ebp - 4]
and ecx, 0x10
jne 0x40511a
mov dword [ebp - 8], 1
jmp 0x405121
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x405400
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa581
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x4e06b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call fcn.00404260
push eax
call fcn.004050d0
add esp, 4
movzx eax, al
test eax, eax
jne 0x40544a
mov al, 1
jmp 0x40564f
mov dword [ebp - 0x284], 0
push 0x24c
push 0
lea ecx, [ebp - 0x280]
push ecx
call fcn.00487e90
add esp, 0xc
push 0x4c5180
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00402ea0
add esp, 0xc
mov dword [ebp - 0x2dc], eax
lea ecx, [ebp - 0x284]
push ecx
mov ecx, dword [ebp - 0x2dc]
call fcn.00404260
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x2c]
call fcn.00404310
cmp dword [ebp - 0x30], 0xffffffff
jne 0x4054c5
mov ecx, dword [ebp + 8]
call fcn.00404260
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor al, al
jmp 0x40564f
lea edx, [ebp - 0x258]
push edx
lea ecx, [ebp - 0x2bc]
call fcn.00404bb0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2bc]
push eax
push 0x4c5188
call fcn.00407080
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x405514
lea edx, [ebp - 0x2bc]
push edx
push 0x4c518c
call fcn.00407080
add esp, 8
movzx eax, al
test eax, eax
je 0x40552b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2bc]
call fcn.00404310
jmp 0x405602
push 0x4c5194
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x2a0]
push edx
call fcn.00402ea0
add esp, 0xc
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2bc]
push eax
lea ecx, [ebp - 0x2a0]
call fcn.004026e0
mov ecx, dword [ebp - 0x284]
and ecx, 1
je 0x40557b
push 0x80
lea ecx, [ebp - 0x2a0]
call fcn.00404260
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp - 0x284]
and edx, 0x10
je 0x405597
lea eax, [ebp - 0x2a0]
push eax
call fcn.00405400
add esp, 4
jmp 0x4055e1
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x2d8]
call fcn.00404280
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2d8]
call fcn.00404260
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x2d8]
push edx
lea eax, [ebp - 0x2a0]
push eax
call fcn.00406b40
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2d8]
call fcn.00404310
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2a0]
call fcn.00404310
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2bc]
call fcn.00404310
lea ecx, [ebp - 0x284]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4054c5
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
call fcn.00404260
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp + 8]
call fcn.00404260
push eax
call fcn.004050d0
add esp, 4
movzx eax, al
neg eax
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00482469
mov esp, ebp
pop ebp
ret
Function at 0x406690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9adb
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x4e06b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x480], 0
xor eax, eax
mov word [ebp - 0x254], ax
push 0x206
push 0
lea ecx, [ebp - 0x252]
push ecx
call fcn.00487e90
add esp, 0xc
push 0x104
lea edx, [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x48]
call fcn.00404bb0
mov dword [ebp - 4], 0
push 1
push 0
lea ecx, [ebp - 0x270]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00402840
mov byte [ebp - 4], 1
xor edx, edx
mov word [ebp - 0x47c], dx
push 0x206
push 0
lea eax, [ebp - 0x47a]
push eax
call fcn.00487e90
add esp, 0xfffffff0
mov ecx, 7
lea esi, [ebp - 0x270]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push 0x4c5a40
lea ecx, [ebp - 0x47c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
lea edx, [ebp - 0x47c]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00404bb0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004025e0
mov ecx, dword [ebp - 0x480]
or ecx, 1
mov dword [ebp - 0x480], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00404310
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x270]
call fcn.00404310
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00404310
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00482469
mov esp, ebp
pop ebp
ret