joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430220
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.0042a9d0
test eax, eax
je 0x43030f
mov ecx, edi
call fcn.0042a9d0
mov ecx, eax
call fcn.00427f50
test eax, eax
jne 0x43030f
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x43030f
mov eax, dword [0x994db0]
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
jne 0x430282
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
lea ecx, [esp + 0x10]
mov ebp, dword [esp + 0x24]
push 1
push ecx
mov ecx, dword [edi + 0x44]
lea edx, [esp + 0x1c]
shr ecx, 4
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x2c]
and ecx, 1
push eax
push ecx
push ebp
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov ecx, edi
call fcn.0042a9d0
mov ecx, eax
call fcn.00428180
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [esp + 0x28]
mov eax, 1
cmp ecx, eax
jne 0x43030f
cmp ebx, eax
jne 0x43030f
cmp dword [esp + 0x10], eax
jne 0x4302f5
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xcc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [edi]
push eax
mov eax, dword [esp + 0x24]
push ecx
push ebp
push eax
mov ecx, edi
call dword [edx + 0xc0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x432f40
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x469a48
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x432f79
inc eax
mov dword [esi + 0x10], eax
jmp 0x43308c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x432f8d
mov eax, 0xffffffc7
jmp 0x43308e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x432f9e
cmp dword [esi + 8], eax
jne 0x432f8d
cmp dword [esi + 8], eax
jne 0x432fb7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x432fb7
mov eax, 0xffffffc7
jmp 0x43308e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x432fcb
push eax
mov ecx, ebx
call fcn.00432770
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00402cf0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x432ffc
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00402d10
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00431ee0
test eax, eax
mov dword [esp + 0x38], eax
je 0x43302f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x96a1b8
call fcn.00402ef0
mov eax, dword [esp + 0x38]
jmp 0x43308e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00432da0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x433073
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00432dc0
mov esi, eax
test esi, esi
jne 0x4330a3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00432da0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x433045
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x96a1b8
call fcn.00402ef0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x96a1b8
call fcn.00402ef0
mov eax, esi
jmp 0x43308e

Function at 0x4361c0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x436220
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x436220
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x436220
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x436220
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x436260
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x4ad01555
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp word [ebp + 0xc], 0
mov eax, dword [0x4ad33b78]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
jne 0x4ad0f14c
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.4ad01305
leave
ret 8
push edi
push dword [ebp + 0xc]
mov edi, dword [sym.imp.msvcrt.dll_towupper]
mov word [ebp - 0xc], 0x3d
call edi
and word [ebp - 6], 0
mov word [ebp - 0xa], ax
pop ecx
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 8], 0x3a
call fcn.4ad01b84
test eax, eax
je 0x4ad17475
test esi, esi
je 0x4ad0f18d
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
xor eax, eax
pop edi
jmp 0x4ad01582
push dword [ebp + 0xc]
call edi
mov word [esi], ax
inc esi
inc esi
mov word [esi], 0x3a
inc esi
inc esi
mov word [esi], 0x5c
and word [esi + 2], 0
xor eax, eax
pop ecx
inc eax
jmp 0x4ad0f18f

Function at 0x4ad01a3a
Capabilities:
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x4ad01a5d
cmp dword [0x4ad2fac4], edi
jne 0x4ad01a5d
cmp dword [0x4ad2fabc], edi
je 0x4ad0be08
pop edi
leave
ret 4
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x20c
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 8], ebx
je 0x4ad0beb9
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
cmp eax, edi
mov dword [ebp - 4], eax
je 0x4ad0beb9
push dword [ebp + 8]
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
call edi
pop ecx
mov ecx, dword [0x4ad33af8]
add ecx, eax
add ecx, dword [ebp - 4]
lea eax, [ecx + ecx + 0x14]
push eax
push ebx
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebx, eax
test ebx, ebx
je 0x4ad17108
cmp byte [0x4ad33afc], 0
jne 0x4ad17110
push 0x4ad0bec0
push ebx
call dword [sym.imp.msvcrt.dll_wcscat]
push ebx
call edi
push dword [ebp + 8]
mov dword [0x4ad33af8], eax
push ebx
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x14
mov byte [0x4ad33afc], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push ebx
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
jmp 0x4ad01a5d
push dword [ebp - 8]
jmp 0x4ad0beae
mov eax, dword [0x4ad33af8]
push dword [ebp + 8]
lea eax, [ebx + eax*2]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
jmp 0x4ad0bea6
Function at 0x4ad01b84
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and word [0x4ad2ba20], 0
push ebx
push esi
mov ebx, 0x2000
push ebx
mov esi, 0x4ad2ba20
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4ad045ba
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
cmp byte [0x4ad2fa64], 0
push edi
je 0x4ad0465a
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x4ad34190
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12de5
push str.ERRORLEVEL
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad0b0d9
push str.CMDEXTVERSION
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12df1
push 0x4ad04674
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12df8
push str.DATE
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e03
push str.TIME
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e0f
push 0x4ad04664
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e27
xor eax, eax
pop edi
jmp 0x4ad01bb2
push dword [0x4ad2fa20]
push 0x4ad102d4
push esi
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
mov eax, esi
jmp 0x4ad0465c
push eax
push esi
call fcn.4ad01555
jmp 0x4ad0b0ee
push 2
jmp 0x4ad0b0df
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x4ad0465c
push ebx
push esi
push 1
push eax
call fcn.4ad0e537
jmp 0x4ad12e19
push ebx
push esi
push 1
push eax
call fcn.4ad0e2eb
and word [eax*2 + 0x4ad2ba20], 0
jmp 0x4ad0b0ee
call dword [sym.imp.msvcrt.dll_rand]
push eax
jmp 0x4ad0b0df
Function at 0x4ad02a73
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4ad33b78]
and word [ebp - 6], 0
mov dword [ebp - 4], eax
mov ax, word [ebp + 8]
mov word [ebp - 0xc], ax
mov ax, word [0x4ad33b8c]
mov word [ebp - 8], ax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xa], 0x3a
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 4]
sbb eax, eax
neg eax
call fcn.4ad01305
leave
ret 4

Function at 0x4ad02be1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x4ad12dbb
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
cmp esi, ebx
je 0x4ad12dc2
push edi
push ebx
push dword [ebp + 8]
call fcn.4ad02b83
mov edi, eax
push 0x20
push edi
mov dword [ebp + 8], edi
call fcn.4ad01a67
cmp eax, ebx
jne 0x4ad12dc9
cmp edi, ebx
je 0x4ad02c70
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov edi, eax
test esi, esi
je 0x4ad02c74
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ebx, eax
test ebx, ebx
jbe 0x4ad02c67
cmp dword [0x4ad2b9e8], 0
jne 0x4ad02c67
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4ad12dd1
lea esi, [esi + ebx*2 + 2]
jmp 0x4ad02c30
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor edi, edi
jmp 0x4ad02c30
xor ebx, ebx
jmp 0x4ad02c3e
xor eax, eax
jmp 0x4ad02c6b
xor eax, eax
jmp 0x4ad02c6a
mov word [eax], bx
jmp 0x4ad02c22
cmp word [esi + edi*2], 0x3d
jne 0x4ad02c61
lea eax, [esi + edi*2 + 2]
jmp 0x4ad02c69
Function at 0x4ad02e9a
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
push edi
inc ebx
xor edi, edi
and eax, 3
cmp eax, 2
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0xc
ja 0x4ad0d9dc
test byte [ebp + 0xc], bl
je 0x4ad02ed5
test byte [ebp + 0xc], 8
jne 0x4ad0d9dc
cmp eax, edi
mov esi, 0x80000000
je 0x4ad083a6
push 0x4ad03d1c
push dword [ebp + 8]
mov dword [ebp - 8], 0x40000000
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x4ad02f00
mov dword [ebp + 0x10], ebx
push 2
cmp dword [ebp + 0xc], 0x10a
pop eax
push edi
je 0x4ad0d98d
push 0x80
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ad17155
push 8
push ebx
call dword [sym.imp.msvcrt.dll__open_osfhandle]
test byte [ebp + 0xc], 8
pop ecx
pop ecx
mov dword [ebp + 0x10], eax
jne 0x4ad0d74b
push dword [ebp + 0x10]
call fcn.4ad02e63
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc
mov dword [ebp - 8], esi
push 3
jmp 0x4ad02f02
push eax
call fcn.4ad02c7d
test eax, eax
jne 0x4ad02f4d
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x4ad02f4d
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
or dword [ebp - 4], 0xffffffff
push 2
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0xc], edi
call esi
cmp eax, 0xffffffff
je 0x4ad17129
push edi
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ad17178
cmp word [ebp - 0xc], 0x1a
je 0x4ad1718a
jmp 0x4ad02f4d
mov edi, 0x80
push edi
push 3
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp - 8]
or eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
push dword [ebp + 8]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ad0d9bb
xor edi, edi
jmp 0x4ad02f35
push 0
push edi
push 4
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ad17155
jmp 0x4ad0d9b4
or eax, 0xffffffff
jmp 0x4ad02f58
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
mov dword [0x4ad2ba04], eax
je 0x4ad0d78a
cmp dword [ebp + 0x10], 0xffffffff
je 0x4ad0d9dc
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll__close]
pop ecx
jmp 0x4ad0d9dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6e
mov dword [0x4ad2ba04], eax
jne 0x4ad0d9dc
mov dword [0x4ad2ba04], 2
jmp 0x4ad0d9dc
push 2
lea eax, [ebp - 4]
push eax
push edi
push ebx
mov dword [ebp - 4], edi
call esi
jmp 0x4ad0d7a4
or dword [ebp - 4], 0xffffffff
push 2
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push ebx
call esi
jmp 0x4ad02f4d
Function at 0x4ad02f6b
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4ad33b78]
mov dword [ebp - 4], eax
mov ax, word [ebp + 8]
mov word [ebp - 0x10], ax
mov ax, word [0x4ad33b8c]
push esi
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x10]
xor esi, esi
push eax
mov word [ebp - 0xe], 0x3a
mov word [ebp - 0xa], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4ad02fee
cmp eax, 2
je 0x4ad02fdf
cmp eax, 5
je 0x4ad02fdf
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4ad170e8
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.4ad01305
leave
ret 4
xor eax, eax
inc eax
jmp 0x4ad02fe1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4ad02fdf
jmp 0x4ad02fee
Function at 0x4ad04e91
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
and dword [esi], 0
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push 0x4ad04ec8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4ad14916
pop esi
leave
ret 4
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push 0x4ad14944
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ad04ec2

Function at 0x4ad05056
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x4ad05178
call fcn.4ad0162f
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x4ad05169
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4ad05169
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
jne 0x4ad19012
cmp dword [ecx + 0x74], 0xe
jbe 0x4ad05169
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x4ad2fa50], 0xffffffff
or dword [0x4ad2fa4c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x4ad34888]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x4ad34884]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4ad2fa54], eax
call fcn.4ad04fe0
cmp dword [0x4ad34878], edi
je 0x4ad19037
call fcn.4ad05194
push 0x4ad34870
push 0x4ad3486c
call sub.msvcrt.dll__initterm
mov eax, dword [0x4ad34880]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x4ad3487c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x4ad34868
push 0x4ad34860
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.4ad03ff1
jmp 0x4ad19048
mov dword [ebp - 0x1c], edi
jmp 0x4ad050ae
cmp eax, 0x20b
jne 0x4ad05169
cmp dword [ecx + 0x84], 0xe
jbe 0x4ad05169
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x4ad050a8
push fcn.4ad04fe0
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
jmp 0x4ad05101
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x4ad1905c
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x4ad1909b
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.4ad01447
ret
Function at 0x4ad0661f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4ad33b78]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x20
mov dword [ebp - 4], eax
call fcn.4ad0176c
mov esi, eax
push esi
mov dword [esi], edi
call fcn.4ad06476
mov eax, dword [esi + 0x14]
mov ebx, dword [esi]
mov edi, dword [esi + 8]
push 0x208
mov dword [ebp - 0x210], eax
call fcn.4ad0176c
push 0
push eax
mov dword [0x4ad33ae8], eax
call fcn.4ad01555
push 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad01ab9
test eax, eax
jne 0x4ad06743
mov ax, word [0x4ad33b8c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad01a67
and word [eax + 2], 0
lea eax, [ebp - 0x20c]
push eax
push 0x4ad34400
call dword [sym.imp.msvcrt.dll_wcscpy]
test edi, edi
pop ecx
pop ecx
je 0x4ad0671f
mov ax, word [edi]
cmp ax, 0x3a
je 0x4ad0671f
cmp ax, word [0x4ad33b8c]
jne 0x4ad066e7
cmp edi, ebx
je 0x4ad0673f
push edi
push ebx
call fcn.4ad0674d
mov ax, word [eax]
cmp ax, 0x3a
je 0x4ad0673f
cmp ax, word [0x4ad33b8c]
je 0x4ad0673f
mov ax, word [edi]
and word [edi], 0
push ebx
mov word [ebp - 0x214], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad16dc6
and dword [0x4ad2ba04], 0
mov ax, word [ebp - 0x214]
mov word [edi], ax
cmp dword [0x4ad2ba04], 0
jne 0x4ad06743
push esi
call fcn.4ad06476
mov eax, dword [ebp - 0x210]
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01305
leave
ret 4
inc edi
inc edi
jmp 0x4ad066e7
xor eax, eax
inc eax
jmp 0x4ad06730
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad2ba04], eax
jmp 0x4ad0670c
Function at 0x4ad067f1
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
xor ebx, ebx
cmp byte [0x4ad3484c], bl
pop ecx
mov dword [ebp + 8], eax
jne 0x4ad15dd7
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp + 0xc], eax
mov edi, 0x4ad290a0
mov esi, 0x2000
cmp dword [ebp + 0x10], esi
ja 0x4ad15deb
cmp dword [ebp + 0x10], ebx
je 0x4ad0687e
push ebx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push dword [0x4ad2b9ec]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
mov ebx, dword [ebp + 0x14]
mov esi, eax
push ebx
dec esi
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ad0687a
cmp dword [ebx], esi
jne 0x4ad0687a
mov eax, dword [ebp - 8]
mov dword [ebx], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x4ad06873
mov ebx, dword [ebp + 0x14]
jmp 0x4ad0686b
push ebx
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4ad06874
push ebx
push ebx
push esi
push edi
push 0x1000
push dword [ebp + 0xc]
push ebx
push dword [0x4ad2b9ec]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add dword [ebp + 0xc], esi
sub dword [ebp + 0x10], esi
push ebx
push dword [ebp + 0x14]
mov dword [ebp - 4], eax
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ad0687a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], eax
jne 0x4ad0687a
jmp 0x4ad0682c
Function at 0x4ad06d88
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
push ebx
push esi
push edi
push 2
pop esi
jne 0x4ad06d9e
push 3
pop esi
mov ebx, dword [ebp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
and dword [ebx], 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
je 0x4ad13520
xor eax, eax
inc eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4ad13567
push 0x23d4
push 0x23d3
push dword [ebp + 0xc]
call fcn.4ad0c64d
sub eax, 0
je 0x4ad1355f
dec eax
dec eax
jne 0x4ad1354e
mov eax, dword [ebp + 0x10]
and dword [eax], 0
or esi, 1
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
jmp 0x4ad06dbe
xor eax, eax
inc eax
jmp 0x4ad06dc0
xor eax, eax
jmp 0x4ad06dc0
Function at 0x4ad06dcc
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x4ad33b78]
push ebx
push esi
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x464], eax
call esi
mov ebx, eax
pop ecx
push dword [ebp - 0x464]
dec ebx
dec ebx
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad1331b
test al, 0x10
jne 0x4ad13329
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01305
leave
ret 8
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
jmp 0x4ad134cf
push dword [ebp - 0x464]
call esi
pop ecx
mov ecx, dword [ebp - 0x464]
lea eax, [ecx + eax*2]
cmp word [eax - 2], 0x5c
jne 0x4ad1334e
and word [eax + 2], 0
mov word [eax], 0x2a
jmp 0x4ad1335e
and word [eax + 4], 0
mov word [eax], 0x5c
mov word [eax + 2], 0x2a
lea eax, [ebp - 0x45c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x468], eax
jne 0x4ad13395
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xffffffffffffffff
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 2
jne 0x4ad134c3
jmp 0x4ad06e1b
mov dword [ebp - 0x460], 1
lea eax, [ebp - 0x430]
push 0x4ad01ab0
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x4ad13485
lea eax, [ebp - 0x430]
push 0x4ad01aa8
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x4ad13485
lea eax, [ebp - 0x430]
push eax
call esi
test eax, eax
pop ecx
je 0x4ad13485
test byte [ebp - 0x45c], 0x10
jne 0x4ad13457
push dword [ebp - 0x464]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x20c]
push eax
call esi
and word [ebp + eax*2 - 0x20e], 0
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x14
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad06dcc
test eax, eax
je 0x4ad134a6
mov eax, dword [ebp - 0x46c]
mov ecx, dword [edi]
add eax, ebx
cmp ecx, eax
jle 0x4ad13483
mov eax, ecx
jmp 0x4ad13483
mov eax, dword [edi]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x430]
push eax
call esi
cmp dword [ebp - 0x460], eax
pop ecx
jle 0x4ad13479
mov eax, dword [ebp - 0x460]
jmp 0x4ad13483
lea eax, [ebp - 0x430]
push eax
call esi
pop ecx
mov dword [edi], eax
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov dword [ebp - 0x460], eax
jne 0x4ad1339f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x468]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x460], 0
jne 0x4ad134d6
cmp esi, 0x12
je 0x4ad06e1b
push 0
push esi
call fcn.4ad0606f
pop ecx
pop ecx
xor eax, eax
jmp 0x4ad06e1e