joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4147cb
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x4147eb
xor al, al
jmp 0x41497e
push ebx
push edi
push esi
call fcn.00448308
pop ecx
push eax
push esi
push 0
push dword [ebp + 8]
mov dword [ebp - 4], eax
call sub.VERSION.dll_GetFileVersionInfoA
mov ebx, dword [ebp + 0x10]
push ebx
call fcn.00448680
add eax, 0x1a
push eax
call fcn.00448308
mov esi, 0x45abf8
mov edi, eax
push esi
push edi
call fcn.00448210
push esi
push ebx
call fcn.00448480
add esp, 0x18
test eax, eax
je 0x4148b5
push str.StringFileInfo_
push edi
call fcn.00448220
push esi
push ebx
call fcn.004487f0
add esp, 0x10
test eax, eax
jne 0x4148ac
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41488c
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
push ebx
push 4
lea edx, [edi + 0x10]
pop ecx
call fcn.00415fdc
shr ebx, 0x10
lea edx, [edi + 0x14]
push ebx
call fcn.00415fdc
mov ebx, dword [ebp + 0x10]
add esp, 8
jmp 0x414899
push str.04090000
push edi
call fcn.00448220
pop ecx
pop ecx
push esi
push edi
call fcn.00448220
push ebx
push edi
call fcn.00448220
add esp, 0x10
jmp 0x4148b5
push ebx
push edi
call fcn.00448220
pop ecx
pop ecx
push str.DefaultLangCodepage
push ebx
call fcn.0044819b
test eax, eax
pop ecx
pop ecx
jne 0x4148f1
mov esi, dword [ebp + 0xc]
push 8
lea eax, [edi + 0x10]
push eax
push esi
call fcn.00448a50
push dword [ebp - 4]
mov byte [esi + 8], 0
call fcn.00448196
push edi
call fcn.00448196
add esp, 0x14
mov al, 1
jmp 0x41497c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41496a
push esi
push ebx
call fcn.00448480
test eax, eax
pop ecx
pop ecx
jne 0x414945
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov esi, ecx
mov edx, 0xffff
and esi, edx
push esi
shr ecx, 0x10
push ecx
mov ecx, eax
and ecx, edx
push ecx
shr eax, 0x10
push eax
push str._u._u._u._u
push dword [ebp + 0xc]
call fcn.0044870b
add esp, 0x18
jmp 0x414958
push 0x200
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.00448a50
add esp, 0xc
push dword [ebp - 4]
call fcn.00448196
push edi
call fcn.00448196
mov al, 1
jmp 0x41497a
push dword [ebp - 4]
call fcn.00448196
push edi
call fcn.00448196
xor al, al
pop ecx
pop ecx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x414996
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4149d3
lea eax, [ebp - 0x140]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x4149c6
or eax, eax
leave
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x140]
leave
ret
Function at 0x4149d5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4149eb
test al, 0x10
je 0x4149eb
mov al, 1
ret
xor al, al
ret

Function at 0x414b81
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push dword [ebp + 8]
lea eax, [ebp - 0x10c]
mov byte [ebp - 1], 0
call fcn.004149ee
lea eax, [ebp - 0x10c]
push eax
call fcn.004149d5
test al, al
pop ecx
pop ecx
je 0x414bc1
lea eax, [ebp - 0x10c]
push str..
push eax
call fcn.00448220
pop ecx
pop ecx
push ebx
push esi
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x564]
push eax
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00448f75
add esp, 0x14
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov bl, 1
je 0x414c84
cmp bl, 1
jne 0x414c84
test byte [ebp - 0x24c], 0x10
jne 0x414c6a
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x10c]
push eax
mov byte [ebp - 1], bl
call fcn.00448210
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00448220
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00448220
add esp, 0x18
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
jne 0x414c80
lea eax, [ebp - 0x24c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x414c0b
xor bl, bl
jmp 0x414c0b
xor bl, bl
jmp 0x414c87
mov bl, byte [ebp - 1]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x414c94
Capabilities:
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x988
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x320]
mov byte [ebp - 2], 0
call fcn.004149ee
push dword [ebp + 0xc]
lea eax, [ebp - 0x428]
call fcn.004149ee
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x320]
push eax
call fcn.00414ade
mov byte [ebp - 3], al
lea eax, [ebp - 0x320]
push eax
call fcn.004149d5
add esp, 0x14
test al, al
mov esi, str..
je 0x414cfd
lea eax, [ebp - 0x320]
push esi
push eax
call fcn.00448220
pop ecx
pop ecx
lea eax, [ebp - 0x428]
push eax
call fcn.004149d5
test al, al
pop ecx
je 0x414d1d
lea eax, [ebp - 0x428]
push esi
push eax
call fcn.00448220
pop ecx
pop ecx
lea eax, [ebp - 0x988]
push eax
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x778]
push eax
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x320]
push eax
call fcn.00448f75
add esp, 0x14
lea eax, [ebp - 0x568]
push eax
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
mov byte [ebp - 1], 1
je 0x414e96
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp byte [ebp - 1], 1
jne 0x414e96
test byte [ebp - 0x568], 0x10
mov byte [ebp - 2], 1
jne 0x414e49
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x988]
push eax
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x53c]
push eax
lea esi, [ebp - 0x218]
call fcn.00414ea9
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00448210
lea eax, [ebp - 0x778]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00448220
lea eax, [ebp - 0x53c]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00448220
mov eax, esi
push eax
call fcn.00414981
add esp, 0x2c
test al, al
je 0x414e25
cmp byte [ebp + 0x10], 0
je 0x414e92
mov eax, esi
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, esi
push eax
je 0x414e38
call ebx
cmp byte [ebp + 0x14], 1
lea eax, [ebp - 0x218]
jne 0x414e84
cmp byte [ebp - 3], 0
jne 0x414e69
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x414e92
lea eax, [ebp - 0x568]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x414d78
mov byte [ebp - 1], al
jmp 0x414d78
push 0
push eax
lea eax, [ebp - 0x110]
push eax
call edi
test eax, eax
je 0x414e92
lea eax, [ebp - 0x110]
push eax
call ebx
jmp 0x414e45
push 0
push eax
lea eax, [ebp - 0x110]
push eax
call edi
jmp 0x414e45
xor bl, bl
jmp 0x414e99
mov bl, byte [ebp - 2]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x41509f
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call fcn.00448680
dec eax
add eax, esi
cmp byte [eax], 0x5c
pop ecx
jne 0x4150b8
mov byte [eax], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x415130
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jne 0x4150e0
push 0
push esi
call ebp
test eax, eax
je 0x4150e5
jmp 0x415134
cmp eax, 3
jne 0x415103
push esi
call fcn.00415b45
mov edi, eax
push 0x5c
push edi
call fcn.0044a2e0
add esp, 0xc
test eax, eax
jne 0x415109
push edi
call fcn.00448196
pop ecx
xor al, al
pop edi
pop esi
pop ebp
ret
push ebx
push edi
mov byte [eax], 0
call fcn.0041509f
push edi
mov bl, al
call fcn.00448196
pop ecx
pop ecx
test bl, bl
je 0x41512b
push 0
push esi
call ebp
test eax, eax
setne bl
mov al, bl
pop ebx
jmp 0x415105
test al, 0x10
je 0x415103
mov al, 1
jmp 0x415105

Function at 0x415138
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push dword [ebp + 8]
lea eax, [ebp - 0x230]
call fcn.004149ee
push dword [ebp + 0xc]
lea eax, [ebp - 0x128]
call fcn.004149ee
pop ecx
pop ecx
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4151b1
cmp byte [ebp + 0x10], al
je 0x4151ad
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00448480
test eax, eax
pop ecx
pop ecx
je 0x4151a9
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov al, 1
leave
ret
xor al, al
leave
ret
lea eax, [ebp - 0x230]
push eax
call fcn.004149d5
test al, al
pop ecx
je 0x4151ad
lea eax, [ebp - 0x128]
push ebx
push eax
call fcn.004149d5
xor ebx, ebx
test al, al
pop ecx
je 0x4151e2
cmp byte [ebp + 0x10], bl
jne 0x415204
xor al, al
jmp 0x415279
lea eax, [ebp - 0x128]
push eax
call fcn.0041509f
test al, al
pop ecx
je 0x4151db
lea eax, [ebp - 0x128]
push eax
call fcn.004149d5
pop ecx
test al, al
jmp 0x4151d9
lea eax, [ebp - 0x230]
push str..
push eax
call fcn.00448220
lea eax, [ebp - 0x230]
push eax
call fcn.00448680
mov byte [ebp + eax - 0x22f], bl
lea eax, [ebp - 0x128]
push eax
call fcn.00448680
mov byte [ebp + eax - 0x127], bl
lea eax, [ebp - 0x230]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x14], eax
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 2
mov word [ebp - 0x10], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb al, al
inc al
pop ebx
leave
ret
Function at 0x41527c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push dword [ebp + 8]
lea eax, [ebp - 0x128]
call fcn.004149ee
push dword [ebp + 0xc]
lea eax, [ebp - 0x230]
call fcn.004149ee
lea eax, [ebp - 0x128]
push eax
call fcn.004149d5
add esp, 0xc
test al, al
jne 0x4152b6
leave
ret
lea eax, [ebp - 0x230]
push ebx
push eax
call fcn.004149d5
xor ebx, ebx
test al, al
pop ecx
je 0x415325
cmp byte [ebp + 0x10], bl
jne 0x4152d6
xor al, al
jmp 0x4153d5
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x415325
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.00448480
test eax, eax
pop ecx
pop ecx
je 0x415325
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne al
jmp 0x4153d5
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.00414ade
test al, al
pop ecx
pop ecx
je 0x415372
push 1
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.00415138
add esp, 0xc
test al, al
je 0x4152cf
lea eax, [ebp - 0x128]
push 1
push eax
call fcn.004153d8
pop ecx
pop ecx
test al, al
jmp 0x41531d
lea eax, [ebp - 0x128]
push eax
call fcn.00448680
mov byte [ebp + eax - 0x127], bl
lea eax, [ebp - 0x230]
push eax
call fcn.00448680
mov byte [ebp + eax - 0x22f], bl
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
pop ecx
lea eax, [ebp - 0x230]
mov dword [ebp - 0x14], eax
pop ecx
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x10], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb al, al
inc al
pop ebx
leave
ret

Function at 0x4153d8
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push dword [ebp + 8]
lea eax, [ebp - 0x128]
call fcn.004149ee
lea eax, [ebp - 0x128]
push eax
call fcn.004149d5
test al, al
pop ecx
pop ecx
jne 0x415403
leave
ret
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
lea eax, [ebp - 0x128]
push eax
jne 0x41541f
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne al
jmp 0x415461
call fcn.00448680
mov byte [ebp + eax - 0x127], bl
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
pop ecx
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 3
mov word [ebp - 0x10], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb al, al
inc al
pop ebx
leave
ret
Function at 0x415543
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
lea eax, [ebp - 0x294]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x4155cd
push 0x100
lea eax, [ebp - 0x104]
push eax
call sub.WSOCK32.dll_gethostname
lea eax, [ebp - 0x104]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x4155cd
mov eax, dword [eax + 0xc]
xor edx, edx
cmp dword [eax], edx
je 0x415596
mov ecx, eax
add ecx, 4
inc edx
cmp dword [ecx], 0
jne 0x41558d
cmp esi, edx
jle 0x4155a1
push str.0.0.0.0
jmp 0x4155bc
push 4
push dword [eax + esi*4 - 4]
lea eax, [ebp - 4]
push eax
call fcn.004492f0
add esp, 0xc
push dword [ebp - 4]
call sub.WSOCK32.dll_inet_ntoa
push eax
push dword [ebp + 8]
call fcn.00448210
pop ecx
pop ecx
call sub.WSOCK32.dll_WSACleanup
leave
ret
push 0x45a5cc
push dword [ebp + 8]
call fcn.00448210
pop ecx
pop ecx
leave
ret

Function at 0x415745
Capabilities:
Enumerate gui resources
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp byte [0x46d9cc], 0
push ebx
push esi
mov ebx, eax
je 0x4157ae
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4157aa
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4157b0
xor eax, eax
jmp 0x4157f0
xor esi, esi
cmp byte [0x46d9cd], 0
je 0x4157cd
test bl, 4
je 0x4157cd
push esi
push 0x4157f4
xor ebx, 4
call dword [sym.imp.USER32.dll_EnumWindows]
cmp ebx, 0x20
je 0x4157e1
cmp ebx, 0x40
je 0x4157e1
push esi
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x4157f0
xor eax, eax
cmp ebx, 0x20
sete al
push esi
push eax
call sub.KERNEL32.dll_SetSystemPowerState
pop esi
pop ebx
leave
ret

Function at 0x41582e
Capabilities:
Log keystrokes

Disassembly:
cmp byte [esp + 8], 1
jne 0x41584d
push 0x1388
push dword [esp + 8]
call fcn.0041580b
test al, al
pop ecx
pop ecx
jne 0x415869
push 1
jmp 0x41584f
push 0
push 0
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
ret
Function at 0x415ab0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
test edi, edi
push esi
jl 0x415b42
jne 0x415ac5
push 0
jmp 0x415b3c
mov al, byte [0x46d9cd]
neg al
sbb eax, eax
and eax, 0x28
add eax, 0xf
cmp edi, eax
jae 0x415b3b
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x415b3b
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
call esi
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
sbb ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
fild qword [ebp - 0x18]
fstp qword [ebp - 0x28]
fild qword [ebp - 0x20]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x28]
fdiv qword [ebp - 0x30]
fmul qword [0x45ddd0]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
call fcn.00455ea0
cmp eax, edi
jb 0x415af2
jmp 0x415b42
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
leave
ret

Function at 0x4228ce
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push edi
lea eax, [ebp - 0x140]
push eax
push dword [ebp + 8]
mov ebx, ecx
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x42294e
lea eax, [ebp - 0x114]
push 0x45b204
push eax
call fcn.00448480
test eax, eax
pop ecx
pop ecx
je 0x42293c
lea eax, [ebp - 0x114]
push 0x45ca40
push eax
call fcn.00448480
test eax, eax
pop ecx
pop ecx
je 0x42293c
push dword [ebp + 0x10]
lea eax, [ebp - 0x114]
push dword [ebp + 0xc]
push eax
call fcn.00414757
add esp, 0xc
test al, al
je 0x422962
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4228f5
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp + 0x14], 0
jne 0x422969
mov al, 1
jmp 0x4229ff
xor bl, bl
jmp 0x4229f6
lea eax, [ebp - 0x140]
push eax
push 0x45ca44
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x4229f4
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test byte [ebp - 0x140], 0x10
je 0x4229e2
lea eax, [ebp - 0x114]
push 0x45b204
push eax
call fcn.00448480
test eax, eax
pop ecx
pop ecx
je 0x4229e2
lea eax, [ebp - 0x114]
push 0x45ca40
push eax
call fcn.00448480
test eax, eax
pop ecx
pop ecx
je 0x4229e2
lea eax, [ebp - 0x114]
push eax
call esi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004228ce
test al, al
je 0x422962
push 0x45ca40
call esi
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x422984
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x424044
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x518
push esi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x518]
push eax
mov esi, 0x104
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x4241bc
push ebx
push edi
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x108]
push str.___s
push eax
call fcn.0044870b
lea eax, [ebp - 0x108]
lea edi, [ebp - 0x108]
push eax
dec edi
call fcn.00448680
add esp, 0x10
xor ebx, ebx
cmp byte [eax + edi], 0x5c
jne 0x4240d3
lea eax, [ebp - 0x108]
push eax
call fcn.00448680
pop ecx
lea ecx, [ebp - 0x108]
dec ecx
dec ecx
cmp byte [eax + ecx], 0x3a
je 0x4240d3
lea eax, [ebp - 0x108]
push eax
call fcn.00448680
pop ecx
mov byte [eax + edi], bl
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4240ea
cmp byte [ebp + 0x10], bl
je 0x4241ad
push ebx
push 0x2200000
push 3
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4241a4
push 0x14
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00448970
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x414], 0xa0000003
call fcn.00448680
shl eax, 1
mov word [ebp - 0x40a], ax
mov eax, dword [ebp - 0x40a]
add esp, 0x10
add eax, 2
push esi
mov word [ebp - 0x408], ax
lea eax, [ebp - 0x404]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x40a]
push ebx
add eax, 0xc
mov word [ebp - 0x410], ax
lea ecx, [ebp - 4]
push ecx
push ebx
movzx eax, ax
push ebx
add eax, 8
push eax
lea eax, [ebp - 0x414]
push eax
push 0x900a4
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
push edi
jne 0x4241b1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
jmp 0x4241ba
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x424e06
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x148
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [ebp - 0xe0]
push eax
push dword [ebp + 0x70]
mov dword [ebp + 0x60], ecx
call esi
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp + 0x64], ebx
jne 0x424e39
xor al, al
jmp 0x424f56
push edi
lea eax, [ebp - 0xb4]
push 0x45b204
push eax
call fcn.00448480
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
pop ecx
pop ecx
je 0x424e97
lea eax, [ebp - 0xb4]
push 0x45ca40
push eax
call fcn.00448480
test eax, eax
pop ecx
pop ecx
je 0x424e97
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or eax, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x78]
not ecx
and eax, ecx
push eax
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x424eb9
lea eax, [ebp - 0xe0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x424e3a
push ebx
call edi
cmp byte [ebp + 0x7c], 0
jne 0x424ec0
mov al, 1
jmp 0x424f55
xor bl, bl
jmp 0x424f4e
lea eax, [ebp - 0xe0]
push eax
push 0x45ca44
call esi
cmp eax, 0xffffffff
mov dword [ebp + 0x64], eax
je 0x424f4c
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test byte [ebp - 0xe0], 0x10
je 0x424f38
lea eax, [ebp - 0xb4]
push 0x45b204
push eax
call fcn.00448480
test eax, eax
pop ecx
pop ecx
je 0x424f38
mov ebx, 0x45ca40
lea eax, [ebp - 0xb4]
push ebx
push eax
call fcn.00448480
test eax, eax
pop ecx
pop ecx
je 0x424f38
lea eax, [ebp - 0xb4]
push eax
call esi
push dword [ebp + 0x7c]
mov ecx, dword [ebp + 0x60]
push dword [ebp + 0x78]
push dword [ebp + 0x74]
push dword [ebp + 0x70]
call fcn.00424e06
test al, al
je 0x424eb9
push ebx
call esi
lea eax, [ebp - 0xe0]
push eax
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x424edc
mov bl, 1
push dword [ebp + 0x64]
call edi
mov al, bl
pop edi
pop esi
pop ebx
add ebp, 0x68
leave
ret 0x10