joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43196c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x431988
cmp dword [esi + 4], 0
je 0x4319b5
test byte [ebx + 0x55], 1
jne 0x4319a7
mov eax, ebx
call fcn.00430578
test eax, eax
jne 0x4319a7
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x431ac5
mov edx, esi
mov eax, ebx
call fcn.00431490
jmp 0x431ac5
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x431abe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004337dc
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0042e294
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0043196c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004337dc
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431ac5
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437ed4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x450178]
cmp byte [eax + 0xc], 0
je 0x438041
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43803a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x451b54], 0
jne 0x437f28
push 0x438048
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x438050
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x451b54], eax
cmp dword [0x44faf8], 0
jne 0x438023
push 0x438060
call sub.kernel32.dll_LoadLibraryA
mov dword [0x44faf8], eax
cmp dword [0x44faf8], 0
je 0x438023
push 0x43806c
mov eax, dword [0x44faf8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x451b58], eax
push 0x43807c
mov eax, dword [0x44faf8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x451b5c], eax
push 0x438090
mov eax, dword [0x44faf8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x451b60], eax
push 0x4380a8
mov eax, dword [0x44faf8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x451b64], eax
push 0x4380c0
mov eax, dword [0x44faf8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x451b68], eax
push 0x4380d4
mov eax, dword [0x44faf8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x451b6c], eax
push 0x4380ec
mov eax, dword [0x44faf8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x451b70], eax
push 0x438104
mov eax, dword [0x44faf8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x451b74], eax
push 0x438120
mov eax, dword [0x44faf8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x451b78], eax
push 0x43812c
mov eax, dword [0x44faf8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x451b7c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438041
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x43becc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404578
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43bf1b
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004047e8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x443630
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x443680]
test si, 4
je 0x443644
or bl, 1
test si, 8
je 0x44364e
or bl, 4
test si, 1
je 0x443658
or bl, 8
test si, 2
je 0x443662
or bl, 0x10
test si, 0x10
je 0x44366c
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44367b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x443684
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4436bc]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44369d
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4436ac
or bl, 4
test esi, 0x20000000
je 0x4436b7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x449d64
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x449d76
add esp, 0xfffffff0
call fcn.00403ac4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a798
mov eax, dword [0x44fe60]
mov dword [eax + 4], ebx
mov dword [eax], 0x44a108
mov eax, dword [0x44fe6c]
mov dword [eax + 4], ebx
mov dword [eax], 0x44a114
mov eax, ebx
call fcn.0044a120
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x412a90]
call fcn.00403788
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x412a90]
call fcn.00403788
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x412a90]
call fcn.00403788
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x412a90]
call fcn.00403788
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x412a90]
call fcn.00403788
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44653c
push eax
push 0
push 0
mov eax, dword [0x44ffa8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41c450]
call fcn.0041d894
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41c450]
call fcn.0041d894
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41c450]
call fcn.0041d894
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044a540
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44a41c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44a41c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44a41c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x449eb3
call fcn.00403b1c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44a200
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44a3ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44a38c
mov dl, 1
mov eax, dword [0x412eac]
call fcn.00403788
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404578
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44a37b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00438234
test al, al
je 0x44a36e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44a3bc
lea eax, [ebp - 0x254]
call fcn.0040a00c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44a36e
xor eax, eax
push ebp
push 0x44a367
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44a3f4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44a350
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004047e8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44a350
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004047e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a36e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44a271
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00416988
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a3b2
lea eax, [ebp - 0x260]
call fcn.00404578
ret

Function at 0x44ace0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x451ba0]
cmp byte [eax + 0xa5], 0
jne 0x44ad51
cmp dword [0x451bb8], 0
jne 0x44ad12
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44ac9c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x451bb8], eax
cmp dword [0x451bb4], 0
jne 0x44ad2d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x451bb4], eax
cmp dword [0x451bbc], 0
jne 0x44ad51
push esp
push 0
push 0
push 0x44ac40
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x451bbc], eax
pop edx
ret
Function at 0x44ae48
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44ae5f
add esp, 0xfffffff0
call fcn.00403ac4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a798
mov eax, dword [0x44ff94]
cmp word [eax + 2], 0
jne 0x44ae87
mov eax, dword [0x44ff94]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044c39c
mov eax, dword [0x450038]
cmp word [eax + 2], 0
jne 0x44aea1
mov eax, dword [0x450038]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044c594
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x412a90]
call fcn.00403788
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x412a90]
call fcn.00403788
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41cc00]
call fcn.00422848
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44b028
mov eax, dword [0x44fec0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00422c18
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44cb34
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x44fec0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d648
test eax, eax
je 0x44af96
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409a00
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d670
test eax, eax
je 0x44afaa
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004047e8
mov eax, dword [0x44fdc8]
cmp byte [eax], 0
jne 0x44afde
mov eax, ebx
call fcn.0044b150
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044cd10
mov eax, ebx
call fcn.0044d6d4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44b01e
call fcn.00403b1c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b3d0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x451ba0]
cmp dword [eax + 0x30], 0
je 0x44b47a
cmp dword [ebx + 0x94], 0
jne 0x44b474
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44b360
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44b474
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44b43a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44b474
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414df8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44b449
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44bfdc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44c011
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404668
jmp 0x44c01e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004045cc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44ceec
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44cf2d
mov eax, esi
call fcn.00433a3c
test al, al
je 0x44cf2d
mov eax, dword [ebx + 0x84]
call fcn.004337dc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44cf2d
push 0
mov eax, dword [ebx + 0x84]
call fcn.004337dc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x44e340
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x451be8], 0
jne 0x44e362
push 0
mov eax, dword [0x451660]
push eax
push 0x44e320
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x451be8], eax
ret
Function at 0x402a30
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42ecd0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402ac4
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402a81
cmp dword [ebp + 0x10], ebx
jne 0x402ab8
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a30
test eax, eax
jne 0x402a93
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a68
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405bed
cmp eax, ebx
je 0x402acb
push ebx
push dword [0x42ecd0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402ac4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42ecd0], ebx
jne 0x402ac1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ac1
jmp 0x402ac4
Function at 0x405161
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x42c098], 0x44
push eax
xor eax, eax
push 0x42c098
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40519c
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405226
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.004054c8
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x40525c
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42eca8], eax
jmp 0x4053e1
mov dword [ebp + 8], ecx
push edi
and dword [ebp + 8], 1
je 0x405277
test eax, eax
je 0x40538c
test cl, 2
je 0x40538c
mov esi, 0x42b098
push ebx
push esi
call fcn.004058f4
cmp dword [ebp + 8], 0
je 0x405296
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x40529c
push ebx
call fcn.0040542e
push 0x409010
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x405382
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405412
cmp byte [eax], 0
je 0x4052ed
cmp byte [ebp - 0x18], 0
je 0x4052ed
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405303
mov al, byte [esi + 1]
test al, al
je 0x405361
cmp al, 0x2e
jne 0x405303
cmp byte [esi + 2], 0
je 0x405361
push esi
push edi
call fcn.004058f4
test byte [ebp - 0x148], 0x10
je 0x405328
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405361
push dword [ebp + 0xc]
push ebx
call fcn.00405226
jmp 0x405361
push ebx
call fcn.004055ac
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405359
test byte [ebp + 0xc], 4
je 0x405351
push ebx
push 0xfffffffffffffff1
call fcn.00404c9f
push 0
push ebx
call fcn.00405642
jmp 0x405361
inc dword [0x42eca8]
jmp 0x405361
push ebx
push 0xfffffffffffffff2
call fcn.00404c9f
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4052cb
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40538c
and byte [edi - 1], 0
xor esi, esi
pop edi
cmp dword [ebp + 8], esi
je 0x4053e1
cmp dword [ebp - 8], esi
jne 0x4053a1
inc dword [0x42eca8]
jmp 0x4053e1
push ebx
call fcn.00405bc6
test eax, eax
je 0x4053e1
push ebx
call fcn.004053e7
push ebx
call fcn.004055ac
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4053d9
test byte [ebp + 0xc], 4
je 0x405399
push ebx
push 0xfffffffffffffff1
call fcn.00404c9f
push esi
push ebx
call fcn.00405642
jmp 0x4053e1
push ebx
push 0xffffffffffffffe5
call fcn.00404c9f
pop esi
pop ebx
leave
ret 8
Function at 0x4054c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42b498
push esi
call fcn.004058f4
push esi
call fcn.0040547b
mov edi, eax
test edi, edi
jne 0x4054e9
xor eax, eax
jmp 0x40553b
push edi
call fcn.00405b2d
test byte [0x42ec34], 0x80
je 0x405502
mov al, byte [edi]
test al, al
je 0x4054e5
cmp al, 0x5c
je 0x4054e5
sub edi, esi
jmp 0x40551a
call fcn.00405bc6
test eax, eax
je 0x405514
test byte [eax], 0x10
je 0x4054e5
push esi
call fcn.0040542e
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405506
call fcn.004053e7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4055ac
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4055c8
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x4055cb
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4055fa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40563e
test edi, edi
jne 0x405605
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405638
Function at 0x405642
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405bed
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405666
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x40579f
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x42c220], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x42c220
je 0x4056aa
push 1
push 0
push esi
call fcn.004055cb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x4057a5
cmp eax, edi
jg 0x4057a5
mov esi, 0x42bc98
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x4057a5
cmp eax, edi
jg 0x4057a5
push esi
push ebp
push str._s_s_r_n
push 0x42b898
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x42ec2c]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405916
push 4
push 0xc0000000
push esi
call fcn.004055cb
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x40579f
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405798
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405798
cmp edi, dword [esp + 0x18]
jne 0x405798
push str._Rename__r_n
push esi
call fcn.00405540
test eax, eax
jne 0x4057ac
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.004058f4
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x42b898
push eax
call fcn.0040558c
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x42ecb0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x4093a0
push eax
call fcn.00405540
test eax, eax
je 0x405763
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x4057d3
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x4057c8
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405765