joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40889b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 8]
add eax, 0x10
cmp dword [eax], 0
je 0x4088cc
mov ecx, eax
mov ecx, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x4088c2
mov byte [ecx + 0x10c], 1
add eax, 4
cmp dword [eax], 0
mov ecx, eax
jne 0x4088b4
pop ebp
ret 4

Function at 0x408a3b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
add edi, 0x10
cmp dword [edi], ebx
je 0x408a70
mov eax, edi
mov esi, edi
mov eax, dword [eax]
push dword [ebp + 0xc]
add eax, 8
push eax
call fcn.0043b2a0
pop ecx
pop ecx
test eax, eax
jne 0x408ad8
add esi, 4
inc ebx
cmp dword [esi], 0
mov eax, esi
jne 0x408a51
xor ebx, ebx
test ebx, ebx
je 0x408af0
mov eax, dword [edi]
xor edx, edx
test eax, eax
je 0x408a9c
mov ecx, edi
cmp byte [eax + 0x10c], 0
je 0x408a92
cmp byte [eax + 0x10d], 0
je 0x408ae4
add ecx, 4
mov eax, dword [ecx]
inc edx
test eax, eax
jne 0x408a80
xor esi, esi
test esi, esi
je 0x408aca
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [edi], 0
je 0x408aca
mov eax, edi
mov eax, dword [eax]
cmp dword [eax + 4], esi
jne 0x408ac0
mov byte [eax + 0x10c], 0
add edi, 4
cmp dword [edi], 0
mov eax, edi
jne 0x408ab2
push dword [ebp + 8]
mov esi, ebx
call fcn.0040889b
mov al, 1
jmp 0x408af2
mov eax, dword [ebp + 8]
mov eax, dword [eax + ebx*4 + 0x10]
mov ebx, dword [eax + 4]
jmp 0x408a72
mov eax, dword [ebp + 8]
mov eax, dword [eax + edx*4 + 0x10]
mov esi, dword [eax + 4]
jmp 0x408a9e
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x409129
Capabilities:
Create thread

Disassembly:
push dword [esi + 0x74]
mov dword [esi + 0x44], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
push eax
push eax
push esi
push 0x408b4c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x70], eax
ret

Function at 0x40915d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x103]
push ebx
push eax
mov byte [ebp - 0x104], bl
call fcn.0043bbc0
mov eax, dword [ebp + 8]
push 0x454c5c
push 0x45335c
push dword [eax + 0x58]
lea eax, [ebp - 0x104]
push str._s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
push 1
push ebx
push ebx
lea eax, [ebp - 0x104]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebx
leave
ret 4
Function at 0x40933b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24c
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x58]
lea eax, [esp + 8]
push esi
mov ecx, eax
push edi
mov esi, 0x104
sub edx, ecx
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x409374
mov cl, byte [edx + eax]
test cl, cl
je 0x409374
mov byte [eax], cl
inc eax
dec esi
jne 0x40935d
test esi, esi
jne 0x409379
dec eax
push 0x454cc8
lea edi, [esp + 0x14]
mov byte [eax], 0
call fcn.004092ba
lea eax, [esp + 0x118]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x409417
mov ecx, dword [ebx + 0x58]
lea eax, [esp + 0x10]
mov edx, eax
mov esi, 0x104
sub ecx, edx
lea edx, [esi + 0x7ffffefa]
test edx, edx
je 0x4093cb
mov dl, byte [ecx + eax]
test dl, dl
je 0x4093cb
mov byte [eax], dl
inc eax
dec esi
jne 0x4093b4
test esi, esi
jne 0x4093d0
dec eax
push 0x45335c
lea edi, [esp + 0x14]
mov byte [eax], 0
call fcn.004092ba
lea eax, [esp + 0x144]
push eax
call fcn.004092ba
mov eax, edi
push eax
call fcn.0040508a
pop ecx
lea eax, [esp + 0x118]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4093a4
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4095e3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
lea edi, [esi + 0x2c]
mov dword [esp + 0x10], ebx
cmp dword [edi], ebx
je 0x409727
mov dword [esp + 0x14], edi
mov eax, dword [edi]
cmp dword [eax + 8], 3
jne 0x4096eb
mov ecx, dword [esi + 0x28]
mov edx, dword [ecx]
push ebx
push ebx
push ebx
push ebx
push dword [eax]
call dword [edx + 0x54]
mov ecx, dword [esi + 0x28]
push ebx
push 1
push ebx
push ebx
mov byte [esi + 0x66], bl
mov edx, dword [edi]
mov eax, dword [ecx]
push ebx
push ebx
push dword [edx]
call dword [eax + 0x20]
mov ecx, dword [esi + 0x28]
push ebx
push 2
push 0x4091c2
push ebx
push 1
push ebx
call fcn.00427f50
cmp byte [esi + 0x66], bl
jne 0x409727
push 0x103
lea eax, [esp + 0x125]
push ebx
push eax
mov byte [esp + 0x12c], bl
call fcn.0043bbc0
add esp, 0xc
push str.systemcomponents2_
push 0x45335c
push dword [esi + 0x58]
lea eax, [esp + 0x12c]
push str._s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x103
lea eax, [esp + 0x1d]
push ebx
push eax
mov byte [esp + 0x24], bl
call fcn.0043bbc0
add esp, 0xc
push 0x45335c
push dword [esi + 0x58]
lea eax, [esp + 0x20]
push 0x454238
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x134]
push eax
call fcn.0040516f
add esp, 0x18
test eax, eax
je 0x40970f
mov edx, dword [edi]
mov ecx, dword [esi + 0x28]
push dword [edx]
mov eax, dword [ecx]
call dword [eax + 0x5c]
mov eax, esi
call fcn.0040914b
test al, al
jne 0x409727
mov edi, dword [esp + 0x14]
inc dword [esp + 0x10]
add edi, 4
mov dword [esp + 0x14], edi
cmp dword [edi], ebx
jne 0x40960a
jmp 0x409727
push 0xfffffffffffffffd
call fcn.00409242
mov eax, dword [esp + 0x10]
mov eax, dword [esi + eax*4 + 0x2c]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409b50
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
xor ebx, ebx
push ebx
mov edi, 0x80
push edi
push 4
push ebx
push ebx
push 0xc0000000
push dword [ebp + 8]
call esi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x409bc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x409b92
and eax, 0xffff
or eax, 0x80070000
cmp eax, 0x80070005
jne 0x409bba
push dword [ebp + 8]
call fcn.0040508a
pop ecx
push ebx
push edi
push 4
push ebx
push ebx
push 0xc0000000
push dword [ebp + 8]
call esi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x409bc1
xor al, al
jmp 0x409c52
push 0x3f
lea eax, [ebp - 0x47]
push ebx
push eax
mov dword [ebp - 8], ebx
mov byte [ebp - 0x48], bl
call fcn.0043bbc0
add esp, 0xc
push ebx
lea eax, [ebp - 8]
push eax
push 0x18
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x19
mov edi, str.fileset_tlocation_tshared_r
lea esi, [ebp - 0x48]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x409c09
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x409c50
or dword [0x46a4a4], 0x1000
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x409bba
push ebx
lea eax, [ebp - 8]
push eax
push 0x18
push str.fileset_tlocation_tshared_r
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x409ce2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x18]
sub esp, 0x104
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
mov esi, str.location
push esi
push dword [ebp + 0x1c]
call fcn.004149a0
mov edi, eax
cmp edi, ebx
je 0x409d60
push str.cache_
push edi
call fcn.0043b2a0
pop ecx
pop ecx
test eax, eax
jne 0x409d6a
cmp dword [ebp + 0x14], 2
je 0x409d6a
push edi
push 0x45335c
push dword [ebp + 0xc]
push str._s_s_s
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x409d54
shr eax, 4
not eax
and eax, 1
jne 0x409df9
or dword [0x46a4a4], 0x100000
jmp 0x409d6a
or dword [0x46a4a4], 0x1000000
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x409d74
push 0x103
lea eax, [ebp - 0x103]
push ebx
push eax
mov byte [ebp - 0x104], bl
call fcn.0043bbc0
lea edx, [ebp - 0x104]
add esp, 0xc
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x409da3
lea eax, [ebp - 0x104]
push eax
call fcn.0044e008
cmp dword [ebp + 0x14], 2
pop ecx
lea eax, [ebp - 0x104]
jne 0x409dcd
push str.sxs_
jmp 0x409dd2
push str.cache_
push eax
call fcn.0043b2a0
pop ecx
pop ecx
mov ecx, 0x453270
cmp eax, ebx
jne 0x409de5
mov eax, ecx
push 0xffffffffffffffff
push ebx
push ebx
push ebx
push ebx
push ecx
mov ecx, dword [ebp + 0x18]
push eax
push esi
push dword [ebp + 0x1c]
call fcn.00414260
pop edi
pop esi
pop ebx
leave
ret 0x18

Function at 0x409e00
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp + 8]
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x409ed4
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push ebx
push ebx
push ebx
mov esi, eax
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0x20
mov dword [ebp - 8], eax
call fcn.0043b28d
pop ecx
push ebx
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
call fcn.00409283
push 0x20
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push 0x10
push eax
call fcn.00402525
add esp, 0x1c
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x409ebe
cmp cl, bl
je 0x409eba
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x409ebe
add eax, 2
add esi, 2
cmp cl, bl
jne 0x409e9e
xor eax, eax
jmp 0x409ec3
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x409ecb
mov byte [ebp - 1], 1
push dword [ebp + 8]
call fcn.0043b5e1
pop ecx
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40a064
Capabilities:
Create directory
Create shortcut via ishelllink
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
xor ebx, ebx
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.0043bbc0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x18]
mov dword [ebp - 8], ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x40a1ee
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp + 0x18]
push eax
push 0x450bfc
push 1
push ebx
push 0x450d9c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, ebx
jl 0x40a1f1
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push 0x450d0c
push eax
call dword [ecx]
mov esi, eax
cmp esi, ebx
jl 0x40a1dd
mov eax, dword [ebp + 0x18]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp + 0x18]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov ecx, dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], ebx
jne 0x40a146
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
mov edx, dword [eax]
push ebx
push ecx
push eax
call dword [edx + 0x44]
mov esi, eax
cmp esi, ebx
jl 0x40a1d4
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [ebp + 0x14], ebx
je 0x40a16e
push dword [ebp + 0x14]
lea eax, [ebp - 0x210]
push eax
call esi
push edi
push ebx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push eax
call esi
lea edi, [ebp - 0x210]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x40a192
mov eax, dword [ebp - 4]
mov esi, str..lnk
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
lea edx, [ebp - 0x210]
push edx
movsw word es:[edi], word [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
push ebx
mov esi, eax
lea eax, [ebp - 0x210]
push eax
push 0x3001
push 0x2000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop edi
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x40a1f1
mov esi, dword [ebp + 0x1c]
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
Function at 0x40a1f9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x108], bl
call fcn.0043bbc0
push str.icon.ico
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [0x46a494]
push dword [eax + 0xe20]
push dword [eax + 0xe1c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
leave
ret 4

Function at 0x40c8c4
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x40c905
push ebx
movzx edx, byte [ecx]
dec eax
inc ecx
movzx ebx, byte [ecx]
shl ebx, 8
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
test eax, eax
jg 0x40c8de
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x40c923
dec esi
je 0x40c91a
dec esi
jne 0x40c928
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x411680
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x38]
push eax
push esi
xor ebx, ebx
mov byte [ebp - 1], 1
call fcn.0043bd23
add esp, 8
test eax, eax
jne 0x4116ce
push 0x44f80c
push esi
call fcn.0043cc0b
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x4116d8
push esi
push str.ERROR:_Unable_to_open__s_for_reading_n
call fcn.0043ca92
mov eax, dword [ebp + 0x10]
add esp, 8
test eax, eax
je 0x4116ce
mov dword [eax], ebx
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp byte [ebp + 0x18], bl
je 0x41172a
cmp byte [ebp + 0x14], bl
je 0x4116ee
mov ecx, dword [ebp - 0x24]
inc ecx
push ecx
call fcn.0043acd0
jmp 0x4116f8
mov edx, dword [ebp - 0x24]
inc edx
push edx
call fcn.0043ac16
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ecx]
add esp, 4
test eax, eax
je 0x4116ce
mov edx, dword [ebp - 0x24]
mov byte [eax + edx], bl
mov eax, dword [ecx]
test eax, eax
jne 0x411760
push esi
push str.Unable_to_allocate_memory_to_read__s_to_mem
call fcn.0043ca92
add esp, 8
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp byte [ebp + 0x14], bl
je 0x41173a
mov esi, dword [ebp - 0x24]
push esi
call fcn.0043acd0
jmp 0x411746
mov edx, dword [ebp - 0x24]
push edx
call fcn.0043ac16
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
mov dword [ecx], eax
mov eax, dword [edx]
add esp, 4
test eax, eax
jne 0x411763
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov esi, dword [ebp - 0x24]
push edi
mov edi, eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41176f
mov dword [eax], esi
test esi, esi
je 0x4117d8
sub esi, ebx
cmp esi, 0x8000
jbe 0x411782
mov esi, 0x8000
mov eax, dword [ebp - 8]
push eax
push esi
push 1
push edi
call fcn.0043ca75
add esp, 0x10
cmp eax, esi
jne 0x4117a3
mov esi, dword [ebp - 0x24]
add ebx, eax
add edi, eax
cmp ebx, esi
jb 0x411773
jmp 0x4117d8
mov ecx, dword [ebp + 8]
push ecx
push ebx
push esi
push str.Unable_to_read__li_bytes_at_offset__li_from_file__s_n
call fcn.0043ca92
mov esi, dword [ebp + 0xc]
mov edx, dword [esi]
push edx
call fcn.0043ac96
mov eax, dword [ebp + 0x10]
add esp, 0x14
mov dword [esi], 0
test eax, eax
je 0x4117d4
mov dword [eax], 0
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
push eax
call fcn.0043c7b7
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x412a70
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
push ebx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
push eax
mov ebx, ecx
push edi
mov dword [ebp - 8], ebx
call fcn.0043bd23
add esp, 8
test eax, eax
jne 0x412c17
push esi
push 0x200
call fcn.0043acd0
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, esi
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412ab3
sub eax, edx
inc eax
push eax
push edi
mov ecx, ebx
call fcn.00411330
mov dword [ebp - 0x10], eax
lea edi, [eax - 1]
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x412ad0
mov dx, word [0x45335c]
mov word [edi], dx
mov ecx, esi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x412ae4
sub ecx, esi
mov edx, ecx
lea edi, [eax - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x412af2
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x180]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, 0xffffffff
je 0x412c04
mov dword [ebp - 4], 0x200
mov dword [ebp + 0x14], 0x80
cmp byte [ebp + 0x10], 0
je 0x412bab
lea eax, [ebp - 0x154]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412b41
sub eax, edx
mov edx, dword [ebp + 0xc]
inc eax
push eax
push edx
mov ecx, ebx
call fcn.00411330
mov ebx, eax
lea edi, [ebx - 1]
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x412b60
mov ax, word [0x45335c]
mov word [edi], ax
lea eax, [ebp - 0x154]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x412b80
sub eax, ecx
mov esi, ecx
lea edi, [ebx - 1]
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x412b90
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0xc]
jmp 0x412bbd
push 0
lea ecx, [ebp - 0x154]
push ecx
mov ecx, ebx
call fcn.00411330
mov ebx, eax
cmp dword [ebp + 0x14], 2
mov esi, dword [ebp + 8]
jae 0x412be7
mov eax, dword [ebp - 4]
mov edx, dword [esi]
sub dword [ebp + 0x14], 0xffffff80
add eax, 0x200
push eax
push edx
mov dword [ebp - 4], eax
call fcn.0043ad64
add esp, 8
test eax, eax
je 0x412c21
mov dword [esi], eax
mov eax, dword [esi]
lea ecx, [ebp - 0x180]
push ecx
push edi
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ebx, dword [ebp - 8]
test eax, eax
jne 0x412b32
lea edx, [ebp - 0x10]
push edx
mov ecx, ebx
call fcn.00411460
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi]
test eax, eax
je 0x412c30
push eax
call fcn.0043ac96
add esp, 4
mov dword [esi], 0
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4187b0
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x1a0]
push eax
call fcn.0042ef90
mov eax, dword [esi + 0x198]
mov ecx, dword [esi + 0x19c]
mov edx, eax
add esp, 4
or edx, ecx
je 0x4187e9
add eax, 0xffffffff
adc ecx, 0xffffffff
mov dword [esi + 0x198], eax
mov dword [esi + 0x19c], ecx
jmp 0x4187f4
push str.Attempt_to_reduce_CMuppet_ref_count___0_IGNORED
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0x1a0]
push eax
call fcn.0042efb0
mov ecx, dword [esi + 0x120]
push ecx
call fcn.0042ef90
cmp byte [esi + 0x8a], 0
mov edx, dword [esi + 0x120]
push edx
sete bl
call fcn.0042efb0
add esp, 0xc
pop esi
mov al, bl
pop ebx
ret

Function at 0x41a320
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41a336
xor al, al
pop ebp
ret
and al, 0x10
cmp al, 0x10
sete al
pop ebp
ret

Function at 0x41a340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x41a35a
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [eax + 0x20]
push 0
push eax
lea ecx, [ebp - 0x80]
push str.size:__llu__hash:__s
push ecx
call fcn.0043c2fb
lea eax, [ebp - 0x80]
add esp, 0x14
lea edx, [eax + 1]
jmp 0x41a380
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41a380
sub eax, edx
cmp eax, 0x80
jae 0x41a3a7
mov edx, 0x80
sub edx, eax
push edx
lea ecx, [ebp + eax - 0x80]
push 0
push ecx
call fcn.0043bbc0
add esp, 0xc
push esi
push 0x80
lea eax, [ebp - 0x80]
push 1
push eax
call fcn.0043d6c5
add esp, 0x10
cmp eax, 0x80
jne 0x41a351
push esi
call fcn.0043d987
add esp, 4
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41c1e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x100
push esi
push eax
push 0x80
mov esi, ecx
lea ecx, [ebp - 0x80]
push 1
push ecx
call fcn.0043ca75
add esp, 0x10
cmp eax, 0x80
je 0x41c213
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x80]
mov byte [ebp - 1], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c220
sub eax, edx
cmp eax, 0x80
jae 0x41c23f
cmp byte [ebp + eax - 0x80], 0
jne 0x41c20a
inc eax
cmp eax, 0x80
jb 0x41c230
lea edx, [ebp - 0x100]
push edx
push str.size
lea eax, [ebp - 0x80]
push eax
mov ecx, esi
call fcn.00419260
test al, al
je 0x41c20a
lea ecx, [ebp - 0x100]
push edi
push ecx
call fcn.0043b226
add esp, 4
lea edx, [ebp - 0x100]
push edx
mov edi, eax
push str.hash
lea eax, [ebp - 0x80]
push eax
mov ecx, esi
call fcn.00419260
test al, al
je 0x41c29e
lea eax, [ebp - 0x100]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c290
sub eax, edx
cmp eax, 0x20
jb 0x41c2a8
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x24
call fcn.0043ac16
add esp, 4
test eax, eax
je 0x41c2c4
mov dword [eax + 0x20], 0
mov byte [eax], 0
mov edx, eax
jmp 0x41c2c6
xor edx, edx
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x100]
mov ecx, eax
mov dword [esi], edx
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41c2d5
mov edx, dword [esi]
mov dword [edx + 0x20], edi
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8