joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4141ef
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x455fbb
call fcn.00440b01
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x414214
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x414260
call fcn.0041c08e
push eax
lea ecx, [ebp - 0x10]
call fcn.004025b0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00410d31
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402590
mov eax, esi
call fcn.00440bd9
ret 8

Function at 0x418a95
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x418ace
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00418a58
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0040d2e0
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x41a808
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x41a84b
call fcn.004234fb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41a84b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41a866
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0041a3c2
test ebx, ebx
mov esi, eax
je 0x41a864
test edi, edi
je 0x41a864
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x426cda
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x426d20
call fcn.004234fb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x426d20
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x426d63
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x426d4c
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x426d4c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x426d60
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4287d1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.004234fb
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x428808
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.004283f3
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x43e923
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x471920]
jne 0x43e92d
repz ret
jmp fcn.0044516b
Function at 0x44e0ea
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00444ab5
xor ebx, ebx
cmp dword [0x476684], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x44e1bf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x44e12a
xor eax, eax
jmp 0x44e283
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x44e123
push eax
call fcn.00444a52
mov dword [esp], 0x4606f0
push edi
mov dword [0x476684], eax
call esi
push eax
call fcn.00444a52
mov dword [esp], 0x4606dc
push edi
mov dword [0x476688], eax
call esi
push eax
call fcn.00444a52
mov dword [0x47668c], eax
lea eax, [ebp - 8]
push eax
call fcn.0044331a
test eax, eax
pop ecx
pop ecx
je 0x44e18d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043fbb0
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x44e1bf
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00444a52
cmp eax, ebx
pop ecx
mov dword [0x476694], eax
je 0x44e1bf
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00444a52
pop ecx
mov dword [0x476690], eax
mov eax, dword [0x476690]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x44e238
cmp dword [0x476694], esi
je 0x44e238
push eax
call fcn.00444abe
pop ecx
call eax
cmp eax, ebx
je 0x44e205
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x476694]
call fcn.00444abe
pop ecx
call eax
test eax, eax
je 0x44e205
test byte [ebp - 0x18], 1
jne 0x44e238
lea eax, [ebp - 0xc]
push eax
call fcn.00443351
test eax, eax
pop ecx
je 0x44e220
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043fbb0
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x44e22f
or dword [ebp + 0x10], 0x200000
jmp 0x44e269
or dword [ebp + 0x10], 0x40000
jmp 0x44e269
mov eax, dword [0x476688]
cmp eax, esi
je 0x44e269
push eax
call fcn.00444abe
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x44e269
mov eax, dword [0x47668c]
cmp eax, esi
je 0x44e269
push dword [ebp - 4]
push eax
call fcn.00444abe
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x476684]
call fcn.00444abe
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x454d60
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x471920]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00454cf5
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004406c0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x454daf
cmp dword [ebp - 0x1c], 5
jb 0x454dc7
jmp 0x454dc3
cmp dword [ebp - 0x10], 1
jne 0x454dc7
cmp dword [ebp - 0x1c], 4
ja 0x454dc3
jne 0x454dc7
cmp dword [ebp - 0x18], 0
jbe 0x454dc7
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x462010
call fcn.00454bc9
test eax, eax
jge 0x454de8
mov byte [0x476775], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043e923
add ebp, 0x78
leave
ret
Function at 0x4083a3
Capabilities:
Get http content length
Read data from internet
Receive data

Disassembly:
push ebp
nop
mov ebp, esp
nop
mov eax, 0x1008
nop
call fcn.0040c6f9
push ebx
nop
push esi
nop
push edi
nop
sub edi, edi
nop
push edi
nop
lea eax, [ebp - 8]
nop
push eax
nop
lea eax, [ebp - 4]
nop
push eax
nop
push 0x20000005
nop
push dword [ebp + 8]
nop
mov dword [ebp - 8], 4
nop
mov dword [ebp - 4], edi
nop
sub esi, esi
nop
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
or eax, eax
nop
je 0x408401
mov eax, dword [ebp - 4]
nop
inc eax
nop
push eax
nop
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
nop
push eax
pop edi
nop
lea eax, [ebp - 8]
nop
push eax
nop
push 0x1000
nop
lea eax, [ebp - 0x1008]
nop
push eax
nop
push dword [ebp + 8]
nop
call dword [sym.imp.WININET.dll_InternetReadFile]
or eax, eax
nop
je 0x408475
mov ebx, dword [ebp - 8]
nop
lea eax, [esi + ebx]
nop
cmp eax, dword [ebp - 4]
nop
jbe 0x408453
inc eax
nop
push eax
nop
push edi
nop
call dword [sym.imp.msvcrt.dll_realloc]
push eax
pop edi
nop
pop ecx
nop
pop ecx
nop
or edi, edi
nop
je 0x40848f
mov ebx, dword [ebp - 8]
nop
add dword [ebp - 4], ebx
nop
push ebx
nop
lea eax, [ebp - 0x1008]
nop
push eax
nop
lea eax, [edi + esi]
nop
push eax
nop
call sub.msvcrt.dll_memcpy
add esp, 0xc
nop
add esi, ebx
nop
or ebx, ebx
nop
jne 0x408401
or edi, edi
nop
je 0x40848f
cmp esi, dword [ebp - 4]
nop
je 0x40848f
push edi
nop
call dword [sym.imp.msvcrt.dll_free]
pop ecx
nop
sub edi, edi
nop
jmp 0x4084a0
mov eax, dword [ebp + 0xc]
nop
or eax, eax
nop
je 0x40849b
mov dword [eax], esi
nop
mov byte [edi + esi], 0
nop
push edi
pop eax
nop
pop edi
nop
pop esi
nop
pop ebx
nop
leave
nop
ret
Function at 0x408b4e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
nop
mov ebp, esp
nop
mov eax, dword [0x406108]
nop
sub esp, 0x808
nop
lea edx, [eax + 1]
nop
mov cl, byte [eax]
nop
inc eax
nop
test cl, cl
nop
jne 0x408b64
push ebx
nop
push esi
nop
sub eax, edx
nop
inc eax
nop
push edi
nop
push eax
nop
call dword [sym.imp.msvcrt.dll_malloc]
push eax
pop ebx
nop
mov eax, dword [ebp + 8]
nop
pop ecx
nop
mov ecx, dword [0x406060]
nop
mov dword [ebp - 4], ebx
nop
mov dl, byte [eax]
nop
inc eax
nop
mov byte [ecx], dl
nop
inc ecx
nop
test dl, dl
nop
jne 0x408b95
mov ecx, dword [0x406108]
nop
push ebx
pop edx
nop
mov al, byte [ecx]
nop
inc ecx
nop
mov byte [edx], al
nop
inc edx
nop
test al, al
nop
jne 0x408bae
sub ecx, ecx
nop
inc ecx
nop
mov edi, 0x4051c9
nop
push ebx
pop esi
nop
sub eax, eax
nop
repe cmpsb byte [esi], byte es:[edi]
nop
je 0x408bed
push 5
nop
mov edi, str.auto
nop
push ebx
pop esi
nop
pop ecx
nop
sub eax, eax
nop
repe cmpsb byte [esi], byte es:[edi]
nop
jne 0x408d2a
lea eax, [ebp + 8]
nop
push eax
nop
push 1
nop
sub ebx, ebx
nop
push ebx
nop
push str.http_shellopencommand
nop
push 0x80000000
nop
mov dword [ebp - 8], 0x400
nop
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
nop
push eax
nop
lea eax, [ebp - 0x808]
nop
push eax
nop
push ebx
nop
push ebx
nop
push ebx
nop
push dword [ebp + 8]
nop
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
nop
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x808], 0x22
nop
lea eax, [ebp - 0x807]
nop
je 0x408c56
lea eax, [ebp - 0x808]
nop
push eax
nop
lea eax, [ebp - 0x408]
nop
push eax
nop
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x408]
nop
push eax
nop
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [eax - 3]
nop
lea esi, [eax - 4]
nop
or edi, edi
nop
jle 0x408cb1
push 4
nop
lea eax, [ebp + ebx - 0x408]
nop
push str..exe
nop
push eax
nop
call dword [sym.imp.msvcrt.dll__strnicmp]
add esp, 0xc
nop
or eax, eax
nop
je 0x408cae
inc ebx
nop
cmp ebx, edi
nop
jl 0x408c83
jmp 0x408cb1
push ebx
pop esi
nop
lea eax, [ebp - 0x408]
nop
mov byte [ebp + esi - 0x404], 0
nop
mov esi, dword [sym.imp.msvcrt.dll_strstr]
nop
push str.chrome
nop
push eax
nop
call esi
pop ecx
nop
pop ecx
nop
or eax, eax
nop
jne 0x408d24
lea eax, [ebp - 0x408]
nop
push str.Chrome
nop
push eax
nop
call esi
pop ecx
nop
pop ecx
nop
or eax, eax
nop
jne 0x408d24
lea eax, [ebp - 0x408]
nop
push str.CHROME
nop
push eax
nop
call esi
pop ecx
nop
pop ecx
nop
or eax, eax
nop
jne 0x408d24
push dword [ebp - 4]
nop
call dword [sym.imp.msvcrt.dll_free]
pop ecx
nop
lea eax, [ebp - 0x408]
nop
jmp 0x408d2a
mov eax, str.blocked
nop
pop edi
nop
pop esi
nop
pop ebx
nop
leave
nop
ret
Function at 0x40b747
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x48
nop
push ebx
nop
mov ebx, dword [sym.imp.msvcrt.dll_malloc]
nop
push ebp
nop
push esi
nop
push edi
nop
push dword [0x406148]
nop
sub edi, edi
nop
mov dword [esp + 0x20], edi
nop
mov dword [esp + 0x24], edi
nop
call ebx
push dword [0x406148]
nop
push eax
pop esi
nop
mov dword [esp + 0x38], esi
nop
call ebx
push dword [0x406148]
nop
mov dword [esp + 0x48], eax
nop
call ebx
push dword [0x406148]
nop
mov dword [esp + 0x44], eax
nop
call ebx
push dword [0x406148]
nop
mov dword [esp + 0x38], eax
nop
call ebx
push dword [0x406148]
nop
mov dword [esp + 0x2c], eax
nop
Function at 0x402a0a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4140e8]
jne 0x402a14
repz ret
jmp fcn.0040463c

Function at 0x40a2f8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4140e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405451
and dword [ebp - 0x14], 0
cmp dword [0x4165a0], 0
mov dword [ebp - 0x18], eax
jne 0x40a3ab
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40a453
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40a453
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4165a0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4165a4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4165a8], eax
call edi
push eax
call esi
mov dword [0x4165b0], eax
test eax, eax
je 0x40a3ab
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4165ac], eax
mov eax, dword [0x4165ac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40a404
cmp dword [0x4165b0], ecx
je 0x40a404
push eax
call esi
push dword [0x4165b0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40a404
test ebx, ebx
je 0x40a404
call edi
test eax, eax
je 0x40a3fb
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40a3fb
test byte [ebp - 8], 1
jne 0x40a404
or dword [ebp + 0x10], 0x200000
jmp 0x40a437
mov eax, dword [0x4165a4]
cmp eax, dword [ebp - 0x18]
je 0x40a437
push eax
call esi
test eax, eax
je 0x40a437
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40a437
mov eax, dword [0x4165a8]
cmp eax, dword [ebp - 0x18]
je 0x40a437
push eax
call esi
test eax, eax
je 0x40a437
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4165a0]
call esi
test eax, eax
je 0x40a453
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40a455
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402a0a
leave
ret
Function at 0x4064b0
Capabilities:
Copy file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5f0318
push eax
mov eax, dword [0x6875c0]
mov dword fs:[0], esp
sub esp, 8
test eax, eax
je 0x4064ea
push str.CopyFile_1_______
push str.cmdtest
push 0xf
push 0x687554
call fcn.00431af0
add esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x2c]
push edi
mov ecx, esi
call fcn.005e1070
push str._NEW.txt
push str..txt
mov ecx, esi
call fcn.005de050
mov ebp, dword [esp + 0x28]
lea ecx, [esp + 0x14]
push ebp
call fcn.005e0fa7
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0
call fcn.005e0fa7
lea eax, [esp + 0x14]
push 0x6463d8
lea ecx, [esp + 0x34]
mov bl, 1
push eax
push ecx
mov byte [esp + 0x2c], bl
call fcn.005e117c
push edi
lea edx, [esp + 0x30]
push eax
push edx
mov byte [esp + 0x2c], 2
call fcn.005e117c
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 3
call fcn.005e1020
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 2
call fcn.005e0ee7
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], bl
call fcn.005e0ee7
lea eax, [esp + 0x10]
push 0x6463d8
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.005e117c
push esi
lea edx, [esp + 0x30]
push eax
push edx
mov byte [esp + 0x2c], 4
call fcn.005e1116
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 5
call fcn.005e1020
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 4
call fcn.005e0ee7
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], bl
call fcn.005e0ee7
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edi, eax
mov eax, dword [0x6875c0]
test eax, eax
je 0x40662e
mov esi, dword [esi]
lea ecx, [esp + 0x2c]
push esi
call fcn.004668d0
mov eax, dword [eax]
push edi
push eax
push str.CopyFile_1______s___d_
push str.cmdtest
push 0xf
push 0x687554
mov byte [esp + 0x38], 6
call fcn.00431af0
add esp, 0x18
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], bl
call fcn.00467250
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.005e0ee7
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
call fcn.005e0ee7
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40d720
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x18]
mov eax, 0x1f3
not ecx
dec ecx
push edi
mov ebx, ecx
push ebp
sub eax, ebx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x40d760
pop edi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
push esi
mov esi, 1
test byte [edi], 0x10
je 0x40d84c
mov al, byte [edi + 0x2c]
lea edx, [edi + 0x2c]
cmp al, 0x2e
jne 0x40d793
mov al, byte [edi + 0x2d]
cmp al, 0x2e
jne 0x40d78b
mov cl, byte [edi + 0x2e]
test cl, cl
je 0x40d821
test al, al
je 0x40d821
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
cmp eax, ecx
jb 0x40d81d
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov byte [ebx + ebp - 1], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x64c744
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x24]
mov ecx, edx
mov edx, dword [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edx
push ebp
call fcn.0040d720
mov byte [ebx + ebp - 1], 0x2a
add esp, 0x10
mov esi, eax
mov byte [ebx + ebp], 0
mov edi, dword [esp + 0x1c]
test esi, esi
je 0x40d839
mov edx, dword [esp + 0x18]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40d766
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x24]
lea ecx, [edi + 0x2c]
push eax
push ecx
push ebp
mov byte [ebx + ebp - 1], 0
call dword [esp + 0x2c]
mov esi, eax
mov byte [ebx + ebp - 1], 0x2a
jmp 0x40d821
Function at 0x40e7f0
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Move file
Set file attributes

Disassembly:
sub esp, 0x664
push ebp
push esi
mov esi, dword [esp + 0x670]
xor ebp, ebp
cmp esi, ebp
je 0x40ea1f
push esi
call fcn.0044cf30
add esp, 4
test eax, eax
je 0x40ea1f
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x18]
push ebp
push eax
push esi
mov dword [esp + 0x24], ebp
call fcn.0040b290
add esp, 0x1c
test eax, eax
je 0x40ea1f
mov eax, dword [esp + 8]
cmp eax, 0xffffffff
je 0x40ea1f
test al, 1
je 0x40e85c
and al, 0xfe
push eax
push esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 8]
test al, 0x10
je 0x40e9f8
test ah, 4
je 0x40e882
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40e882
pop esi
mov eax, 1
pop ebp
add esp, 0x664
ret
push ebx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x46e]
mov word [esp + 0x46c], bp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x46c]
push esi
push ecx
stosw word es:[edi], ax
call fcn.0044cece
lea edx, [esp + 0x474]
push 0x64c748
push edx
call fcn.0044cea4
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ebp
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x46c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40e9cf
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea edx, [esp + 0x40]
push 0x64b608
push edx
call ebp
test eax, eax
je 0x40e9b2
lea eax, [esp + 0x40]
push 0x64b604
push eax
call ebp
test eax, eax
je 0x40e9b2
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x266]
mov word [esp + 0x264], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x264]
push esi
push ecx
stosw word es:[edi], ax
call fcn.0044cece
lea edx, [esp + 0x26c]
push 0x6464a8
push edx
call fcn.0044cea4
lea eax, [esp + 0x50]
lea ecx, [esp + 0x274]
push eax
push ecx
call fcn.0044cea4
mov eax, dword [esp + 0x2c]
add esp, 0x18
test ah, 4
je 0x40e99a
mov eax, dword [esp + 0x38]
test eax, 0x20000000
jne 0x40e98a
cmp eax, reloc.OLEAUT32.dll_DispGetParam
jne 0x40e99a
lea edx, [esp + 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x40e9b2
mov eax, dword [esp + 0x67c]
lea ecx, [esp + 0x264]
push eax
push ecx
call fcn.0040e7f0
add esp, 8
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40e8f6
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor ebp, ebp
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
cmp eax, ebp
pop ebx
jne 0x40ea21
cmp dword [esp + 0x674], ebp
je 0x40ea21
push 4
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop esi
pop ebp
add esp, 0x664
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, ebp
jne 0x40ea21
cmp dword [esp + 0x674], ebp
je 0x40ea21
push 4
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop esi
pop ebp
add esp, 0x664
ret
xor eax, eax
pop esi
pop ebp
add esp, 0x664
ret