joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fefdc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4ff296
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x505e6c]
mov eax, dword [eax]
mov edx, 0x4ff2b0
call fcn.0047bf28
push 5
mov eax, dword [0x505e6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x4ff25d
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.004e2790
lea eax, [ebp - 0x10]
call fcn.0047f740
mov eax, dword [ebp - 0x10]
call fcn.0040dd04
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0047f29c
mov edx, dword [ebp - 0x14]
mov eax, 0x50d16c
call fcn.00406448
call fcn.004fd368
lea ecx, [ebp - 0x18]
mov edx, 0x4ff2d0
mov eax, dword [0x50d16c]
call fcn.0047e380
mov edx, dword [ebp - 0x18]
mov eax, 0x50d170
call fcn.00406448
lea ecx, [ebp - 0x1c]
mov edx, 0x4ff2e8
mov eax, dword [0x50d16c]
call fcn.0047e380
mov edx, dword [ebp - 0x1c]
mov eax, 0x50d174
call fcn.00406448
push 2
push 0
push 1
mov ecx, dword [0x50d16c]
mov dl, 1
mov eax, dword [0x4aa728]
call fcn.004aaa68
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ff134
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.004aaa28
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.004aaa00
cmp dword [ebp - 0xc], 0x67734d49
je 0x4ff10f
mov cl, 1
xor edx, edx
mov eax, dword [0x50d174]
call fcn.004abcec
jmp 0x4ff11e
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x50d16c]
call fcn.004abcec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff13b
mov eax, dword [ebp - 4]
call fcn.00404098
ret
Function at 0x4ff440
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ff583
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x4ff59c
mov edx, ebx
call fcn.00406914
mov eax, dword [ebp - 0x25c]
call fcn.004064d4
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4ff55d
xor eax, eax
push ebp
push 0x4ff556
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4ff5b8
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.0040df84
test eax, eax
jne 0x4ff527
test byte [ebp - 0x258], 0x10
jne 0x4ff527
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00406640
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406914
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x4ff519
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4ff4b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff55d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff58a
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.00406440
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x4ff5c4
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ff6c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00406448
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0047e824
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x4ff6e0
call fcn.0040e258
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406914
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x4ff664
test esi, 0x10
jne 0x4ff694
test esi, 1
je 0x4ff664
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004064d4
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x4ff68e
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00406448
jmp 0x4ff6a1
inc edi
cmp edi, 0xa
je 0x4ff6a1
inc ebx
cmp ebx, 0x3e8
jne 0x4ff605
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff6cb
lea eax, [ebp - 0x14]
call fcn.00406438
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406440
ret
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0xa250c57
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x669156e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x401bd7
pop dword [ebp - 0x34]
mov eax, 0x489f3fd8
add eax, 0xb7a0dbff
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x7759b2f8
sub dword [ebp - 0x44], 0x29076dad
mov dword [ebp - 0x40], 0xcbda240a
sub dword [ebp - 0x40], 0x99a6d7c5
mov dword [ebp - 0x3c], 0x7f947070
sub dword [ebp - 0x3c], 0x33482c42
mov dword [ebp - 0x38], 0xd0606dd5
add dword [ebp - 0x38], 0x2f9f922b
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xcaa3fc5e
add dword [ebp - 0x44], 0xa9ce6cf8
mov dword [ebp - 0x40], 0x6532e374
add dword [ebp - 0x40], 0xdc397e01
mov dword [ebp - 0x3c], 0x396ce5fd
add dword [ebp - 0x3c], 0x2a02866f
mov dword [ebp - 0x38], 0x1c99a425
add dword [ebp - 0x38], 0xe3665bdb
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xb97f2ac4
sub eax, 0xb93eb9c4
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3706b
push 0
call eax
mov ecx, 0x7b03696b
add ecx, 0x84fce063
mov edx, eax
mov ebx, 0x71feed30
sub ebx, 0x71bded30
add ebx, dword [ebp - 0x34]
mov edi, 0xc39459a0
sub edi, 0x9bd3db46
xor dword [ebp - 0x30], 0x97e7cea9
mov esi, dword [ebx]
add dword [ebp - 0x28], 0x98402b3c
xor esi, edi
mov dword [ebp - 4], 0x493b272b
mov dword [edx], esi
xor dword [ebp - 0x30], 0x7cb2d970
add edx, 4
add ebx, 0x9024e093
sub ebx, 0x9024e08f
loop 0x401cf4
add eax, 0x4c651072
sub eax, 0x4c63f667
xor ebx, ebx
add ebx, eax
add eax, 0xa631313e
sub eax, 0xa6313139
mov ecx, 0x3aa3d23c
add ecx, 0xc59c2dc4
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x4011c0
Capabilities:
Create directory
Get thread local storage value
Set file attributes

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4513e0]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
push ebx
xor ebx, ebx
sub eax, 2
push edi
mov edi, ecx
je 0x4012b9
sub eax, 1
jne 0x40134a
add edi, 0x118
push edi
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00429c32
mov ecx, dword [esi + 4]
add esp, 0xc
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov eax, dword [0x453b70]
mov edi, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
push edi
call eax
push ebx
push 0x80
push 3
push ebx
push 1
push 0xc0000100
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40129c
movzx eax, word [esi + 0x1a]
movzx ecx, word [esi + 0x18]
lea edx, [esp + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
cmp eax, 1
jne 0x401295
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
cmp eax, 1
jne 0x401295
lea ecx, [esp + 8]
push ecx
push ebx
mov edx, ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [esi + 0x1c]
and eax, 0x27
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
jmp 0x40134c
mov edx, dword [edi]
mov eax, dword [esi + 4]
mov edx, dword [edx + 0x14]
push eax
call edx
test al, al
je 0x401343
lea eax, [edi + 0x118]
push eax
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.00429c32
mov edx, dword [esi + 4]
add esp, 0xc
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x120]
push 0x104
push edx
call fcn.00429c32
add esp, 0xc
lea eax, [esp + 0x11c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0
lea ecx, [esp + 0x120]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
push 0x180
lea edx, [esp + 0x1c]
push 0x8121
push edx
call fcn.00428b79
add esp, 0xc
mov ebx, eax
add dword [edi + 0x21c], 1
mov eax, ebx
mov ecx, dword [esp + 0x220]
pop edi
pop ebx
xor ecx, esp
call fcn.004289ca
add esp, 0x21c
ret 4

Function at 0x40152b
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp ebx, 0x8000
push esi
mov esi, ecx
jl 0x401573
mov ecx, dword [esi + ebx*4 - 0x1fdd4]
mov eax, dword [esi + 0x228]
push edi
mov edi, dword [esp + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x40154d
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x224]
add eax, ecx
mov ecx, dword [esp + 0x14]
push edi
push eax
push ecx
call fcn.0042e380
add esp, 0xc
add dword [esi + ebx*4 - 0x1fdd4], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
push ebx
call fcn.004291e4
add esp, 0xc
pop esi
pop ebx
ret 0xc
Function at 0x401630
Capabilities:
Extract resource via kernel32 functions
Get thread local storage value

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xa
mov edi, eax
push 0x4b0
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x401731
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401731
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push edi
mov dword [esi + 0x224], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea edi, [esi + 8]
push edi
push 0xffffffffffffffff
push 0x4010e0
push 0x4010c0
push 0x401090
push 0x401060
push 0x401030
push 0x401020
push 0x401010
mov dword [esi + 0x228], eax
call sub.Cabinet.dll_FDICreate
add esp, 0x24
test eax, eax
mov dword [esi + 4], eax
je 0x401721
mov eax, dword [0x453b70]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call ebx
mov edx, dword [eax]
push 0
push 0x8020
mov ecx, eax
mov eax, dword [edx]
push 0
call eax
mov edx, dword [esi + 4]
lea ecx, [esp + 0xc]
push ecx
mov edi, eax
push edi
push edx
call sub.Cabinet.dll_FDIIsCabinet
movzx eax, word [esp + 0x1e]
mov ecx, dword [0x453b70]
add esp, 0xc
push ecx
mov dword [esi + 0x220], eax
call ebx
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
push edi
call eax
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00401370
pop edi
pop esi
pop ebx
add esp, 0x18
ret 4
mov eax, dword [edi]
pop edi
pop esi
add eax, 0xb000
pop ebx
add esp, 0x18
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
add esp, 0x18
ret 4

Function at 0x401970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x441ebe
mov eax, dword fs:[0]
push eax
push ebx
push edi
mov eax, dword [0x4513e0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea eax, [edi + 0x40]
mov dword [esp + 0x14], 2
call fcn.00402c90
cmp dword [edi + 0x30], 8
jb 0x4019b8
mov eax, dword [edi + 0x1c]
push eax
call fcn.00429d64
add esp, 4
xor ebx, ebx
mov dword [edi + 0x30], 7
mov dword [edi + 0x2c], ebx
lea eax, [edi + 0xc]
mov word [edi + 0x1c], bx
mov byte [esp + 0x14], bl
call fcn.00402c10
mov dword [esp + 0x14], 0xffffffff
call fcn.00403330
mov eax, dword [edi + 4]
push eax
call fcn.00429d64
add esp, 4
mov dword [edi + 4], ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0xc
ret 4
Function at 0x406340
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x440a5b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4513e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00427f54
push 4
mov dword [esp + 0x20], 0
call fcn.0042a0a3
mov edi, eax
add esp, 4
test edi, edi
je 0x4063c0
call fcn.004281ba
mov dword [edi], eax
call fcn.00427fee
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00428799
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4063b5
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004287ba
jmp 0x4063c2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x4088e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x441ebe
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x4513e0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
call fcn.00416c70
xor ebx, ebx
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [esp + 0x14], ebx
call fcn.004068e0
mov dword [esi + 0x10], eax
mov byte [eax + 0x45], 1
mov eax, dword [esi + 0x10]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x10]
mov dword [eax], eax
mov eax, dword [esi + 0x10]
mov dword [eax + 8], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x30], 7
mov dword [esi + 0x2c], ebx
mov word [esi + 0x1c], bx
mov byte [esp + 0x14], 2
call fcn.004222e0
mov dword [esi + 0x44], eax
mov byte [eax + 0x2d], 1
mov eax, dword [esi + 0x44]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x44]
mov dword [eax], eax
mov eax, dword [esi + 0x44]
mov dword [eax + 8], eax
mov dword [esi + 0x48], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x3e], 1
mov byte [esi + 0x3c], bl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x411450
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x880
mov eax, dword [0x4513e0]
xor eax, esp
mov dword [esp + 0x87c], eax
mov eax, dword [esp + 0x888]
push ebx
mov ebx, dword [esp + 0x8a0]
push ebp
mov ebp, dword [esp + 0x8a0]
push esi
mov esi, dword [esp + 0x890]
push edi
push esi
mov edi, ecx
lea ecx, [esp + 0x684]
push 0x104
push ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], eax
call fcn.00429cf8
add esp, 0xc
push 0x448ab0
lea edx, [esp + 0x684]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x684]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x411500
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.__Error_0x_X_retrieving_folder_contents
push 0x4524d8
xor eax, eax
call fcn.0041eee0
add esp, 0xc
jmp 0x411677
mov ecx, 0x448b08
lea eax, [esp + 0x4c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x411536
test dx, dx
je 0x411532
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x411536
add eax, 4
add ecx, 4
test dx, dx
jne 0x411510
xor eax, eax
jmp 0x41153b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x411645
mov ecx, 0x448b0c
lea eax, [esp + 0x4c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x411576
test dx, dx
je 0x411572
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x411576
add eax, 4
add ecx, 4
test dx, dx
jne 0x411550
xor eax, eax
jmp 0x41157b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x411645
push esi
lea edx, [esp + 0x47c]
push 0x104
push edx
call fcn.00429cf8
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0xc
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x47c]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x274]
push 0x104
push eax
call fcn.00429cf8
add esp, 0xc
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x274]
push edx
call esi
test byte [esp + 0x20], 0x10
je 0x411611
mov eax, dword [esp + 0x8a4]
mov ecx, dword [esp + 0x8a0]
mov edx, dword [esp + 0x89c]
push ebx
push ebp
push eax
push ecx
push edx
lea eax, [esp + 0x284]
push eax
lea ecx, [esp + 0x490]
push ecx
mov ecx, edi
call fcn.00411450
jmp 0x41163b
mov edx, dword [esp + 0x8a4]
mov eax, dword [esp + 0x89c]
push ebp
push edx
push eax
lea ecx, [esp + 0x27c]
push ecx
lea edx, [esp + 0x488]
push edx
mov edx, ebx
mov ecx, edi
call fcn.00411800
mov esi, eax
test esi, esi
jne 0x41166c
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x411500
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x12
jne 0x41166c
xor esi, esi
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x88c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004289ca
add esp, 0x880
ret 0x1c
Function at 0x4116a0
Capabilities:
Copy file
Get common file path
Move file

Disassembly:
sub esp, 0x41c
mov eax, dword [0x4513e0]
xor eax, esp
mov dword [esp + 0x418], eax
push ebp
mov ebp, dword [esp + 0x424]
push edi
lea eax, [esp + 0x218]
push eax
push 0x104
mov edi, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x448b14
lea edx, [esp + 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0
push 3
push 0
push 1
push 0x20000
lea ecx, [esp + 0x28]
push ecx
mov dword [esi], 0
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41174b
push esi
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 8]
push edx
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 4
push 1
push ebp
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x4117a8
push str.____Transfering_source_file_security
push 0x4524d8
call fcn.0041eee0
mov ecx, dword [esp + 0x14]
add esp, 8
push 0
push ecx
push 0
push 0
push 0x80000004
push 1
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov eax, dword [esp + 8]
test eax, eax
je 0x4117a8
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 5
push ebp
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 0x10]
push ecx
push str.____Source:__s
push 0x4524d8
xor eax, eax
call fcn.0041eee0
push ebp
push str.____Destination:__s
push 0x4524d8
xor eax, eax
call fcn.0041eee0
mov ecx, dword [esp + 0x438]
add esp, 0x18
pop edi
pop ebp
xor ecx, esp
call fcn.004289ca
add esp, 0x41c
ret 4