joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f63a
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x6b7ea3
call fcn.0064083a
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x38], ebx
je 0x44f734
cmp byte [esi + 0x3d], bl
je 0x44f734
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x44f674
xor al, al
jmp 0x44f736
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.00438caf
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ebx, edi
cmp eax, 0x10
jae 0x44f6a1
lea ebx, [ebp - 0x28]
mov edi, ebx
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, ebx
mov edx, dword [ecx]
push eax
push edi
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x44f6cc
sub eax, 1
je 0x44f6d0
dec eax
sub eax, 1
je 0x44f722
xor bl, bl
jmp 0x44f724
mov byte [esi + 0x3d], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov ecx, edi
cmp eax, 0x10
jae 0x44f6e0
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x2c]
sub ebx, ecx
je 0x44f708
cmp eax, 0x10
jae 0x44f6ef
lea edi, [ebp - 0x28]
push dword [esi + 0x4c]
push ebx
push 1
push edi
call fcn.00667e3b
add esp, 0x10
cmp ebx, eax
jne 0x44f6c8
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
cmp byte [esi + 0x3d], 0
je 0x44f722
test ebx, ebx
jne 0x44f695
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.0040e5d3
jmp 0x44f68f
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040f52f
mov al, bl
jmp 0x44f736
mov al, 1
call fcn.006407e4
ret

Function at 0x44fd28
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor edx, edx
mov ecx, 0x811c9dc5
cmp dword [esp + 8], edx
jbe 0x44fd4e
push esi
mov esi, dword [esp + 8]
movzx eax, byte [edx + esi]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [esp + 0xc]
jb 0x44fd3a
pop esi
mov eax, ecx
ret 8
Function at 0x453213
Capabilities:
Create directory

Disassembly:
push 0x4a0
mov eax, 0x69efda
call fcn.006408a8
mov edi, ecx
mov eax, dword [edi + 0x40]
mov dword [ebp - 0x374], edi
test eax, eax
jne 0x45337e
xor ebx, ebx
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.00453f9b
mov edx, dword [eax]
lea ecx, [ebp - 0x64]
push str.HTA_
push ecx
mov ecx, eax
mov dword [ebp - 4], ebx
call dword [edx + 0x34]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.00447b2e
cmp dword [ebp - 0x4c], 8
mov eax, dword [ebp - 0x60]
jae 0x45326c
lea eax, [ebp - 0x60]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x45329a
push ebx
push str.failCreateHtaDir
lea ecx, [ebp - 0xe4]
call fcn.004577b2
push 0x7509e4
lea eax, [ebp - 0xe4]
push eax
call fcn.006586e4
push 1
push 2
lea ecx, [ebp - 0x4ac]
call fcn.004416bd
push ebx
mov byte [ebp - 4], 3
call fcn.0066952a
mov dword [esp], 0x6cb5ec
push edx
push eax
push str.install.
lea eax, [ebp - 0x4ac]
push eax
call fcn.00448c07
mov ecx, eax
call fcn.0044cc67
push eax
call fcn.00448c07
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x370]
call fcn.004479c5
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4ac]
call fcn.004443cb
push eax
mov eax, dword [ebp - 0x370]
lea ecx, [ebp - 0x370]
mov byte [ebp - 4], 5
call dword [eax + 0x28]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040f52f
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x370]
mov ecx, edi
push eax
call fcn.004520c4
mov dword [ebp - 4], 4
push 0x1c
call fcn.0063ffa4
pop ecx
mov dword [ebp - 0x378], eax
mov byte [ebp - 4], 0xf
test eax, eax
je 0x45335b
lea ecx, [ebp - 0x64]
push ecx
mov ecx, eax
call fcn.004479c5
mov ebx, eax
lea ecx, [ebp - 0x370]
mov dword [edi + 0x40], ebx
call fcn.00447b2e
lea ecx, [ebp - 0x4ac]
call fcn.00441b51
lea ecx, [ebp - 0x64]
call fcn.00447b2e
mov eax, ebx
call fcn.006407f5
ret
Function at 0x4558e4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_GetNativeSystemInfo]
cmp word [ebp - 0x24], 6
je 0x455906
cmp word [ebp - 0x24], 9
je 0x455906
xor al, al
jmp 0x455908
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x45590c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x7a6168]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x61c]
push esi
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
je 0x4559d1
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLongPathNameW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x45596b
sub ecx, edx
sar ecx, 1
cmp ecx, 0xa
jbe 0x4559d1
push ecx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.00665c03
add esp, 0xc
test eax, eax
je 0x4559cd
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4559a3
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.00665c03
add esp, 0xc
test eax, eax
jne 0x4559d1
mov al, 1
jmp 0x4559d3
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.006407be
mov esp, ebp
pop ebp
ret
Function at 0x457f34
Capabilities:
Hash data using sha1

Disassembly:
and dword [ecx + 0x14], 0
and dword [ecx + 0x18], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
ret
Function at 0x45c192
Capabilities:
Initialize winsock library

Disassembly:
push ebp
sub esp, 0x34c
lea ebp, [esp - 4]
mov eax, dword [0x7a6168]
xor eax, ebp
mov dword [ebp + 0x34c], eax
push 0xbc
mov eax, 0x6a0122
call fcn.00640871
mov esi, ecx
lea eax, [ebp + 0x1c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x45c1f1
push 0
push str.WSAStartup_failed
lea ecx, [ebp + 0x2e4]
call fcn.004577b2
push 0x7509e4
lea eax, [ebp + 0x2e4]
push eax
call fcn.006586e4
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0xac], edi
jne 0x45c20b
push edi
mov ecx, esi
call fcn.0045b65c
jmp 0x45c2c0
lea eax, [esi + 0x9c]
cmp dword [eax + 0x14], 8
jb 0x45c219
mov eax, dword [eax]
push 1
push 0x40
push 0x22
push eax
lea ecx, [ebp - 0xc8]
call fcn.0045ae9b
mov eax, dword [ebp - 0xc8]
mov byte [ebp - 4], 1
mov eax, dword [eax + 4]
cmp dword [ebp + eax - 0xbc], 0
je 0x45c291
push str.Cannot_open__
lea ecx, [ebp]
call fcn.00447a60
lea eax, [esi + 0x98]
mov byte [ebp - 4], 2
push eax
mov eax, dword [ebp]
lea ecx, [ebp]
call dword [eax + 0x2c]
mov eax, dword [ebp]
lea ecx, [ebp]
push 0x7440bc
call dword [eax + 0x24]
push edi
lea eax, [ebp]
push eax
lea ecx, [ebp + 0x27c]
call fcn.004576c2
push 0x7509e4
lea eax, [ebp + 0x27c]
jmp 0x45c1eb
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 3
push eax
mov ecx, esi
call fcn.0045b65c
lea ecx, [ebp - 0xc8]
mov dword [ebp - 4], 1
call fcn.0045132c
lea ecx, [ebp - 0xc8]
call fcn.0044cf24
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x34c]
xor ecx, ebp
call fcn.006407be
lea esp, [ebp + 0x350]
pop ebp
ret

Function at 0x45d2f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x6a70c7
call fcn.00640244
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
push dword [ebp + 0xc]
xor edi, edi
mov dword [esi], 0x6cc388
lea ecx, [esi + 0x20]
mov dword [ebp - 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
call fcn.0049bf89
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45d2fe
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x6a70c7
call fcn.00640244
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
push dword [ebp + 0xc]
xor edi, edi
mov dword [esi], 0x6cc388
lea ecx, [esi + 0x20]
mov dword [ebp - 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
call fcn.0049bf89
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45d356
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x6a02db
call fcn.00640244
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi], 0x6cc388
lea ecx, [esi + 0x20]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [ebp - 4], eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
lea eax, [ebp + 0xc]
push eax
mov byte [ebp - 4], 1
call fcn.00521c59
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4600d6
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push esi
mov esi, dword [ebp + 8]
mov eax, esi
shr eax, 0x1f
test al, 1
je 0x4600f0
and dword [0], 0
test esi, esi
jne 0x4600fb
xor eax, eax
jmp 0x46017e
push edi
xor edi, edi
push esi
call fcn.0066890b
pop ecx
test eax, eax
jne 0x46017d
push esi
call fcn.0046ea8d
inc edi
cmp edi, 3
jl 0x4600fe
push 0x40
pop esi
push esi
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0065ab80
add esp, 0xc
mov dword [ebp - 0x68], esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x460143
call esi
mov dword [ebp - 0x64], eax
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
push 0x28
rep stosd dword es:[edi], eax
pop eax
push eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call sub.KERNEL32.DLL_K32GetProcessMemoryInfo
test eax, eax
jne 0x46016d
call esi
mov dword [ebp - 0x24], eax
call esi
mov dword [0x7b0cc8], eax
and dword [0], 0
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46059a
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x69bc4a
call fcn.00640244
sub esp, 0x444
mov eax, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov esi, 0x104
mov dword [ebp - 0x10], edi
test eax, eax
jne 0x4605d1
lea eax, [ebp - 0x450]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea eax, [ebp - 0x450]
lea ecx, [ebp - 0x248]
push ecx
push edi
push 0x6cc3e0
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
test eax, eax
jne 0x46060a
call fcn.00669d90
push eax
call fcn.00669d90
push eax
push str.c:_u_u.tmp
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.00464914
add esp, 0x14
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.00429973
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], edi
test esi, esi
je 0x460687
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x460635
sub ecx, edx
mov eax, 0x103
sar ecx, 1
sub eax, ecx
lea ecx, [ebp - 0x28]
push eax
push edi
lea eax, [ebp - 0x40]
push eax
call fcn.004407ff
push esi
mov byte [ebp - 4], 1
call fcn.00428460
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.004282ce
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
call fcn.00427b6c
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.004281f2
jmp 0x460693
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
call fcn.00427b6c
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.004281f2
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4606fb
Capabilities:
Create directory

Disassembly:
mov eax, 0x6baa5c
call fcn.00640244
sub esp, 0x30
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 8
pop ebx
cmp dword [esi + 0x14], ebx
jb 0x46071a
mov eax, dword [esi]
jmp 0x46071c
mov eax, esi
push 0x5c
push eax
call fcn.0065b08b
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x46074b
cmp dword [esi + 0x14], ebx
jb 0x460735
mov eax, dword [esi]
jmp 0x460737
mov eax, esi
push 0x2f
push eax
call fcn.0065b08b
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4607cd
cmp dword [esi + 0x14], ebx
jb 0x460754
mov eax, dword [esi]
jmp 0x460756
mov eax, esi
sub edi, eax
sar edi, 1
cmp dword [esi + 0x14], ebx
jb 0x460763
mov eax, dword [esi]
jmp 0x460765
mov eax, esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.00429973
xor ecx, ecx
mov dword [ebp - 0x10], 7
xor eax, eax
mov dword [ebp - 4], ecx
push edi
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x3c]
push ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x24]
push eax
call fcn.0042835e
push 1
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
call fcn.004606fb
xor edi, edi
lea ecx, [ebp - 0x24]
push edi
push 1
call fcn.004281f2
push edi
push 1
lea ecx, [ebp - 0x3c]
call fcn.004281f2
cmp byte [ebp + 0xc], 0
je 0x4607cd
cmp dword [esi + 0x14], ebx
jb 0x4607c5
mov esi, dword [esi]
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x460e1e
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, 0x6baa5c
call fcn.00640244
sub esp, 0x280
push ebx
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x3c]
push str._s.
push eax
call fcn.004654e1
add esp, 0xc
mov eax, dword [ebp - 0x3c]
xor ebx, ebx
cmp dword [ebp - 0x28], 8
mov dword [ebp - 4], ebx
jae 0x460e55
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x28c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x460f11
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push 0x6c6dc8
push eax
call fcn.004654e1
add esp, 0x10
test byte [ebp - 0x28c], 0x10
mov byte [ebp - 4], 1
jne 0x460eaa
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x460ea2
lea eax, [ebp - 0x24]
push eax
call fcn.0046fd2f
jmp 0x460ee6
push 0x6cc408
lea eax, [ebp - 0x260]
push eax
call fcn.00555907
test eax, eax
je 0x460ee6
push 0x6cc400
lea eax, [ebp - 0x260]
push eax
call fcn.00555907
test eax, eax
je 0x460ee6
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x460ee0
lea eax, [ebp - 0x24]
push eax
call fcn.00460e1e
push ebx
push 1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.004281f2
lea eax, [ebp - 0x28c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x460e6e
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.004281f2
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x461022
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46103a
test al, 0x10
je 0x46103a
xor eax, eax
inc eax
jmp 0x46103c
xor eax, eax
ret 4

Function at 0x461054
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46106c
test al, 0x10
jne 0x46106c
xor eax, eax
inc eax
jmp 0x46106e
xor eax, eax
ret 4
Function at 0x461131
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x6a057d
call fcn.00640244
sub esp, 0x29c
push ebx
push esi
push edi
push 0x6cc534
lea ecx, [ebp - 0x40]
call fcn.00429973
push 1
lea eax, [ebp - 0x40]
xor edi, edi
push eax
sub esp, 0x18
mov dword [ebp - 4], edi
mov eax, esp
push dword [ebp + 0xc]
push eax
call fcn.00429352
lea eax, [ebp - 0x28]
push eax
call fcn.00460380
push edi
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004281f2
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x46118e
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x2a8]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4611fb
mov bl, byte [ebp + 0x10]
test bl, bl
jne 0x4611b4
cmp word [ebp - 0x27c], 0x2e
je 0x4611e2
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x58]
call fcn.00429973
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 3
call fcn.0043f9f6
push edi
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.004281f2
lea eax, [ebp - 0x2a8]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x4611a6
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.004281f2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x461227
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x6a057d
call fcn.00640244
mov eax, dword [ebp + 0x10]
sub esp, 0x29c
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
jne 0x461248
mov eax, 0x6cc534
push eax
lea ecx, [ebp - 0x40]
call fcn.00429973
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push 1
push eax
sub esp, 0x18
mov eax, esp
push dword [ebp + 0xc]
push eax
call fcn.00429352
lea eax, [ebp - 0x28]
push eax
call fcn.00460380
push 0
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004281f2
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x46128e
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x2a8]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4612a7
xor esi, esi
jmp 0x461302
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00429352
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 3
call fcn.0043f9f6
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.004281f2
lea eax, [ebp - 0x2a8]
inc esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x4612a7
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push esi
push str.Found__d_entries_using_filter__s_in_directory__s
call fcn.0040e2b4
add esp, 0x10
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004281f2
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x461354
Capabilities:
Get common file path

Disassembly:
mov eax, 0x6a059f
call fcn.00640244
sub esp, 0x64
push esi
push edi
xor edi, edi
mov dword [ebp - 0x2c], 7
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x30], edi
mov word [ebp - 0x40], ax
mov dword [ebp - 4], edi
cmp byte [0x7b0cce], al
je 0x461395
push str.downloads
push dword [ebp + 8]
call fcn.00473603
jmp 0x4614a5
push 0x6cc5b8
push 0x6c716c
call fcn.00463d8e
mov dword [ebp - 0x28], 0x374de290
mov dword [ebp - 0x24], 0x4565123f
mov dword [ebp - 0x20], 0xc4396491
mov dword [ebp - 0x1c], 0x7b465e92
test eax, eax
je 0x461431
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x8000
lea ecx, [ebp - 0x28]
push ecx
call eax
test eax, eax
js 0x461431
push dword [ebp - 0x10]
lea ecx, [ebp - 0x58]
call fcn.00429973
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0044087b
push eax
lea ecx, [ebp - 0x40]
call fcn.00427c6d
push edi
push 1
lea ecx, [ebp - 0x70]
call fcn.004281f2
push edi
push 1
lea ecx, [ebp - 0x58]
call fcn.004281f2
push 2
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x461429
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x461499
push 2
push 0x118
call fcn.004600a3
push 1
push 5
mov esi, eax
push esi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x461499
push 0x6cc5d0
lea ecx, [ebp - 0x58]
call fcn.00429973
push 1
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00429973
lea eax, [ebp - 0x70]
push eax
call fcn.00460380
push eax
lea ecx, [ebp - 0x40]
call fcn.00427c6d
push edi
push 1
lea ecx, [ebp - 0x70]
call fcn.004281f2
push edi
push 1
lea ecx, [ebp - 0x58]
call fcn.004281f2
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
call fcn.00427b6c
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.004281f2
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x461515
Capabilities:
Move file

Disassembly:
push 3
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
ret 8

Function at 0x4617d4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x18]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x461817
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x461839
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
test ecx, ecx
je 0x461823
mov dword [ecx], eax
cmp eax, esi
je 0x461837
sub esi, eax
add eax, edi
push esi
push 0
push eax
call fcn.0065ab80
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x461841
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
xor ebx, ebx
call fcn.00460e1e
mov esi, ebx
push ebx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x46187d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x46187f
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc esi
cmp esi, 5
jl 0x461850
jmp 0x46187f
mov bl, 1
pop esi
mov al, bl
pop ebx
ret 4

Function at 0x4618d9
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x50]
push 0x22
pop eax
cmp word [edi], ax
jne 0x4618f6
add edi, 2
push eax
lea eax, [edi + 2]
push eax
jmp 0x4618f9
push 0x20
push edi
call fcn.006592c7
mov esi, eax
xor ebx, ebx
mov ebp, ebx
pop ecx
pop ecx
test esi, esi
je 0x461915
movzx ebp, word [esi]
xor ecx, ecx
mov word [esi], cx
add esi, 2
push edi
call fcn.00461054
test al, al
jne 0x461927
push 2
pop eax
jmp 0x4619b6
push 0x3c
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0065ab80
add esp, 0xc
mov dword [esp + 0x20], edi
xor edi, edi
mov dword [esp + 0x10], 0x3c
lea eax, [esp + 0x10]
mov dword [esp + 0x24], esi
inc edi
mov dword [esp + 0x14], 0x540
push eax
mov dword [esp + 0x30], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, edi
jne 0x4619ac
cmp dword [esp + 0x48], ebx
je 0x4619ac
push 0x493e0
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
jne 0x461997
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
je 0x4619a2
mov ebx, dword [esp + 0x50]
jmp 0x4619a2
mov ecx, 0x102
cmp eax, ecx
jne 0x4619a2
mov ebx, ecx
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
je 0x4619b4
mov word [esi - 2], bp
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 4