joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402666
Capabilities:
Create directory
Set current directory

Disassembly:
mov eax, 0x4078b2
call fcn.004034e0
sub esp, 0x2fc
push ebx
push esi
lea ecx, [ebp - 0x18]
call fcn.00401e3e
mov esi, fcn.00401e85
lea eax, [ebp - 0x308]
push esi
push fcn.00401e3e
push 0x28
xor ebx, ebx
push 0xc
push eax
mov dword [ebp - 4], ebx
call fcn.00404078
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00402158
push 0x4092d0
push 0x4092e8
lea ecx, [ebp - 0x18]
call fcn.004021fb
cmp dword [ebp - 0x14], 1
jl 0x4026ce
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jne 0x4026d3
mov eax, dword [0x4092e4]
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x128]
push eax
call fcn.00403500
pop ecx
dec eax
cmp eax, 2
jle 0x4026fe
cmp byte [ebp + eax - 0x128], 0x5c
jne 0x4026ee
cmp byte [ebp + eax - 0x128], 0x5c
lea eax, [ebp + eax - 0x128]
jne 0x402723
and byte [eax], 0
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x402749
and byte [ebp - 4], 0
push esi
push 0x28
lea eax, [ebp - 0x308]
push 0xc
push eax
call fcn.00403f84
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401e85
jmp 0x402854
lea eax, [ebp - 0x128]
push edi
push eax
lea ecx, [ebp - 0x18]
call fcn.00402158
cmp dword [ebp - 0x14], 1
jl 0x4027b4
lea edi, [ebp - 0x308]
push 0
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.00401ef6
mov esi, eax
lea eax, [ebp - 0x18]
test esi, esi
push eax
mov ecx, edi
jle 0x402798
call fcn.0040214a
push esi
mov ecx, edi
call fcn.00402594
inc esi
lea ecx, [ebp - 0x18]
push esi
push 0
call fcn.004023ce
jmp 0x4027a5
call fcn.0040214a
lea ecx, [ebp - 0x18]
call fcn.00401cf9
inc ebx
add edi, 0xc
cmp dword [ebp - 0x14], 1
jge 0x402765
mov esi, fcn.00401e85
lea eax, [ebp - 0x308]
lea ecx, [ebp - 0x18]
push eax
call fcn.0040214a
cmp ebx, 1
jle 0x402832
lea edi, [ebp - 0x2fc]
dec ebx
push 0x4092d0
lea ecx, [ebp - 0x18]
call fcn.004021ec
push edi
lea ecx, [ebp - 0x18]
call fcn.004021db
cmp dword [ebp - 0x14], 1
jl 0x4027f2
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4027f7
mov eax, dword [0x4092e4]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x40282c
and dword [ebp - 0x20], eax
and dword [ebp - 0x1c], eax
cmp dword [ebp - 0x14], 1
mov dword [ebp - 0x24], 0xc
jl 0x40281c
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x402821
mov eax, dword [0x4092e4]
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add edi, 0xc
dec ebx
jne 0x4027cf
and byte [ebp - 4], 0
push esi
push 0x28
lea eax, [ebp - 0x308]
push 0xc
push eax
call fcn.00403f84
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401e85
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4056f5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x409410
cmp edx, dword [eax]
je 0x405717
add eax, 8
inc ecx
cmp eax, 0x4094a0
jl 0x405708
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x409410]
jne 0x405845
mov eax, dword [0x40be7c]
cmp eax, 1
je 0x40581f
test eax, eax
jne 0x405748
cmp dword [0x409354], 1
je 0x40581f
cmp edx, 0xfc
je 0x405845
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40577f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00403700
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00403500
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4057c2
lea eax, [ebp - 0x1a4]
push eax
call fcn.00403500
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4084f0
push edi
call fcn.00404140
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00403700
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403710
lea eax, [ebp - 0xa0]
push 0x4084d0
push eax
call fcn.00403710
push dword [esi + 0x409414]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403710
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040706d
add esp, 0x2c
pop edi
jmp 0x405845
lea eax, [ebp + 8]
lea esi, [esi + 0x409414]
push 0
push eax
push dword [esi]
call fcn.00403500
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4079c7
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x407a1c
push dword [esp + 0x10]
push 0x407946
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x488b20]
test esi, esi
je 0x407a75
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x407a14
cmp byte [esi + 0x10], 0
je 0x407a14
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x4079f0
jmp 0x407a75
mov esi, dword [0x488b20]
test esi, esi
je 0x407a75
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x407a6e
cmp byte [esi + 0x11], 0
je 0x407a4a
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x407a61
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x488b20
call fcn.004137fc
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x407a29
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x408ed9
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
test esi, esi
je 0x408f38
cmp byte [esi], 0
je 0x408f38
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00424f70
push dword [esp + 0x1c]
mov ebx, eax
push ebx
call dword [esp + 0x20]
push esi
push ebx
call fcn.00425220
add esp, 0x10
test eax, eax
jne 0x408f37
push 0x24
push 8
push dword [0x488a44]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword [esp + 0x10]
mov dword [ecx + 0x14], edi
mov edi, ecx
mov dword [ecx], ebx
mov dword [ecx + 8], 1
mov dword [eax + 4], ecx
pop ebx
mov eax, edi
pop edi
pop esi
ret 0x10

Function at 0x409ccc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x409d56
cmp dword [ebp + 0xc], edi
je 0x409d56
push esi
push 0x28
push 8
push dword [0x488a44]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 8]
mov esi, eax
or dword [esi + 4], 0xffffffff
mov dword [esi], edi
call sub.MSVCRT.dll__strdup
push dword [ebp + 0xc]
mov dword [esi + 8], eax
call sub.MSVCRT.dll__strdup
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
pop ecx
pop ecx
test al, 1
je 0x409d45
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x409e5a
push 0x2000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x409d3d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, esi
jmp 0x409d55
push esi
call fcn.00409eab
jmp 0x409d54
push esi
call fcn.00409d6f
push esi
mov edi, eax
call fcn.00409eab
pop ecx
pop ecx
pop esi
mov eax, edi
pop edi
pop ebp
ret 0xc

Function at 0x409d6f
Capabilities:
Delete file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov eax, dword [esi + 8]
mov ebp, dword [esi + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ebp
call fcn.00444410
mov edi, eax
test edi, edi
je 0x409e3f
push dword [esp + 0x18]
call fcn.00469560
push ebx
push pe_nt_image_headers32
push 2
push ebx
push 1
push 0xc0000000
push ebp
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x409e2f
test byte [esi + 0x1c], 2
mov dword [esi + 0x10], ebp
jne 0x409dd8
push 1
push 0x34
push edi
call fcn.004444a0
add esp, 0xc
push dword [esp + 0x18]
push 0x2712
push edi
call fcn.004444a0
push 0x409e69
push 0x4e2b
push edi
call fcn.004444a0
push esi
push 0x2711
push edi
call fcn.004444a0
push edi
call fcn.00444490
add esp, 0x28
test eax, eax
jne 0x409e1a
xor ebx, ebx
mov dword [esi + 4], 0xfffffffe
inc ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x409e2f
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esp + 0x18]
call fcn.00469550
push edi
call fcn.004443f0
pop ecx
cmp dword [esi + 4], 0xfffffffe
je 0x409e52
cmp dword [esi + 4], 0xfffffffc
je 0x409e52
mov dword [esi + 4], 0xfffffffd
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x409f90
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push edi
xor edi, edi
inc edi
cmp dword [0x488e54], 0
jne 0x409fbc
push 0x409edf
push 0x10
push 0x2c
mov dword [0x488e54], edi
call fcn.004131a0
mov dword [0x488e50], eax
cmp word [0x488e48], 0
jne 0x40a058
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
test eax, eax
jne 0x409fe7
mov word [0x488e48], di
jmp 0x409fef
xor eax, eax
mov word [0x488e48], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x488e64], eax
test eax, eax
je 0x40a058
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x471094
push eax
call esi
push 0x4710a0
push dword [0x488e64]
mov dword [0x488e58], eax
call esi
push str.getnameinfo
push dword [0x488e64]
mov dword [0x488e5c], eax
call esi
cmp dword [0x488e58], 0
mov dword [0x488e60], eax
pop esi
je 0x40a058
cmp dword [0x488e5c], 0
je 0x40a058
test eax, eax
je 0x40a058
mov dword [0x488e4c], edi
movsx eax, word [0x488e48]
pop edi
add esp, 0x190
ret
Function at 0x40b99a
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x489418]
call fcn.004130cd
mov ebx, eax
test ebx, ebx
je 0x40b9fc
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x40b9c3
push dword [esp + 0xc]
push ebx
call eax
jmp 0x40b9fc
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.DLL_GetWindowTextLengthA]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.00413ef0
mov esi, eax
lea ecx, [edi + 1]
push ecx
push esi
mov byte [esi], 0
push dword [ebx]
call dword [sym.imp.USER32.DLL_GetWindowTextA]
push esi
call sub.MSVCRT.dll_strlen
pop ecx
sub edi, eax
push edi
call fcn.00413f90
pop edi
pop esi
pop ebx
ret 8

Function at 0x40c838
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov ebx, eax
test ebx, ebx
je 0x40c8b2
push 9
call esi
test al, al
jns 0x40c8b2
push 0x11
call esi
test al, al
js 0x40c8b2
push 0x10
call esi
test al, al
js 0x40c8b2
push 0x12
call esi
test al, al
js 0x40c8b2
push 5
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [ebp - 0xc]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x40c8b2
push eax
push eax
push 0x44e
push ebx
call dword [sym.imp.USER32.DLL_SendMessageA]
test eax, 0x800
jne 0x40c8b2
xor eax, eax
jmp 0x40c933
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40c8da
push 0x11
call esi
test al, al
js 0x40c8d2
push 0x10
call esi
test al, al
js 0x40c8d2
push 0x12
call esi
test al, al
jns 0x40c8da
push 1
push edi
call fcn.0040c93b
mov esi, dword [sym.imp.USER32.DLL_GetPropA]
test ebx, ebx
je 0x40c8f0
push str.PB_Hotkey
push ebx
call esi
test eax, eax
jne 0x40c930
push str.PB_WindowID
push edi
call esi
mov esi, eax
test esi, esi
je 0x40c930
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x40c930
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x40c930
lea eax, [esi - 1]
push eax
push dword [0x489424]
call fcn.004130cd
test eax, eax
je 0x40c930
mov eax, dword [eax + 8]
jmp 0x40c932
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40db4b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push 0x4712f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x48917c], eax
test eax, eax
je 0x40db7b
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x489178], eax
lea eax, [ebp - 0x1c]
mov dword [0x489180], 1
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40dbcb
cmp dword [ebp - 0xc], 1
jne 0x40dba9
and dword [0x489180], 0
jmp 0x40dbe3
cmp dword [ebp - 0xc], 2
jne 0x40dbcb
cmp dword [ebp - 0x18], 5
jb 0x40dba0
jne 0x40dbcb
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
and eax, dword [0x489180]
mov dword [0x489180], eax
jmp 0x40dbd0
mov eax, dword [0x489180]
test eax, eax
je 0x40dbe3
call fcn.0040d9b6
neg eax
sbb eax, eax
and dword [0x489180], eax
lea esp, [ebp + 0x78]
pop ebp
ret

Function at 0x40ed40
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x40ed72
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40ed6d
cmp dword [esp + 0xc], esi
je 0x40ed89
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x41158d
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [0x489218]
push ebp
xor ebp, ebp
push esi
test eax, eax
jne 0x4115b0
push fcn.004116ad
push 0x10
push 0x148
call fcn.004131a0
mov dword [0x489218], eax
push dword [esp + 0xc]
push eax
call fcn.0041310c
mov esi, eax
test esi, esi
je 0x4116a6
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x4115d2
mov edi, section..rdata
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x4115e0
cmp byte [ebx], 0
jne 0x4115e5
mov ebx, 0x47141c
push edi
call sub.MSVCRT.dll_strlen
push ebx
mov dword [esp + 0x24], eax
call sub.MSVCRT.dll_strlen
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
add ecx, 2
add eax, ecx
push eax
push 0
push dword [0x488a44]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x41168d
push edi
push eax
call sub.MSVCRT.dll_strcpy
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x411642
cmp byte [eax + edi - 1], 0x5c
mov edi, dword [esp + 0x18]
je 0x411646
push 0x471420
push edi
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
jmp 0x411646
mov edi, dword [esp + 0x18]
push ebx
push edi
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x411666
and dword [esi + 4], ebp
jmp 0x411678
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x41167a
mov dword [esi + 4], 1
mov ebp, esi
push edi
push 0
push dword [0x488a44]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x4116a4
cmp dword [esp + 0x14], 0xffffffff
je 0x411698
mov esi, dword [esp + 0x14]
push esi
push dword [0x489218]
call fcn.0041307e
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc
Function at 0x411723
Capabilities:
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x248
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x4117ad
cmp byte [eax], 0
je 0x4117ad
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
mov byte [ebp - 4], 0
push eax
call sub.MSVCRT.dll_strlen
mov ecx, eax
add esp, 0x10
lea eax, [ebp + ecx - 0x109]
cmp ecx, 2
je 0x411777
cmp ecx, 3
jne 0x4117b9
cmp byte [ebp - 0x107], 0x3a
jne 0x4117b9
cmp ecx, 2
jne 0x411798
lea eax, [ebp - 0x108]
push 0x471420
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jbe 0x4117ad
push 0xfffffffffffffffe
pop edi
mov eax, edi
mov edx, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov cl, byte [eax]
cmp cl, 0x5c
je 0x4117c5
cmp cl, 0x2f
jne 0x4117cb
mov byte [eax], 0
dec eax
jmp 0x4117b9
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, esi
je 0x411808
test byte [ebp - 0x248], 0x10
je 0x4117f1
push 0xfffffffffffffffe
pop edi
jmp 0x4117ff
mov esi, dword [ebp - 0x22c]
xor edi, edi
or edi, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4117ad
mov cl, byte [ebp - 0x108]
mov al, byte [ebp - 0x107]
cmp cl, 0x5c
jne 0x41181d
cmp al, 0x5c
je 0x411826
cmp cl, 0x2e
jne 0x4117ad
cmp al, cl
jne 0x4117ad
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, esi
je 0x411798
test al, 0x10
je 0x4117ad
jmp 0x4117aa

Function at 0x411861
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x4118d2
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
mov byte [ebp - 4], 0
push eax
call sub.MSVCRT.dll_strlen
lea ecx, [ebp - 0x108]
add esp, 0x10
add eax, ecx
jmp 0x4118b4
mov cl, byte [eax - 1]
cmp cl, 0x20
je 0x4118b3
cmp cl, 0x5c
je 0x4118b3
cmp cl, 0x2f
jne 0x4118be
dec eax
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x4118a1
mov byte [eax], 0
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x4118d4
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x411bb8
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x411be1
test byte [esp + 8], 2
je 0x411bd5
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x411be3
xor eax, eax
ret 8

Function at 0x411c70
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x411cac
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x411fb0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x412015
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x41200d
push dword [esp + 0x10]
push dword [0x489548]
call fcn.004130cd
test eax, eax
je 0x412003
cmp dword [eax + 4], 0
je 0x411ff2
push edi
push esi
push eax
call fcn.00412070
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc
Function at 0x412070
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x412177
cmp dword [esi + 0x14], 1
jne 0x4120bb
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x412138
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x412123
dec eax
je 0x41210c
sub eax, 2
je 0x4120f7
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.00411c70
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x412165
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x4120e1
xor eax, eax
pop esi
add esp, 0xc
ret 0xc

Function at 0x412f5c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x489228]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x412fbd
push esi
push dword [0x489224]
push 8
push dword [0x488a44]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x489228]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x489220]
jmp 0x412fad
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x412fab
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x412f9b
push edi
push 0x412efa
call fcn.00469086
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4