joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f2b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x52038c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
mov ebx, edx
push esi
xor esi, esi
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x458], esi
cmp dword [eax + 0x10], esi
je 0x40f318
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x454], eax
cmp eax, 0xffffffff
je 0x40f318
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x450], 0x22c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x40f32a
push dword [ebp - 0x454]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4c3a
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0x454]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40f44d
nop dword [eax]
mov ecx, dword [ebp - 0x45c]
lea eax, [ebp - 0x42c]
push eax
call fcn.00403060
push eax
call fcn.004c2493
add esp, 8
test eax, eax
jne 0x40f42a
cmp dword [ebx + 0x10], eax
je 0x40f447
push dword [ebp - 0x448]
push eax
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40f424
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004be240
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40f424
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00404770
cmp dword [ebx + 0x14], 8
mov ecx, eax
jb 0x40f3e3
mov eax, dword [ebx]
jmp 0x40f3e5
mov eax, ebx
push dword [ebx + 0x10]
push 0
push eax
call fcn.0040b010
lea ecx, [ebp - 0x224]
mov esi, eax
call fcn.004047e0
cmp esi, 0xffffffff
je 0x40f41e
mov esi, dword [ebp - 0x448]
mov dword [ebp - 0x458], esi
cmp edi, 0xffffffff
je 0x40f424
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x40f42a
mov esi, dword [ebp - 0x458]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0x454]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40f350
jmp 0x40f44d
mov esi, dword [ebp - 0x448]
push dword [ebp - 0x454]
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4c3a
mov esp, ebp
pop ebp
ret
Function at 0x40f470
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6078
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x52038c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x40f4b6
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push ebx
lea edx, [ebp - 0x18]
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040f5b0
mov edi, dword [ebp - 0x18]
add esp, 4
test al, al
je 0x40f52e
mov ebx, dword [ebp - 0x14]
mov esi, edi
cmp edi, ebx
je 0x40f52a
mov eax, dword [esi]
test eax, eax
je 0x40f520
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40f520
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x40f520
cmp edi, 0xffffffff
je 0x40f520
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, ebx
jne 0x40f4f0
mov edi, dword [ebp - 0x18]
mov bl, 1
jmp 0x40f548
mov edx, ebx
mov ecx, esi
call fcn.0040f2b0
test eax, eax
jne 0x40f53f
xor bl, bl
jmp 0x40f548
mov ecx, eax
call fcn.0040f570
mov bl, al
test edi, edi
je 0x40f55b
mov ecx, dword [ebp - 0x10]
sub ecx, edi
sar ecx, 2
push ecx
push edi
call fcn.00405e40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f570
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x40f577
xor al, al
ret
push esi
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40f596
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40f59a
xor al, al
pop esi
ret
cmp esi, 0xffffffff
je 0x40f5a6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
ret
Function at 0x40f5b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x52038c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x458]
push 0x228
mov esi, edx
mov dword [ebp - 0x468], ecx
push 0
push eax
mov dword [ebp - 0x464], esi
call fcn.004be240
add esp, 0xc
mov dword [ebp - 0x45c], 0x22c
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
lea eax, [ebp - 0x45c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x40f634
cmp ebx, 0xffffffff
je 0x40f621
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a4c3a
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x45c]
mov byte [ebp - 0x45d], 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x40f77c
mov ecx, dword [ebp - 0x468]
call fcn.00403060
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.004c2493
add esp, 8
test eax, eax
jne 0x40f766
cmp dword [edi + 0x10], eax
jne 0x40f693
lea eax, [ebp - 0x454]
mov ecx, esi
push eax
call fcn.0040f930
mov byte [ebp - 0x45d], 1
jmp 0x40f766
push dword [ebp - 0x454]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40f760
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.004be240
add esp, 0xc
lea eax, [ebp - 0x214]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40f760
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00404770
cmp dword [edi + 0x14], 8
jb 0x40f6fd
mov ecx, dword [edi]
jmp 0x40f6ff
mov ecx, edi
push dword [edi + 0x10]
push 0
push ecx
mov ecx, eax
call fcn.0040b010
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x46c], eax
cmp ecx, 8
jb 0x40f736
inc ecx
push ecx
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x22c]
call fcn.00404840
mov eax, dword [ebp - 0x46c]
cmp eax, 0xffffffff
je 0x40f754
mov ecx, dword [ebp - 0x464]
lea eax, [ebp - 0x454]
push eax
call fcn.0040f930
mov byte [ebp - 0x45d], 1
cmp esi, 0xffffffff
je 0x40f760
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x464]
lea eax, [ebp - 0x45c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40f651
cmp ebx, 0xffffffff
je 0x40f788
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x45d]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004a4c3a
mov esp, ebp
pop ebp
ret
Function at 0x410140
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e622f
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x52038c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x60], 0
xor eax, eax
push 7
push str.Desktop
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00404670
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0x40
xor eax, eax
mov dword [ebp - 0x14], 7
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00404670
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x5c], reloc.WS2_32.dll_accept
push eax
lea edx, [ebp - 0x5c]
mov ecx, esi
call fcn.0040ffc0
add esp, 8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x60], 1
cmp eax, 8
jb 0x410209
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00404840
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x410235
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00404840
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp dword [esi + 0x10], eax
jne 0x4102b0
mov edx, 0x50c010
lea ecx, [ebp - 0x58]
call fcn.0040ff00
mov edi, eax
cmp esi, edi
je 0x41029b
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x410274
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00404840
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x41028c
mov eax, dword [esi]
jmp 0x41028e
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push edi
call fcn.00404140
mov ecx, dword [ebp - 0x44]
cmp ecx, 8
jb 0x4102b0
inc ecx
push ecx
push dword [ebp - 0x58]
lea ecx, [ebp - 0x58]
call fcn.00404840
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4c3a
mov esp, ebp
pop ebp
ret
Function at 0x4102d0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e622f
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x52038c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x60], 0
xor eax, eax
push 8
push str.Programs
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00404670
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0x40
xor eax, eax
mov dword [ebp - 0x14], 7
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00404670
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x5c], reloc.WS2_32.dll_accept
push eax
lea edx, [ebp - 0x5c]
mov ecx, esi
call fcn.0040ffc0
add esp, 8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x60], 1
cmp eax, 8
jb 0x410399
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00404840
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x4103c5
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00404840
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp dword [esi + 0x10], eax
jne 0x410440
mov edx, 0x50c020
lea ecx, [ebp - 0x58]
call fcn.0040ff00
mov edi, eax
cmp esi, edi
je 0x41042b
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x410404
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00404840
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x41041c
mov eax, dword [esi]
jmp 0x41041e
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push edi
call fcn.00404140
mov ecx, dword [ebp - 0x44]
cmp ecx, 8
jb 0x410440
inc ecx
push ecx
push dword [ebp - 0x58]
lea ecx, [ebp - 0x58]
call fcn.00404840
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4c3a
mov esp, ebp
pop ebp
ret
Function at 0x410460
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6279
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x52038c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4104b8
mov eax, dword [esi]
jmp 0x4104ba
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x10], 1
cmp ecx, 0x104
jb 0x4104fb
mov dword [esi + 0x10], 0x104
cmp dword [esi + 0x14], 8
jb 0x4104ee
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x208], cx
jmp 0x41050c
mov eax, esi
xor ecx, ecx
mov word [eax + 0x208], cx
jmp 0x41050c
mov eax, 0x104
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0040cb80
cmp dword [esi + 0x14], 8
jb 0x410516
mov eax, dword [esi]
jmp 0x410518
mov eax, esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esi + 0x10]
cmp eax, ecx
ja 0x410568
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 8
jb 0x41054e
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, esi
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0040cb80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410650
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e62a8
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x52038c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x41068c
xor al, al
jmp 0x410766
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00404260
mov edx, 0x2f
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00410590
mov edx, 0x5c
lea ecx, [ebp - 0x28]
call fcn.00410590
cmp dword [ebp - 0x18], 3
ja 0x4106e9
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
jne 0x41072f
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x278]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x410733
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
cmp edx, 8
jb 0x410716
mov ecx, dword [esi]
jmp 0x410718
mov ecx, esi
cmp word [ecx + eax*2 - 2], 0x5c
je 0x41072f
cmp edx, 8
jb 0x410727
mov esi, dword [esi]
cmp word [esi + eax*2 - 2], 0x2f
jne 0x41074d
mov bl, 1
jmp 0x41074f
test byte [ebp - 0x278], 0x10
push eax
je 0x410747
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, 1
jmp 0x41074f
call dword [sym.imp.KERNEL32.dll_FindClose]
xor bl, bl
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x410764
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00404840
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4c3a
mov esp, ebp
pop ebp
ret
Function at 0x410790
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e62fb
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x52038c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
call fcn.00410650
test al, al
jne 0x4107d2
xor eax, eax
jmp 0x4109c9
push str..
mov edx, edi
lea ecx, [ebp - 0x58]
call fcn.0040fb80
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2d8]
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
push ecx
cmovae eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2dc], eax
cmp eax, 0xffffffff
je 0x41099c
mov ebx, dword [ebp + 8]
nop word [eax + eax]
lea eax, [ebp - 0x2ac]
push eax
push 0x50f658
call fcn.004c2493
add esp, 8
test eax, eax
je 0x410975
lea eax, [ebp - 0x2ac]
push eax
push 0x50f65c
call fcn.004c2493
add esp, 8
test eax, eax
je 0x410975
push 0x50f42c
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.0040fb80
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 1
push ecx
mov edx, eax
lea ecx, [ebp - 0x70]
call fcn.0040ce60
add esp, 8
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x410898
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00404840
xor eax, eax
mov dword [ebp - 0x14], 7
test byte [ebp - 0x2d8], 0x10
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
je 0x41094d
test bl, bl
je 0x41093b
push 0x50f42c
mov edx, edi
lea ecx, [ebp - 0x88]
call fcn.0040fb80
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 4
push ecx
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.0040ce60
add esp, 8
push eax
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00410ae0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x410908
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00404840
xor eax, eax
mov byte [ebp - 4], 3
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
cmp eax, 8
jb 0x41093b
inc eax
lea ecx, [ebp - 0x88]
push eax
push dword [ebp - 0x88]
call fcn.00404840
push 1
push ebx
mov edx, esi
lea ecx, [ebp - 0x70]
call fcn.00410790
add esp, 8
jmp 0x41095c
test bl, bl
jne 0x41095c
lea eax, [ebp - 0x70]
mov ecx, esi
push eax
call fcn.004109f0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x5c]
cmp eax, 8
jb 0x410975
inc eax
lea ecx, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
call fcn.00404840
lea eax, [ebp - 0x2d8]
push eax
push dword [ebp - 0x2dc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x410820
push dword [ebp - 0x2dc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esi + 4]
mov eax, 0x2aaaaaab
sub ecx, dword [esi]
imul ecx
mov ecx, dword [ebp - 0x44]
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp ecx, 8
jb 0x4109c7
inc ecx
push ecx
push dword [ebp - 0x58]
lea ecx, [ebp - 0x58]
call fcn.00404840
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4c3a
mov esp, ebp
pop ebp
ret
Function at 0x410e20
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e63a8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x52038c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x40]
call fcn.0040c620
mov edi, eax
mov edx, esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040c620
cmp dword [edi + 0x14], 0x10
jb 0x410e70
mov edi, dword [edi]
cmp dword [eax + 0x14], 0x10
jb 0x410e78
mov eax, dword [eax]
push edi
push eax
call fcn.004cc6b7
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x14]
sete bl
cmp eax, 0x10
jb 0x410e9c
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004049b0
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp ecx, 0x10
jb 0x410ec3
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.004049b0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4c3a
mov esp, ebp
pop ebp
ret
Function at 0x410ef0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e63f1
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x52038c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004be240
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
sub esp, 0xc
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], eax
cmp dword [ecx + 0x14], 8
jb 0x410f87
mov eax, dword [ecx]
jmp 0x410f89
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
push edx
push edi
mov word [eax], dx
call fcn.00404260
lea edx, [ebp - 0x230]
lea ecx, [ebp - 0x248]
call fcn.0040bfc0
add esp, 0x18
lea eax, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
lea esi, [ebp - 0x248]
cmovae eax, dword [ebp - 0x230]
cmp dword [ebp - 0x234], 8
push eax
cmovae esi, dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push esi
push str._ws_x__ws
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00410bc0
xor eax, eax
mov dword [ebp - 0x24c], 7
add esp, 0x18
mov dword [ebp - 0x250], 0
mov word [ebp - 0x260], ax
cmp word [ebp - 0x218], ax
jne 0x41101f
xor ecx, ecx
jmp 0x41103f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411030
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x260]
call fcn.00404670
lea edx, [ebp - 0x260]
mov byte [ebp - 4], 2
mov ecx, edi
call fcn.00410e20
mov eax, dword [ebp - 0x24c]
cmp eax, 8
jb 0x411081
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.00404840
push 4
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
mov eax, dword [ebp - 0x21c]
setne bl
cmp eax, 8
jb 0x4110b5
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00404840
mov ecx, dword [ebp - 0x234]
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp ecx, 8
jb 0x4110f0
inc ecx
push ecx
push dword [ebp - 0x248]
lea ecx, [ebp - 0x248]
call fcn.00404840
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4c3a
mov esp, ebp
pop ebp
ret
Function at 0x411110
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Move file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6428
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x44
mov eax, dword [0x52038c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x18], 7
push 0xffffffffffffffff
push eax
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00404260
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00410d00
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41126a
shr eax, 4
and al, 1
je 0x41126a
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a4c4b
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
mov esi, eax
cmovae ecx, dword [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 2
push ecx
push esi
call fcn.004cc653
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
xorps xmm0, xmm0
mov byte [ebp - 0x2d], 1
add esp, 0x10
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x1c]
mov word [esi + eax*2 + 2], cx
mov dword [ebp - 0x3c], ecx
mov ecx, 0x414
movq qword [ebp - 0x44], xmm0
mov ax, word [ebp - 0x44]
or ax, cx
mov dword [ebp - 0x3e], 0
mov ecx, 0xffbf
mov dword [ebp - 0x3a], 0
and ax, cx
movups xmmword [ebp - 0x54], xmm0
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 3
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
movzx ecx, byte [ebp - 0x2d]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x34], ecx
test esi, esi
je 0x41126f
push 2
push esi
call fcn.004a4caf
mov ecx, dword [ebp - 0x34]
add esp, 8
jmp 0x41126f
mov cl, 1
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x41128b
lea ecx, [eax + 1]
push ecx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.00404840
mov al, byte [ebp - 0x34]
jmp 0x41128d
mov al, cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a4c3a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret