joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cc00
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov eax, 0x301c
push esi
push ebx
call fcn.005e3260
sub esp, eax
mov eax, dword [ecx + 0x138]
add eax, dword [ecx + 0x828]
lea ebx, [esp + 0x1010]
mov esi, ecx
mov byte [esp + 0x10], 0
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscpy
mov eax, dword [esp + 0x3030]
mov edi, dword [eax + 0x14]
add edi, dword [esi + 0x828]
mov dword [esp], ebx
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax*2 - 8]
mov dword [esp + 4], str.system32CatRootF750E6C3_38EE_11D1_85E5_00C04FC295EE_ws
mov dword [esp + 8], edi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax*2 - 6]
mov dword [esp + 4], 0x72f654
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], 0x72f3b2
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__wfopen]
test eax, eax
je 0x40cd2e
mov ebx, eax
mov dword [esp + 0xc], 2
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call fcn.005e9f50
mov dword [esp], ebx
call fcn.005e9c30
mov dword [esp + 0xc], 0
mov ebp, eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
call fcn.005e9f50
mov dword [esp], ebp
call fcn.006fec20
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov edi, eax
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
lea eax, [esp + 0x10]
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.004128f0
mov dword [esp], edi
call fcn.006febd0
xor eax, eax
cmp byte [esp + 0x10], 0
je 0x40cd4c
lea eax, [esp + 0x10]
lea ecx, [esi + 0x80c]
mov dword [esp], eax
call fcn.00402a70
sub esp, 4
add esp, 0x301c
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x413b30
Capabilities:
Read file on windows

Disassembly:
push ebx
mov eax, 0x2028
call fcn.005e3260
sub esp, eax
mov eax, dword [ecx + 0xc]
lea ebx, [esp + 0x20]
mov dword [esp + 4], 0x730284
mov dword [esp + 8], ebx
mov eax, dword [eax]
mov dword [esp], eax
call fcn.00413980
sub esp, 0xc
mov dword [esp + 4], 0x73028c
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__wfopen]
test eax, eax
je 0x413bd1
mov ebx, eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0x19]
mov dword [esp + 8], 1
mov dword [esp + 4], 3
mov dword [esp], eax
call sub.msvcrt.dll_fread
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
cmp word [esp + 0x19], 0x4453
mov edx, dword [esp + 0x1c]
je 0x413be0
cmp edx, 0x204
je 0x413c00
xor eax, eax
add esp, 0x2028
pop ebx
ret
cmp byte [esp + 0x1b], 0x57
jne 0x413bc9
cmp edx, 0x205
mov eax, 1
jne 0x413bc9
jmp 0x413bd3
add esp, 0x2028
mov eax, 1
pop ebx
ret
Function at 0x417fc0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov eax, 0x243c
mov ebp, esp
push edi
push esi
push ebx
call fcn.005e3260
sub esp, eax
lea eax, [ebp - 0x236a]
mov ebx, ecx
xor ecx, ecx
mov dword [ebp - 0x2378], 0
mov dword [ebp - 0x2370], pe_nt_image_headers32
mov dword [ebp - 0x2374], eax
mov eax, dword [ebx]
mov dword [esp + 4], str._s_.
mov byte [ebp - 0x236c], 0
mov dword [ebp - method.Pg.virtual_0], vtable.Pg.0
mov word [ebp - 0x236a], cx
mov dword [esp + 8], eax
lea eax, [ebp - 0x237c]
mov dword [esp], eax
call fcn.00403a60
lea eax, [ebp - 0x2268]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2374]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea edi, [ebp - 0x223c]
lea esi, [ebp - 0x2018]
sub esp, 8
mov dword [ebp - 0x242c], eax
nop
lea esi, [esi]
lea eax, [ebp - 0x2268]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x242c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
sub esp, 8
test eax, eax
je 0x418183
mov dword [esp + 8], edi
mov dword [esp + 4], 0x730732
mov dword [esp], esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], edi
call sub.msvcrt.dll_wcslen
lea eax, [esi + eax*2 - 6]
mov dword [esp + 4], 0x73073a
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
lea eax, [ebp - 0x237c]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x730740
mov dword [esp], eax
call fcn.00403a60
mov eax, dword [ebp - 0x2374]
mov edx, 0x44
mov ecx, 0x869458
mov word [eax + 0x10], dx
mov dword [esp], eax
call fcn.00441540
sub esp, 4
test al, al
jne 0x418160
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
lea ecx, [ebp - 0x241c]
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call fcn.00414db0
sub esp, 0xc
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebx + 0x10]
je 0x4181c0
test ecx, ecx
je 0x418132
lea eax, [ebp - 0x241c]
mov dword [esp], eax
call fcn.005f8460
mov ecx, dword [ebx + 0xc]
sub esp, 4
add ecx, 0xa0
mov dword [ebx + 0xc], ecx
lea ecx, [ebp - 0x241c]
call fcn.005f8a40
mov eax, dword [ebx + 0xc]
lea ecx, [eax - 0xa0]
call fcn.00416d90
jmp 0x418060
mov eax, dword [ebp - 0x2374]
mov dword [esp + 4], str.Skip__S_n
mov dword [esp], 0x849160
mov dword [esp + 8], eax
call fcn.0041f830
jmp 0x418060
mov eax, dword [ebp - 0x242c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x2378]
sub esp, 4
mov dword [ebp - method.nInst.virtual_0], vtable.nInst.0
test eax, eax
je 0x4181b1
mov dword [esp], eax
call fcn.006febd0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebx + 8]
lea edx, [ebp - 0x241c]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov ecx, eax
call fcn.006b1ec0
sub esp, 8
jmp 0x41813b
Function at 0x41d190
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
push edi
mov eax, 0x227c
push esi
push ebx
call fcn.005e3260
sub esp, eax
mov ebx, dword [esp + 0x2290]
jmp 0x41d1c3
mov dword [esp], ebx
mov dword [esp + 4], 0x5c
call sub.msvcrt.dll_wcschr
lea ebx, [eax + 2]
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
call sub.msvcrt.dll_wcschr
test eax, eax
jne 0x41d1b0
mov eax, dword [esp + 0x2290]
lea edi, [esp + 0x270]
lea esi, [esp + 0x20]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscpy
sub ebx, dword [esp + 0x2290]
mov dword [esp + 4], str..inF
lea eax, [edi + ebx]
mov dword [esp], eax
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
sub esp, 8
cmp eax, 0xffffffff
mov ebx, eax
je 0x41d2a3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x41d242
mov dword [esp + 4], esi
mov dword [esp], ebx
call ebp
sub esp, 8
test eax, eax
je 0x41d2a3
test byte [esp + 0x20], 0x10
jne 0x41d232
lea eax, [esp + 0x4c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
lea eax, [esp + 0x4c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2290]
mov dword [esp], eax
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
je 0x41d2b0
mov dword [esp + 8], edi
mov dword [esp + 4], str.keeping___S_n
mov dword [esp], 0x849160
call fcn.0041f5d0
mov dword [esp + 4], esi
mov dword [esp], ebx
call ebp
sub esp, 8
test eax, eax
jne 0x41d242
add esp, 0x227c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], str.deleting__S___d__n
mov dword [esp], 0x849160
call fcn.0041f5d0
jmp 0x41d232

Function at 0x41ee20
Capabilities:
Get hostname

Disassembly:
push edi
push esi
mov eax, 0x2040
push ebx
call fcn.005e3260
sub esp, eax
mov edi, ecx
lea eax, [esp + 0x3c]
lea esi, [esp + 0x40]
mov dword [esp + 0x3c], 0x1000
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
sub esp, 8
lea ebx, [esp + 0x38]
mov dword [esp], ebx
call sub.msvcrt.dll_time
mov dword [esp], ebx
call sub.msvcrt.dll_localtime
test byte [0x8671a1], 0x20
je 0x41ee80
xor eax, eax
mov word [edi], ax
add esp, 0x2040
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x20], esi
mov edx, dword [eax]
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x10], edx
mov ecx, dword [eax + 0x10]
lea edx, [ecx + 1]
mov dword [esp + 0xc], edx
mov eax, dword [eax + 0x14]
mov dword [esp], edi
mov dword [esp + 4], str._4d__02d__02d___02d__02d__02d___s_
add eax, 0x76c
mov dword [esp + 8], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x2040
pop ebx
pop esi
pop edi
ret
Function at 0x41f0a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x11a]
push ebx
sub esp, 0x14c
mov dword [ebp - 0x124], eax
xor eax, eax
test byte [0x8671a1], 8
mov esi, dword [ebp + 8]
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x120], pe_nt_image_headers32
mov byte [ebp - 0x11c], 0
mov dword [ebp - method.Pg.virtual_0], vtable.Pg.0
mov word [ebp - 0x11a], ax
je 0x41f100
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov ebx, ecx
mov dword [esp + 4], 0x734d14
mov dword [esp], 0
call sub.msvcrt.dll_setlocale
mov ecx, ebx
call fcn.0041ee20
lea edi, [ebp - 0x12c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], str._s_slog.txt
mov dword [esp], edi
call fcn.00403a60
mov dword [esp], esi
mov ecx, 0x869458
call fcn.004420d0
sub esp, 4
test eax, eax
mov edx, dword [ebp - 0x124]
jne 0x41f214
mov dword [esp + 8], edx
mov dword [esp + 4], str.ERROR_in_log_start__:_Write_protected__S_n
mov dword [esp], 0x849160
call fcn.0041f010
mov dword [esp + 8], 0x1000
mov dword [esp + 4], esi
mov dword [esp], 0x734d64
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub esp, 0xc
mov dword [esp + 4], str.SDIO_logs
mov dword [esp], esi
call sub.msvcrt.dll_wcscat
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], str._s_slog.txt
mov dword [esp], edi
call fcn.00403a60
mov edx, dword [ebp - 0x124]
mov eax, dword [sym.imp.msvcrt.dll__wfopen]
mov dword [esp + 4], 0x734d30
mov dword [esp], edx
mov dword [ebp - 0x13c], eax
call eax
test eax, eax
mov dword [ebx + 0x2000], eax
je 0x41f260
test byte [ebx + 0x200d], 8
je 0x41f240
mov eax, dword [ebp - 0x128]
mov dword [ebp - method.nInst.virtual_0], vtable.nInst.0
test eax, eax
je 0x41f0f2
mov dword [esp], eax
call fcn.006febd0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [esp + 4], 0x734d30
mov dword [esp], edx
mov ecx, 0x869458
call fcn.00441fa0
sub esp, 8
test eax, eax
mov edx, dword [ebp - 0x124]
jne 0x41f1bb
jmp 0x41f159
mov dword [esp + 8], 0x734d8a
mov dword [esp + 4], str.start_logging_n_s_n_n
mov dword [esp], 0x849160
call fcn.0041ef00
jmp 0x41f1ea
mov eax, dword [ebp - 0x124]
mov dword [esp + 4], str.ERROR_in_log_start__:_Write_protected__S_n
mov dword [esp], 0x849160
mov dword [esp + 8], eax
call fcn.0041f010
mov dword [esp + 8], 0x1000
mov dword [esp + 4], esi
mov dword [esp], 0x734d64
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub esp, 0xc
mov dword [esp + 4], str.SDIO_logs
mov dword [esp], esi
call sub.msvcrt.dll_wcscat
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], str._s_slog.txt
mov dword [esp], edi
call fcn.00403a60
mov dword [esp], esi
call fcn.00441300
mov eax, dword [ebp - 0x124]
mov dword [esp + 4], 0x734d84
mov dword [esp], eax
mov eax, dword [ebp - 0x13c]
call eax
mov dword [ebx + 0x2000], eax
jmp 0x41f1e1
Function at 0x4307c0
Capabilities:
Create thread

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x41d2e0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [0x8490e8], eax
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x2c
ret 4
Function at 0x43b320
Capabilities:
Accept command line arguments

Disassembly:
push esi
push ebx
sub esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
sub esp, 8
cmp dword [esp + 0x1c], 1
jbe 0x43b390
mov esi, eax
mov ebx, 1
jmp 0x43b359
add ebx, 1
cmp dword [esp + 0x1c], ebx
jbe 0x43b390
mov eax, dword [esi + ebx*4]
cmp word [eax], 0x2f
jne 0x43b36a
mov edx, 0x2d
mov word [eax], dx
mov dword [esp + 4], str._script
mov dword [esp], eax
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
je 0x43b350
add esp, 0x24
mov eax, 1
pop ebx
pop esi
ret
add esp, 0x24
xor eax, eax
pop ebx
pop esi
ret
Function at 0x43da51
Capabilities:
Execute command

Disassembly:
ret
Function at 0x4405d0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
mov eax, 0x201c
push esi
push ebx
call fcn.005e3260
xor ebx, ebx
sub esp, eax
mov ebp, dword [esp + 0x2034]
mov eax, dword [esp + 0x2030]
lea esi, [esp + 0x10]
mov word [ebp], bx
mov dword [esp + 8], 0x1000
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], str.Opening__S_n
mov dword [esp], 0x849160
call fcn.0041f5d0
mov dword [esp + 4], 0x73b712
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__wfopen]
test eax, eax
mov edi, eax
je 0x44072a
mov dword [esp + 8], edi
mov dword [esp + 4], 0x1000
mov dword [esp], esi
call sub.msvcrt.dll_fgetws
test eax, eax
je 0x4406f3
mov ebx, esi
jmp 0x440666
add ebx, 2
movzx eax, word [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_iswspace
test eax, eax
jne 0x440663
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_wcscpy
movzx eax, word [esp + 0x10]
cmp ax, 0x3b
je 0x440643
cmp ax, 0x23
je 0x440643
cmp ax, 0x2f
jne 0x4406a2
mov ecx, 0x2d
mov word [esp + 0x10], cx
mov dword [esp + 4], 0x73ae8a
mov dword [esp], esi
call sub.msvcrt.dll_wcsstr
test eax, eax
jne 0x440643
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
cmp word [esp + eax*2 + 0xe], 0xa
je 0x44070d
cmp word [esp + 0x10], 0
je 0x440643
mov dword [esp + 4], esi
mov dword [esp], ebp
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x73b72e
mov dword [esp], eax
call sub.msvcrt.dll_wcscat
jmp 0x440643
mov dword [esp], edi
call sub.msvcrt.dll_fclose
add esp, 0x201c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
xor edx, edx
mov word [esp + eax*2 + 0xe], dx
cmp word [esp + 0x10], 0
je 0x440643
jmp 0x4406d2
mov dword [esp + 8], esi
mov dword [esp + 4], str.Failed_to_open__S_n
mov dword [esp], 0x849160
call fcn.0041f010
add esp, 0x201c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x4407c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push edi
mov ebp, ecx
push esi
push ebx
sub esp, 0x3c
mov dword [esp], str._cfg:
call sub.msvcrt.dll_wcslen
mov edi, eax
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
sub esp, 8
cmp dword [esp + 0x2c], 1
jle 0x44084a
mov esi, eax
lea eax, [edi + edi]
mov edi, 1
mov dword [esp + 0x1c], eax
mov ebx, dword [esi + edi*4]
cmp word [ebx], 0x2f
jne 0x440815
mov eax, 0x2d
mov word [ebx], ax
mov dword [esp + 4], str._cfg:
mov dword [esp], ebx
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
je 0x440841
add ebx, dword [esp + 0x1c]
mov ecx, ebp
mov dword [esp], ebx
call fcn.00440760
sub esp, 4
test al, al
jne 0x440860
add edi, 1
cmp dword [esp + 0x2c], edi
jg 0x440804
add esp, 0x3c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 4
or dword [ebp + 0x1c000], 0x8000
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x441220
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
mov dword [esp + 8], 0x64
mov dword [esp], 0
movzx eax, si
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
sub esp, 0xc
test eax, eax
je 0x441290
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
sub esp, 8
mov edx, dword [esp + 0x28]
mov dword [edx], eax
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp + 8], esi
mov dword [esp + 4], str.ERROR_in_get_resource__:_failed_FindResource__d__n
mov dword [esp], 0x849160
call fcn.0041f010
mov eax, dword [esp + 0x28]
mov dword [eax], 0
mov eax, dword [esp + 0x24]
mov dword [eax], 0
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x441300
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
push edi
mov eax, 0x201c
push esi
push ebx
call fcn.005e3260
sub esp, eax
mov ebx, dword [esp + 0x2030]
cmp word [ebx + 2], 0x3a
jne 0x441325
cmp word [ebx + 4], 0
je 0x44133a
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x441345
test al, 0x10
je 0x441350
add esp, 0x201c
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test al, 0x7f
je 0x44133a
nop
lea esi, [esp + 0x10]
mov dword [esp + 4], ebx
mov dword [esp], esi
mov ebx, esi
call sub.msvcrt.dll_wcscpy
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
cmp eax, 2
ja 0x441424
mov edi, dword [sym.imp.msvcrt.dll__wmkdir]
mov ebp, dword [sym.imp.msvcrt.dll__errno]
jmp 0x44138d
mov eax, 0x5c
add ebx, 2
mov word [ebx - 2], ax
mov dword [esp], ebx
mov dword [esp + 4], 0x5c
call sub.msvcrt.dll_wcschr
test eax, eax
mov ebx, eax
je 0x4413d0
xor edx, edx
mov word [eax], dx
mov dword [esp], esi
call edi
test eax, eax
jns 0x441381
call ebp
cmp dword [eax], 0x11
je 0x441381
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
cmp eax, 2
jbe 0x441381
call ebp
jmp 0x441401
mov dword [esp], esi
call edi
test eax, eax
jns 0x44133a
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
cmp dword [eax], 0x11
je 0x44133a
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
cmp eax, 2
jbe 0x44133a
call ebx
mov eax, dword [eax]
mov dword [esp + 8], esi
mov dword [esp + 4], str.ERROR_in_mkdir_r__:_failed__wmkdir__S__d_._Write_protected__n
mov dword [esp], 0x849160
mov dword [esp + 0xc], eax
call fcn.0041f010
jmp 0x44133a
cmp word [esp + 0x10], 0x5c
jne 0x441373
lea eax, [esp + 0x14]
mov ecx, 0x5c
mov dword [esp + 4], 0x5c
mov word [esp + 0x12], cx
mov dword [esp], eax
call sub.msvcrt.dll_wcschr
lea ebx, [eax + 2]
jmp 0x441373
Function at 0x4414b0
Capabilities:
Check if file exists

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, dword [esp + 0x30]
mov dword [esp], ebx
call esi
sub esp, 4
test eax, eax
jne 0x44151d
mov eax, dword [esp + 0x34]
test eax, eax
jle 0x441530
imul ebp, dword [esp + 0x38], 0x3e8
mov edi, 1
jmp 0x4414ed
add edi, 1
cmp edi, dword [esp + 0x34]
jg 0x441530
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Waiting:__S_n
mov dword [esp], 0x849160
call fcn.0041f5d0
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
mov dword [esp], ebx
call esi
sub esp, 4
test eax, eax
je 0x4414e4
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x441540
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
sub esp, 4
test eax, eax
setne al
add esp, 0x1c
ret 4

Function at 0x441560
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x36a]
push ebx
lea eax, [ebp - 0x37c]
sub esp, 0x38c
mov dword [ebp - 0x374], edx
xor edx, edx
mov word [ebp - 0x36a], dx
mov edx, dword [ebp + 8]
mov dword [esp + 4], 0x73b8e4
mov dword [esp], eax
mov dword [ebp - 0x378], 0
mov dword [ebp - 0x370], pe_nt_image_headers32
mov dword [esp + 8], edx
mov byte [ebp - 0x36c], 0
mov dword [ebp - method.Pg.virtual_0], vtable.Pg.0
call fcn.00403a60
mov eax, dword [ebp - 0x374]
lea esi, [ebp - 0x268]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
sub esp, 8
cmp eax, 0xffffffff
mov ebx, eax
je 0x441660
test byte [ebp - 0x268], 0x10
je 0x441650
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x441609
test byte [ebp - 0x268], 0x10
je 0x441650
mov dword [esp + 4], esi
mov dword [esp], ebx
call edi
sub esp, 8
test eax, eax
jne 0x441600
xor esi, esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esp, 4
mov eax, dword [ebp - 0x378]
mov dword [ebp - method.nInst.virtual_0], vtable.nInst.0
test eax, eax
je 0x441643
mov dword [esp], eax
call fcn.006febd0
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov esi, 1
jmp 0x44161b
xor esi, esi
jmp 0x441627

Function at 0x441690
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x4416b4
shr eax, 4
add esp, 0x1c
and eax, 1
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test al, 0x7f
sete al
add esp, 0x1c
ret 4
Function at 0x4416d0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
xor esi, esi
sub esp, 0x27c
mov eax, dword [esp + 0x290]
lea ebp, [esp + 0x20]
mov dword [esp + 4], ebp
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
sub esp, 8
cmp eax, 0xffffffff
je 0x441738
mov ebx, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebp
mov dword [esp], ebx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], eax
add esi, dword [esp + 0x18]
adc edi, dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
sub esp, 8
test eax, eax
jne 0x441700
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esp, 4
add esp, 0x27c
mov eax, esi
mov edx, edi
pop ebx
pop esi
pop edi
pop ebp
ret 4