joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419620
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
cmp ebx, edi
je 0x4197ba
mov ecx, dword [ebp + 8]
cmp ecx, edi
jl 0x4197ba
mov eax, dword [esi + 0x31f70]
cmp ecx, eax
jg 0x4197ba
mov byte [ebp - 1], 0
mov dword [ebp - 8], edi
cmp eax, edi
jle 0x4197ba
jmp 0x419663
mov ecx, dword [ebp + 8]
cmp edi, 5
ja case.default.0x419668
jmp dword [edi*4 + 0x4197c4]
mov al, byte [ebx]
mov byte [ebp - 1], al
jmp case.default.0x419668
mov dl, byte [ebx + 1]
jmp 0x419693
mov al, byte [ebx + 2]
mov byte [ebp - 1], al
jmp case.default.0x419668
mov dl, byte [ebx + 3]
jmp 0x419693
mov al, byte [ebx + 4]
mov byte [ebp - 1], al
jmp case.default.0x419668
mov dl, byte [ebx + 5]
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x419752
mov edx, dword [esi + 0x3345c]
mov eax, edi
imul eax, eax, 0x2ac
lea ebx, [eax + esi + 0x31fc8]
mov eax, dword [esi + ecx*4 + 0x33428]
imul eax, dword [ebp - 8]
add eax, dword [esi + ecx*4 + 0x33440]
push 0
push edx
push eax
mov ecx, ebx
call fcn.00511070
mov edx, dword [esi + 0x33478]
mov eax, dword [ebp + 8]
push 0
push edx
mov edx, dword [esi + eax*4 + 0x33428]
imul edx, dword [ebp - 8]
add edx, dword [esi + eax*4 + 0x3345c]
lea ecx, [edi + edi*8]
add ecx, ecx
lea ecx, [esi + ecx*8 + 0x32fd0]
push edx
mov dword [ebp - 0xc], ecx
call fcn.00511070
mov eax, dword [ebx + 4]
test eax, eax
je 0x419717
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x419723
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], 6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 4]
test eax, eax
je 0x41973e
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
inc dword [ebp - 8]
mov ebx, dword [ebp + 0xc]
jmp 0x4197ad
mov edx, dword [ecx]
mov eax, dword [edx + 4]
inc dword [ebp - 8]
mov ebx, dword [ebp + 0xc]
mov dword [ecx + eax], 6
jmp 0x4197ad
mov ecx, edi
imul ecx, ecx, 0x2ac
lea eax, [ecx + esi + 0x31fc8]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x419773
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41977f
mov edx, dword [eax]
mov ecx, dword [edx + 4]
mov dword [eax + ecx], 6
lea edx, [edi + edi*8]
add edx, edx
mov ecx, dword [esi + edx*8 + 0x32fd4]
lea eax, [esi + edx*8 + 0x32fd0]
test ecx, ecx
je 0x4197a1
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4197ad
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov dword [eax + edx], 6
inc edi
cmp edi, dword [esi + 0x31f70]
jl 0x419660
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x425c80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x530068
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ecx + 0x74]
push esi
or edi, 0xffffffff
call fcn.00438550
test al, al
je 0x425cdf
xor eax, eax
cmp dword [esi + 0x68], eax
jle 0x425cdd
mov eax, dword [esi + 0x64]
test eax, eax
jne 0x425cca
mov eax, 0x538640
push eax
push 0xffffffffffffffff
push str.DataFolderCsidl
push str.CcDataFolderDefault
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
mov dword [ebx], edi
call fcn.00438290
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004fce50
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x425d14
push eax
call fcn.005134a7
add esp, 4
cmp dword [ebx], 0
jl 0x425d34
cmp dword [esi + 4], 0
jle 0x425d34
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x425d50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53003b
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
lea esi, [ecx + 0x74]
mov dword [ebp - 4], ebx
push esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], esi
call fcn.00438550
cmp al, bl
je 0x425f2e
xor eax, eax
cmp dword [esi + 0x68], ebx
jle 0x425dcc
mov esi, dword [esi + 0x64]
cmp esi, ebx
jne 0x425db9
mov esi, 0x538640
push esi
push 0xffffffffffffffff
push str.DataFolderCsidl
push str.CcDataFolderDefault
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, ebx
jl 0x425f2e
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x54], ebx
mov ecx, eax
lea esi, [ebp - 0x20]
lea ebx, [ebp - 0x54]
mov dword [ebp - 4], 1
call fcn.004fd370
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.004fce50
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x425e25
push eax
call fcn.005134a7
add esp, 4
cmp dword [edi + 4], 0
jle 0x425f21
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
call fcn.00438290
mov bl, 3
mov byte [ebp - 4], bl
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5388e8
call esi
push 0x5388e8
call fcn.004fcc10
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
push ecx
call fcn.004fcc10
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x425f0d
cmp word [eax], 0
je 0x425f0d
push eax
lea eax, [ebp - 0x20]
call fcn.004fcf00
mov ecx, 0x539f20
lea eax, [ebp - 0x20]
call fcn.00425b20
test al, al
je 0x425e99
mov ecx, str.ScanOcrFolderName
jmp 0x425ecc
mov ecx, str.Email
lea eax, [ebp - 0x20]
call fcn.00425b20
test al, al
je 0x425eb1
mov ecx, str.ScanMailFolderName
jmp 0x425ecc
mov ecx, str.SharePoint
lea eax, [ebp - 0x20]
call fcn.00425b20
mov ecx, str.ScanMossFolderName
test al, al
jne 0x425ecc
mov ecx, str.ScanImgFolderName
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x2c]
push edx
push eax
call fcn.00438330
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.004fce50
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.004fc190
push 0x5388e8
call esi
push 0x5388e8
call fcn.004fcc10
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
push ecx
call fcn.004fcc10
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x425f21
push eax
call fcn.005134a7
add esp, 4
lea edx, [ebp - 0x54]
push edx
mov byte [ebp - 4], 0
call fcn.004fd2d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42f2a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
mov eax, dword [0x559024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
push edi
xor al, al
mov edi, ecx
mov dword [ebp - 0x488], edi
mov dword [ebp - 0x48c], esi
mov byte [ebp - 0x481], al
test esi, esi
je 0x42f3fd
cmp word [esi], 0
je 0x42f3fd
test ebx, ebx
je 0x42f3fd
mov eax, esi
call fcn.0042f560
cmp eax, 0x474
jne 0x42f417
mov eax, esi
mov esi, edi
call fcn.00440da0
test al, al
je 0x42f417
mov ecx, 0x474
lea eax, [ebp - 0x480]
lea esp, [esp]
mov byte [eax], 0
inc eax
dec ecx
jne 0x42f320
mov esi, 0x474
lea edx, [ebp - 0x480]
call fcn.00440e20
cmp eax, esi
jne 0x42f3c6
mov ax, word [ebp - 0x42c]
mov edx, dword [ebp - 0x424]
lea edi, [ebx + 0x38]
mov ecx, 7
lea esi, [ebp - 0x448]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x428]
mov dword [ebx + 0x68], ecx
lea edi, [ebx + 0x70]
mov ecx, 0x104
lea esi, [ebp - 0x420]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov word [ebx + 0x54], ax
lea eax, [ebx + 4]
lea esi, [ebp - 0x47c]
mov dword [ebx + 0x6c], edx
mov edx, 0x19
sub esi, eax
mov edi, edi
lea ecx, [edx + 0x7fffffe5]
test ecx, ecx
je 0x42f3b6
movzx ecx, word [esi + eax]
test cx, cx
je 0x42f3b6
mov word [eax], cx
add eax, 2
dec edx
jne 0x42f390
sub eax, 2
mov word [eax], dx
mov bl, 1
jmp 0x42f3cc
test edx, edx
jne 0x42f3bd
sub eax, 2
xor edx, edx
mov word [eax], dx
mov bl, 1
jmp 0x42f3cc
mov bl, byte [ebp - 0x481]
mov esi, dword [ebp - 0x488]
call fcn.00440e00
test bl, bl
je 0x42f3e8
mov eax, dword [ebp - 0x48c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret 4
mov dword [edi + 0xc], 0x57
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x481]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00513498
mov esp, ebp
pop ebp
ret 4
Function at 0x42f430
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x559024]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor al, al
mov edi, edx
mov dword [ebp - 0x444], edi
mov dword [ebp - 0x440], ecx
mov byte [ebp - 0x439], al
test ebx, ebx
je 0x42f528
cmp word [ebx], 0
je 0x42f528
test ecx, ecx
je 0x42f528
mov eax, ebx
mov ecx, edi
call fcn.0042f560
cmp eax, 0x434
jne 0x42f53e
push esi
mov eax, ebx
mov esi, edi
call fcn.00440da0
test al, al
je 0x42f512
mov ecx, 0x434
lea eax, [ebp - 0x438]
mov byte [eax], 0
inc eax
dec ecx
jne 0x42f4a1
mov esi, 0x434
lea edx, [ebp - 0x438]
call fcn.00440e20
cmp eax, esi
jne 0x42f4f6
mov eax, dword [ebp - 0x440]
lea edi, [eax + 4]
mov ecx, 7
lea esi, [ebp - 0x434]
rep movsd dword es:[edi], dword [esi]
mov cx, word [ebp - 0x418]
mov word [eax + 0x20], cx
lea edi, [eax + 0x34]
mov ecx, 0x104
lea esi, [ebp - 0x416]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov byte [ebp - 0x439], 1
mov esi, dword [ebp - 0x444]
call fcn.00440e00
mov al, byte [ebp - 0x439]
test al, al
je 0x42f518
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [ebp - 0x439]
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret
mov dword [edi + 0xc], 0x57
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x439]
xor ecx, ebp
pop edi
call fcn.00513498
mov esp, ebp
pop ebp
ret
Function at 0x432fb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebx
xor bl, bl
cmp dword [ebp + 8], 0x101
push edi
sete al
lea edi, [eax + 0x8369]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff7
cmp eax, 0x6a
ja case.default.0x432fdc
movzx ecx, byte [eax + 0x43306c]
push esi
jmp dword [ecx*4 + 0x43304c]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, 0
test al, 0x80
setne dl
lea esi, [edx + 1]
jmp 0x433027
mov esi, 4
jmp 0x433027
mov esi, 3
jmp 0x433027
mov esi, 2
jmp 0x433027
mov esi, 1
jmp 0x433027
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns case.0x432fdc.16
mov esi, 5
xor bl, bl
call fcn.00507e10
test eax, eax
je case.0x432fdc.16
mov ecx, dword [ebp + 0x10]
push ecx
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov bl, 1
pop esi
pop edi
mov al, bl
pop ebx
pop ebp
ret 0xc
Function at 0x436c30
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d926
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x559024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, edx
xor al, al
mov dword [ebp - 0x264], esi
test ebx, ebx
je 0x436da8
cmp word [ebx], 0
je 0x436da8
push ecx
lea eax, [ebp - 0x270]
push eax
push esi
call fcn.004372d0
add esi, 0x58
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004fce50
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x436cb6
push eax
call fcn.005134a7
add esp, 4
push 0x5388e8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5388e8
mov edi, esi
call fcn.004fcc10
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call fcn.004fcc10
mov ebx, dword [ebp - 0x264]
cmp dword [ebx + 0x68], 0
lea edi, [ebx + 0x64]
jle 0x436d01
mov ecx, dword [edi + 8]
mov edx, dword [edi]
push ecx
push 0
push edx
call fcn.00517440
add esp, 0xc
mov dword [edi + 4], 0
mov eax, dword [esi]
test eax, eax
jne 0x436d0c
mov eax, 0x538640
lea ecx, [ebp - 0x260]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x436da4
mov edx, dword [ebp + 0xc]
push edx
mov ecx, ebx
call fcn.00437540
test al, al
jne 0x436db1
mov ecx, 0x2e
call fcn.004fc9e0
lea ecx, [ebp - 0x27c]
push ecx
lea edx, [eax + 1]
mov ecx, esi
call fcn.004fc4b0
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.004fce50
lea ecx, [ebp - 0x27c]
mov dword [ebp - 4], 0xffffffff
call fcn.004fc190
push 0x53a544
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x53a544
call fcn.004fcc10
mov edi, dword [edi]
test edi, edi
jne 0x436d8d
mov edi, 0x538640
mov esi, dword [esi]
mov eax, esi
test esi, esi
jne 0x436d9a
mov eax, 0x538640
push 1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov al, 1
jmp 0x436db3
mov dword [esi + 0x70], 0x57
jmp 0x436db3
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret 8
Function at 0x4373f0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x533a18
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x40]
add edi, 0x40
test esi, esi
je 0x437482
cmp word [esi], 0
je 0x437482
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x437477
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x43748b
mov dword [ebp - 0x10], 2
mov eax, dword [edi]
test eax, eax
jne 0x43745a
mov eax, 0x538640
xor bl, bl
test eax, eax
je 0x43749a
cmp word [eax], 0
je 0x43749a
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x43748f
mov bl, 1
jmp 0x4374a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x43744f
mov dword [ebp - 0x10], 0x57
jmp 0x43744f
mov bl, 1
jmp 0x4374a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x4374a1
mov dword [ebp - 0x10], 0x57
test bl, bl
je 0x437517
mov eax, dword [ebp + 8]
cmp dword [eax + 0x50], 0
jle 0x437513
push edi
lea ecx, [ebp - 0x1c]
call fcn.004fc120
push 0x5388e8
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5388e8
lea edi, [ebp - 0x1c]
call fcn.004fcc10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x4c]
mov eax, dword [eax + 0x50]
push ecx
call fcn.004fcc10
mov esi, dword [ebp - 0x1c]
mov eax, esi
test esi, esi
jne 0x4374f3
mov eax, 0x538640
push eax
lea edx, [ebp - 0x10]
push edx
call fcn.004415d0
mov bl, al
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x437513
push esi
call fcn.005134a7
add esp, 4
test bl, bl
jne 0x437520
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x70], eax
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x437540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x58]
sub esp, 8
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
jne 0x437556
mov eax, 0x538640
lea esi, [ecx + 0x34]
call fcn.00440da0
test al, al
je 0x4375b5
mov eax, dword [esi + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp eax, 0xffffffff
je 0x4375bf
push ebx
lea ecx, [ebp - 4]
push ecx
push 4
lea edx, [ebp - 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43758f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
cmp dword [ebp - 4], 4
jne 0x43759f
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x43759f
mov bl, 1
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x4375b5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [esi + 4], 0xc
jmp 0x43759f
Function at 0x438550
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528b58
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ebp - 0x18]
xor bl, bl
call fcn.00437aa0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
jle 0x438637
mov esi, dword [ebp - 0x18]
test esi, esi
jne 0x4385a1
mov esi, 0x538640
test esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x4385c9
cmp word [esi], 0
je 0x4385c9
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4385c7
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4385c9
jmp 0x4385f8
call edi
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4385d5
mov eax, 0x538640
xor bl, bl
test eax, eax
je 0x4385f4
cmp word [eax], 0
je 0x4385f4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4385f2
mov bl, 1
jmp 0x4385f4
call edi
test bl, bl
je 0x438637
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x438604
mov eax, 0x538640
xor cl, cl
test eax, eax
je 0x438635
cmp word [eax], 0
je 0x438635
mov edi, dword [ebp + 8]
add edi, 0x64
push eax
mov eax, edi
call fcn.004fcf00
push 0x5c
mov esi, edi
call fcn.004fccc0
mov esi, str.CcComDef.dat
mov eax, edi
call fcn.004fcfb0
mov cl, 1
mov bl, cl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x43864e
push eax
call fcn.005134a7
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43ccc0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x559024]
xor eax, ebp
mov dword [ebp - 4], eax
xor al, al
push esi
mov esi, edx
mov dword [ebp - 0x28], ecx
test ecx, ecx
je 0x43cd51
push ebx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add esi, 0x10
mov word [ebp - 0x24], ax
mov eax, dword [esi + 4]
xor edi, edi
test eax, eax
je 0x43cd1a
push 0x10
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
test edi, edi
jg 0x43cd1a
mov edx, dword [esi]
mov ebx, dword [edx + 4]
add ebx, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov bl, 1
test edi, edi
jg 0x43cd2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43cd2c
xor bl, bl
test bl, bl
je 0x43cd4d
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
call fcn.0043cd60
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00513498
mov esp, ebp
pop ebp
ret
Function at 0x43de20
Capabilities:
Delete file
Enumerate files on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52d6c2
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x559024]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, esp
push eax
lea eax, [esp + 0x2a8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2b0], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
add eax, 0x2c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2b0], 2
call fcn.004fce50
push 0x5388e8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5388e8
lea edi, [esp + 0x20]
call fcn.004fcc10
push 0x53a76c
mov eax, edi
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.004fd0a0
push 0x53a770
push eax
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x2c8], 3
call fcn.004fd0a0
add esp, 0x18
lea ecx, [esp + 0x28]
mov byte [esp + 0x2b0], 4
call fcn.004fce50
mov byte [esp + 0x2b0], 3
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x43df22
push eax
call fcn.005134a7
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov byte [esp + 0x2b0], 2
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x43df3b
push eax
call fcn.005134a7
add esp, 4
mov eax, dword [esp + 0x28]
cmp eax, ebx
jne 0x43df48
mov eax, 0x538640
lea ecx, [esp + 0x4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x43dfe2
nop
cmp word [esp + 0x78], 0x2e
je 0x43dfcb
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.004fd0a0
add esp, 0xc
lea ecx, [esp + 0x34]
mov byte [esp + 0x2b0], 5
call fcn.004fce50
mov byte [esp + 0x2b0], 2
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x43dfb5
push eax
call fcn.005134a7
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov esi, dword [esp + 0x34]
mov eax, esi
cmp esi, ebx
jne 0x43dfc4
mov eax, 0x538640
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x4c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43df60
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x43dffb
push eax
call fcn.005134a7
add esp, 4
mov byte [esp + 0x2b0], bl
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x43e013
push eax
call fcn.005134a7
add esp, 4
mov dword [esp + 0x2b0], 0xffffffff
cmp esi, ebx
je 0x43e02b
push esi
call fcn.005134a7
add esp, 4
mov ecx, dword [esp + 0x2a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x290]
xor ecx, esp
call fcn.00513498
mov esp, ebp
pop ebp
ret 4
Function at 0x43ef10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d530
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
xor ebx, ebx
cmp dword [esi + 4], ebx
jle 0x43efea
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.0043e900
mov dword [ebp - 4], ebx
mov eax, dword [esi]
cmp eax, ebx
jne 0x43ef5f
mov eax, 0x538640
cmp dword [ebp - 0x20], ebx
jle 0x43ef73
mov ecx, dword [ebp - 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x43efd3
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea eax, [edi + 0x2c]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004fce50
push 0x5388e8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5388e8
lea edi, [ebp - 0x18]
call fcn.004fcc10
mov eax, dword [esi]
push eax
mov eax, dword [esi + 4]
call fcn.004fcc10
mov esi, dword [ebp - 0x18]
mov eax, esi
cmp esi, ebx
jne 0x43efbc
mov eax, 0x538640
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x43efd3
push esi
call fcn.005134a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x43efea
push eax
call fcn.005134a7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret