joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1a3dd7c
Capabilities:
Encode data using xor

Disassembly:
sal edx, 0x91
not ecx
sal eax, 0x96
mul dword [esp + 0xb]
sbb ecx, 0x5915d121
imul edx, eax
xchg word [esp + eax*2 - 0x7d7ffffc], ax
neg ecx
xor bh, 0xd9
xor ebx, ecx
xor eax, eax
xor ax, dx
adc ebp, ecx
xor al, byte [edi + eax*2]
movsx ecx, dx
dec byte [esp + ecx*8 + 9]
dec dword [esp + ecx*8 + 7]
add dl, byte [edi + ecx + 2]
xchg dword [esp + ecx*4 + 7], ecx
dec word [esp + 6]
call fcn.00e3aa36
add byte [edx], 0x26
add byte [ebx + 0x1a], 0x82
out 0x39, al
adc edx, esi
cwde
or byte [0x1b14a2af], bl
mov eax, 0x839dcc50
in eax, 0x7e
sbb eax, 0xf31cb1f8
push edi
dec eax
mov eax, dword [0x4455441a]
in al, 0x5c
call 0xe7a1bb14
pop ebp
jae 0x1a3dd98
adc ebp, esi
xchg dword [esi], ebp
sub dword [edi + 0x72be4189], edi
js 0x1a3ddfe
jmp dword [eax + 0x72]
pushal
jb 0x1a3de46
sbb byte [0x86d3e5ed], dl
jl 0x1a3de80
retf
mov al, byte [0x8d022188]
xor byte [edi - 0x4a], 0x7d
pop esp
mov ebx, 0xe6f54b4
fistp dword [ebp + 0x154e88d2]
enter 0x1998, 0xe
pop eax
out 0xae, eax
jmp 0x1a3ded2
cmpsd dword [esi], dword es:[edi]
ret 0xd622
xchg edi, eax
mov edx, 0x768ae265
xchg esi, eax
sub eax, 0x52d0d848
fidiv word [ebx - 0x4777fb61]
sbb dword [edx + 0x73], ebp
pop edi
test eax, 0xb9c14e65
aad 0xda
fisub dword [ecx]
mov ch, ah
and dh, ch
push ecx
and dword [edi + esi + 8], edx
lcall 0x5924, 0xb94c0531
or ebx, dword [eax - 0x2dcb5a6]
invalid

Function at 0x1a41b93
Capabilities:
Encrypt data using speck

Disassembly:
imul ax, ax
mov dword [esp + edx*2 - 0x66c01116], eax
mov word [esi + edx - 0x3360088b], cx
adc dword [esp + edx - 0x33600888], edx
call fcn.00e1a82d
mov ecx, 0xcc25f4ad
movsx edx, cx
sub edi, 4
movsx eax, cx
sub ecx, ecx
mov eax, dword [edi + ecx*2]
inc ecx
xor eax, ebx
lea eax, [ecx + eax + 0x4c123b01]
ror eax, 2
and ecx, 0x16afac9f
bts dx, cx
lea eax, [eax + ecx*4 + 0x21136e7f]
shr edx, 0xce
xor eax, 0xb85c426
ror dx, 0x8f
inc edx
xor ebx, eax
not cx
sal cl, 0xe6
dec edx
add esi, eax
xadd ecx, edx
movsx eax, dx
inc eax
mov ax, word [ecx + ebp - 0x4ff7f]
call fcn.00d6c639

Function at 0x1a4631e
Capabilities:
Encode data using base64

Disassembly:
btc edx, edx
lea esi, [esi + edx - 0x307a5271]
shl dl, 0x62
call fcn.01134556
out 0xf9, al
enter 0xffffffffffffc0e4, 0x63
xor esp, ebp
add bh, byte [ecx + 6]
add dword [edi + ecx*4], ebx
aaa
mov dh, 0x11
sbb ah, byte [ebx + ebp*4]
hlt
mov dword [esp], 0xcf858d92
not dword [esp]
neg eax
sal ecx, cl
pop edx
bt edx, ecx
xor ebx, eax
rol cx, 0xee
jae 0x1099c9e
leave
push edx
sbb al, 0xa8
aad 8
add edx, 0x3d
std
dec ecx
and eax, dword [ebp - 0x5d0e45f1]
btr ecx, 0xa2

Function at 0x1a481b7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec ebx
push 0xcd16be9d
call fcn.01a481b7
mov eax, 0x3f91fa83
mov eax, dword [ebp + ebx*4]
push eax
jmp 0xd8290f
push 0xb33ed702
lea esp, [esp + 0xc]
jne 0xef389c
push 0x78aa270d
push 0xc3b73c1e
push 0x35b5caae
mov eax, dword [ebp]
call fcn.00fdd6f3
mov edx, 0x130b3bbb
aas
mov dl, 0xd2
dec esi
or edi, eax
pop edx
or esp, dword [ebp + 0x3aa00ce3]
hlt
Function at 0x105050b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10505200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x105050d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105050c2
add dl, dl
jne 0x105050e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10505134
xor eax, eax
add dl, dl
jne 0x105050ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105051d5
add dl, dl
jne 0x105050fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10505108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10505113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1050511e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1050512a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x105050cd
mov eax, 1
add dl, dl
jne 0x10505142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1050514d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10505139
sub eax, ebx
mov ebx, 1
jne 0x10505180
mov ecx, 1
add dl, dl
jne 0x10505166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10505171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1050515d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105050cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10505197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105051a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1050518e
cmp eax, 0x7d00
jae 0x105051c5
cmp eax, 0x500
jb 0x105051c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105050cd
cmp eax, 0x7f
ja 0x105051c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105050cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x105051f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x105050cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401470
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1404
call fcn.00406610
mov eax, dword [0x41d190]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc04]
push esi
push eax
call fcn.004045d4
lea ecx, [ebp - 0x804]
push ecx
call fcn.004045d4
lea eax, [ebp - 0x804]
add esp, 8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4014b0
sub eax, edx
xor ecx, ecx
jmp 0x4014c0
mov dl, byte [ebp + ecx - 0x804]
mov byte [ebp + ecx - 0x404], dl
inc ecx
test dl, dl
jne 0x4014c0
lea ecx, [ebp + eax - 0x405]
mov al, byte [ecx]
cmp al, 0x5c
je 0x4014e4
cmp al, 0x2f
jne 0x4014e7
mov byte [ecx], 0
lea edx, [ebp - 0x404]
push 0x5c
push edx
call fcn.004064d0
add esp, 8
test eax, eax
jne 0x40150d
lea eax, [ebp - 0x404]
push 0x2f
push eax
call fcn.004064d0
add esp, 8
lea esi, [eax + 1]
lea edx, [ebp - 0x1404]
mov eax, esi
sub edx, esi
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401520
lea eax, [ebp - 0x404]
mov byte [esi], cl
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x401533
mov ecx, dword [str.RzxMon.exe]
mov edx, dword [0x4183b4]
mov dword [eax], ecx
mov cx, word [0x4183b8]
mov dword [eax + 4], edx
mov dl, byte [0x4183ba]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0xc04]
push eax
lea ecx, [ebp - 0x804]
push str._supdatesRzxUpdate.exe
push ecx
call fcn.00406583
lea edx, [ebp - 0x804]
push edx
call fcn.00402774
add esp, 0x10
test eax, eax
jne 0x4015a6
lea eax, [ebp - 0xc04]
push eax
lea ecx, [ebp - 0x804]
push str._sRzxUpdate.exe
push ecx
call fcn.00406583
add esp, 0xc
lea edx, [ebp - 0x404]
push edx
call fcn.004027b0
push 0
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x804]
push ecx
call fcn.00402867
lea edx, [ebp - 0x1404]
push edx
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x1004]
push str.__s____s_
push ecx
call fcn.00406583
push 0
push 0
push 0x20
lea edx, [ebp - 0x1004]
push 0
push edx
call fcn.00404670
add esp, 0x34
test eax, eax
jne 0x401615
push eax
push eax
push 0x20
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.0040464b
add esp, 0x14
push 0x7d0
mov dword [0x41e4e4], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401860
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x41d190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0xf003f
push 0
push 0
mov esi, 3
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x4018ab
push str.OpenSCManager_error_r_n
call fcn.0040663b
add esp, 4
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004062fc
mov esp, ebp
pop ebp
ret
push edi
push 0xf01ff
push str.rzxnm
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x4018de
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004062fc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x401918
mov eax, dword [ebp - 0x1c]
cmp eax, 4
jne 0x4018fa
lea esi, [eax - 2]
jmp 0x401918
cmp eax, 1
je 0x401904
cmp eax, 7
jne 0x401918
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov esi, eax
neg esi
sbb esi, esi
neg esi
inc esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push ebx
call edi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004062fc
mov esp, ebp
pop ebp
ret
Function at 0x402020
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc04
mov eax, dword [0x41d190]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3ff
lea eax, [ebp - 0xc03]
push 0
push eax
mov byte [ebp - 0xc04], 0
call fcn.00406310
push 0x3ff
lea ecx, [ebp - 0x403]
push 0
push ecx
mov byte [ebp - 0x404], 0
call fcn.00406310
add esp, 0x18
push 0x400
lea edx, [ebp - 0xc04]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0xc04]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x402083
mov ecx, dword [str.IPHLPAPI.DLL]
mov edx, dword [0x4184d0]
mov dword [eax], ecx
mov ecx, dword [0x4184d4]
mov dword [eax + 4], edx
mov dx, word [0x4184d8]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [ebp - 0xc04]
push eax
call fcn.00402774
add esp, 4
test eax, eax
jne 0x4021dc
push 0x3ff
push eax
lea ecx, [ebp - 0x803]
push ecx
mov byte [ebp - 0x804], al
call fcn.00406310
lea edx, [ebp - 0x404]
push edx
call fcn.004045d4
add esp, 0x10
xor eax, eax
mov cl, byte [ebp + eax - 0x404]
mov byte [ebp + eax - 0x804], cl
inc eax
test cl, cl
jne 0x4020f0
lea eax, [ebp - 0x404]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x402110
mov ecx, dword [str.IPHLPAPI.DLL]
mov edx, dword [0x4184d0]
mov dword [eax], ecx
mov ecx, dword [0x4184d4]
mov dword [eax + 4], edx
mov dx, word [0x4184d8]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
call fcn.00405a6e
cmp eax, 4
lea eax, [ebp - 0x804]
jg 0x40217d
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x402150
mov ecx, dword [str.IPHLPAPI.DLLxp]
mov edx, dword [0x4184c0]
mov dword [eax], ecx
mov ecx, dword [0x4184c4]
mov dword [eax + 4], edx
mov edx, dword [0x4184c8]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
jmp 0x4021b6
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x402180
mov ecx, dword [str.IPHLPAPI.DLLwin7]
mov edx, dword [0x4184ac]
mov dword [eax], ecx
mov ecx, dword [0x4184b0]
mov dword [eax + 4], edx
mov edx, dword [0x4184b4]
mov dword [eax + 8], ecx
mov cx, word [0x4184b8]
mov dword [eax + 0xc], edx
mov word [eax + 0x10], cx
push 1
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x804]
push eax
call fcn.0040285e
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004062fc
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x404]
push ecx
call fcn.004045d4
lea eax, [ebp - 0x404]
add esp, 4
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4021f2
mov edx, dword [str.IPHLPAPI.DLL]
mov ecx, dword [0x4184d0]
mov dword [eax], edx
mov edx, dword [0x4184d4]
mov dword [eax + 4], ecx
mov cx, word [0x4184d8]
mov dword [eax + 8], edx
lea edx, [ebp - 0x404]
push edx
mov word [eax + 0xc], cx
call fcn.004027b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 4
call fcn.004062fc
mov esp, ebp
pop ebp
ret
Function at 0x40266e
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x548
mov eax, 0x416f51
call fcn.00406bc1
mov edi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x410]
push str._s
push eax
call fcn.00406583
add esp, 0xc
lea eax, [ebp - 0x550]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40273e
mov dword [ebp - 0x554], esi
and dword [ebp - 4], 0
lea eax, [ebp - 0x524]
push 0x418510
push eax
call fcn.00406ad0
pop ecx
pop ecx
test eax, eax
je 0x402721
lea eax, [ebp - 0x524]
push 0x41850c
push eax
call fcn.00406ad0
pop ecx
pop ecx
test eax, eax
je 0x402721
test byte [ebp - 0x550], 0x10
je 0x402746
lea eax, [ebp - 0x524]
push eax
push edi
lea eax, [ebp - 0x410]
push str._s_s
push eax
call fcn.00406583
lea eax, [ebp - 0x410]
push eax
call fcn.0040266e
add esp, 0x14
test al, al
je 0x402746
lea eax, [ebp - 0x550]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4026be
test esi, esi
je 0x40273e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
call fcn.00406c0b
ret
test esi, esi
je 0x402751
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x402740

Function at 0x402774
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40278e
test al, 0x10
jne 0x40278e
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x402792
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4027ac
test al, 0x10
je 0x4027ac
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4027be
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x41d190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x402814
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
test edi, edi
je 0x40280b
push 5
push 0
push edi
call esi
push 5
push edi
push ebx
call esi
pop esi
jmp 0x402826
push str.wininit.ini
push edi
push ebx
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004062fc
leave
ret
Function at 0x40291e
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc50
mov eax, dword [0x41d190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc50], ebx
mov dword [ebp - 0xc48], esi
test ebx, ebx
je 0x402b69
and dword [ebp - 0xc4c], 0
test esi, esi
jne 0x40298b
push 0x400
lea eax, [ebp - 0xc44]
push esi
push eax
call fcn.00406310
lea eax, [ebp - 0xc44]
push eax
call fcn.004059b6
lea eax, [ebp - 0xc44]
add esp, 0x10
mov dword [ebp - 0xc48], eax
mov esi, eax
push esi
call fcn.00406a40
cmp byte [esi + eax - 1], 0x5c
pop ecx
jne 0x4029a3
mov dword [ebp - 0xc4c], 1
push ebx
call fcn.00402774
pop ecx
test eax, eax
je 0x402b69
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
test edi, edi
jne 0x4029c5
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4029cb
push 0xb
push edi
push ebx
call esi
test eax, eax
jne 0x402b69
mov ebx, 0x3ff
push ebx
push eax
mov byte [ebp - 0x844], al
lea eax, [ebp - 0x843]
push eax
call fcn.00406310
push ebx
xor ebx, ebx
lea eax, [ebp - 0x443]
push ebx
push eax
mov byte [ebp - 0x444], 0
call fcn.00406310
add esp, 0x18
cmp edi, ebx
je 0x402a6f
push edi
call fcn.00402774
pop ecx
test eax, eax
je 0x402a64
push edi
lea eax, [ebp - 0x444]
push str._s.bak
push eax
call fcn.00406583
add esp, 0xc
push 0x5c
push edi
call fcn.004064d0
pop ecx
pop ecx
cmp dword [ebp - 0xc4c], ebx
je 0x402a3d
inc eax
push eax
push dword [ebp - 0xc48]
lea eax, [ebp - 0x844]
push str._s_s.bak
push eax
call fcn.00406583
add esp, 0x10
push 0xb
lea eax, [ebp - 0x444]
push eax
push edi
call esi
push 0xb
push edi
push dword [ebp - 0xc50]
jmp 0x402ac2
mov edi, dword [ebp - 0xc50]
push edi
lea eax, [ebp - 0x444]
push str._s.bak
push eax
call fcn.00406583
add esp, 0xc
push 0x5c
push edi
call fcn.004064d0
pop ecx
pop ecx
cmp dword [ebp - 0xc4c], ebx
je 0x402a9d
inc eax
push eax
push dword [ebp - 0xc48]
lea eax, [ebp - 0x844]
push str._s_s.bak
push eax
call fcn.00406583
add esp, 0x10
push 0xb
lea eax, [ebp - 0x444]
push eax
push edi
call esi
cmp byte [ebp - 0x844], bl
je 0x402b69
cmp byte [ebp - 0x444], bl
je 0x402b69
lea eax, [ebp - 0x444]
push eax
call fcn.00402774
pop ecx
test eax, eax
je 0x402b69
push 0
call fcn.00406918
push 0x3f
mov edi, eax
lea eax, [ebp - 0x43]
push 0
push eax
mov byte [ebp - 0x44], bl
call fcn.00406310
push edi
lea eax, [ebp - 0x44]
push 0x418540
push eax
call fcn.00406583
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x844]
push eax
call fcn.00408530
add esp, 0x24
push 0xb
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x444]
push eax
call esi
test eax, eax
lea eax, [ebp - 0x844]
jne 0x402b5f
push str..bak
push eax
call fcn.00408530
mov eax, ebx
pop ecx
inc ebx
pop ecx
cmp eax, 0xa
jl 0x402b28
lea eax, [ebp - 0x444]
push 0
push eax
call fcn.004027be
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004062fc
leave
ret
Function at 0x402b78
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xd50
mov eax, 0x416f84
call fcn.00406bc1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 0xd58], eax
lea eax, [ebp - 0xc10]
push str._s
push eax
mov dword [ebp - 0xd54], ecx
call fcn.00406583
add esp, 0xc
lea eax, [ebp - 0xd50]
push eax
lea eax, [ebp - 0xc10]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402ce6
mov dword [ebp - 0xd5c], ebx
and dword [ebp - 4], 0
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, str._s_s
lea eax, [ebp - 0xd24]
push 0x418510
push eax
call fcn.00406ad0
pop ecx
pop ecx
test eax, eax
je 0x402cc5
lea eax, [ebp - 0xd24]
push 0x41850c
push eax
call fcn.00406ad0
pop ecx
pop ecx
test eax, eax
je 0x402cc5
lea eax, [ebp - 0xd24]
push eax
push dword [ebp - 0xd58]
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.00406583
lea eax, [ebp - 0xd24]
push eax
push dword [ebp - 0xd54]
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.00406583
add esp, 0x20
test byte [ebp - 0xd50], 0x10
je 0x402ca9
push dword [ebp - 0xd54]
lea eax, [ebp - 0x810]
push eax
call fcn.00412959
pop ecx
pop ecx
test eax, eax
je 0x402cc5
lea eax, [ebp - 0x410]
push eax
call fcn.00402792
pop ecx
test eax, eax
jne 0x402c8e
lea eax, [ebp - 0x410]
push eax
call fcn.00402755
pop ecx
push dword [ebp + 0x10]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.00402b78
add esp, 0xc
jmp 0x402cc5
cmp dword [ebp + 0x10], 0
lea eax, [ebp - 0x410]
je 0x402cb9
push 0
jmp 0x402cbb
push 1
push eax
lea eax, [ebp - 0x810]
push eax
call edi
lea eax, [ebp - 0xd50]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402be2
test ebx, ebx
je 0x402ce6
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.00406c0b
ret

Function at 0x402cec
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x544
mov eax, dword [0x41d190]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push esi
lea eax, [ebp - 0x404]
push str._s
push eax
call fcn.00406583
add esp, 0xc
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x402dcb
lea eax, [ebp - 0x518]
push 0x418510
push eax
call fcn.00406ad0
pop ecx
pop ecx
test eax, eax
je 0x402da7
lea eax, [ebp - 0x518]
push 0x41850c
push eax
call fcn.00406ad0
pop ecx
pop ecx
test eax, eax
je 0x402da7
lea eax, [ebp - 0x518]
push eax
push esi
lea eax, [ebp - 0x404]
push str._s_s
push eax
call fcn.00406583
add esp, 0x10
test byte [ebp - 0x544], 0x10
lea eax, [ebp - 0x404]
je 0x402d9a
push eax
call fcn.00402cec
pop ecx
jmp 0x402da7
push 0
push 0
push eax
call fcn.0040291e
add esp, 0xc
lea eax, [ebp - 0x544]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402d38
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004062fc
leave
ret
Function at 0x402e35
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xd4c
mov eax, 0x416fb7
call fcn.00406bc1
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0xd54], eax
lea eax, [ebp - 0x810]
push str._s
push eax
call fcn.00406583
add esp, 0xc
lea eax, [ebp - 0xd50]
push eax
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x402fb3
test edi, edi
je 0x402fb3
mov dword [ebp - 0xd58], edi
and dword [ebp - 4], 0
mov esi, str._s_s
lea eax, [ebp - 0xd24]
push eax
push ebx
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.00406583
lea eax, [ebp - 0xd24]
push eax
push dword [ebp - 0xd54]
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.00406583
add esp, 0x20
test byte [ebp - 0xd50], 0x10
je 0x402f7e
lea eax, [ebp - 0xd24]
push 0x418510
push eax
call fcn.00406ad0
pop ecx
pop ecx
test eax, eax
je 0x402f96
lea eax, [ebp - 0xd24]
push 0x41850c
push eax
call fcn.00406ad0
pop ecx
pop ecx
test eax, eax
je 0x402f96
cmp byte [ebp + 0x10], 0
je 0x402f49
lea eax, [ebp - 0xd24]
push eax
lea eax, [ebp - 0xc10]
push str.___s__
push eax
call fcn.00406583
push 0x400
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0xc10]
push eax
call fcn.00405b80
add esp, 0x18
lea eax, [ebp - 0x410]
push eax
call fcn.00402792
pop ecx
test eax, eax
jne 0x402f67
lea eax, [ebp - 0x410]
push eax
call fcn.00402755
pop ecx
push 0
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.00402e35
jmp 0x402f93
push 0
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.0040291e
add esp, 0xc
lea eax, [ebp - 0xd50]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402e9b
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.00406c0b
ret