joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ea30
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x664
push ebp
push esi
mov esi, dword [esp + 0x670]
xor ebp, ebp
cmp esi, ebp
je 0x40ebde
push esi
call fcn.0044cf30
add esp, 4
test eax, eax
je 0x40ebde
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x18]
push ebp
push eax
push esi
mov dword [esp + 0x24], ebp
call fcn.0040b290
add esp, 0x1c
test eax, eax
je 0x40ebde
mov eax, dword [esp + 8]
cmp eax, 0xffffffff
je 0x40ebde
test al, 1
je 0x40ea9c
and al, 0xfe
push eax
push esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 8]
test al, 0x10
je 0x40ebcb
push ebx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x46e]
mov word [esp + 0x46c], bp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x46c]
push esi
push ecx
stosw word es:[edi], ax
call fcn.0044cece
lea edx, [esp + 0x474]
push 0x64c748
push edx
call fcn.0044cea4
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x230]
mov dword [esp + 0x22c], ebp
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x21c]
lea ecx, [esp + 0x46c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40ebb6
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea edx, [esp + 0x248]
push 0x64b608
push edx
call ebp
test eax, eax
je 0x40eb96
lea eax, [esp + 0x248]
push 0x64b604
push eax
call ebp
test eax, eax
je 0x40eb96
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push esi
push ecx
stosw word es:[edi], ax
call fcn.0044cece
lea edx, [esp + 0x1c]
push 0x6464a8
push edx
call fcn.0044cea4
lea eax, [esp + 0x258]
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.0044cea4
lea edx, [esp + 0x2c]
push edx
call fcn.0040ea30
add esp, 0x1c
lea eax, [esp + 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40eb21
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor ebp, ebp
push 4
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x664
ret
push 4
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop esi
pop ebp
add esp, 0x664
ret
pop esi
xor eax, eax
pop ebp
add esp, 0x664
ret

Function at 0x40f150
Capabilities:
Copy file

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edi, eax
test edi, edi
jne 0x40f192
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40f192
push edi
push esi
call fcn.0040e590
add esp, 8
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40f1a0
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Get file attributes
Move file
Set file attributes

Disassembly:
sub esp, 0x204
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ebp
push esi
mov esi, dword [esp + 0x214]
push edi
push esi
call ebx
cmp eax, 0xffffffff
jne 0x40f1cc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x204
ret
mov ebp, dword [esp + 0x21c]
push ebp
call ebx
cmp eax, 0xffffffff
je 0x40f283
test al, 1
je 0x40f1f5
and al, 0xfe
push eax
push ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0x10]
test al, 0x10
je 0x40f283
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push eax
push ebp
lea ecx, [esp + 0x1c]
push 0x64caf4
push ecx
call fcn.0044ce12
add esp, 0x10
lea edx, [esp + 0x14]
xor esi, esi
push edx
call ebx
cmp eax, 0xffffffff
je 0x40f270
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push eax
push ebp
lea eax, [esp + 0x1c]
push 0x64caf4
push eax
call fcn.0044ce12
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
call ebx
inc esi
cmp esi, 0xa
jge 0x40f1bf
cmp eax, 0xffffffff
jne 0x40f23c
lea edx, [esp + 0x14]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, dword [esp + 0x218]
mov eax, dword [esp + 0x220]
push eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebp
mov esi, eax
call fcn.004110d0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x204
ret
Function at 0x40f3c0
Capabilities:
Check for time delay via gettickcount
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5f09fb
push eax
mov dword fs:[0], esp
sub esp, 0x208
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x228]
xor ebx, ebx
cmp edi, ebx
je 0x40f5a1
mov esi, dword [esp + 0x22c]
cmp esi, ebx
je 0x40f5a1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [esp + 0x230]
mov dword [esp + 0x14], eax
cmp ecx, ebx
je 0x40f41e
cmp eax, 0xffffffff
jne 0x40f5a1
push esi
lea ecx, [esp + 0x14]
call fcn.005e0f55
push 0x64cb18
lea ecx, [esp + 0x14]
mov dword [esp + 0x224], ebx
call fcn.005e12c3
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call ebp
mov ecx, dword [esp + 0x10]
push 0
push ecx
push edi
call fcn.0040f1a0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40f58d
mov eax, dword [esp + 0x234]
test eax, eax
je 0x40f484
mov edx, dword [esp + 0x10]
push edx
push edi
call eax
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40f5bc
mov eax, dword [esp + 0x10]
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ebx, eax
test ebx, ebx
jne 0x40f58d
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x40f5c5
test al, 1
je 0x40f4b7
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
stosw word es:[edi], ax
stosb byte es:[edi], al
call ebp
push eax
push esi
lea ecx, [esp + 0x20]
push 0x64caf4
push ecx
call fcn.0044ce12
add esp, 0x10
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor edi, edi
cmp eax, 0xffffffff
je 0x40f52e
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
push eax
push esi
lea eax, [esp + 0x20]
push 0x64caf4
push eax
call fcn.0044ce12
add esp, 0x10
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc edi
cmp edi, 0xa
jge 0x40f582
cmp eax, 0xffffffff
jne 0x40f4fa
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileA]
lea edx, [esp + 0x18]
push edx
push esi
call ebp
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 1
push esi
push eax
call edi
mov ebx, eax
test ebx, ebx
jne 0x40f56d
mov eax, dword [esp + 0x238]
test eax, eax
je 0x40f569
mov ecx, dword [esp + 0x10]
push 5
push esi
push ecx
call edi
mov ebx, eax
test ebx, ebx
je 0x40f57a
push 4
lea edx, [esp + 0x1c]
push 0
push edx
call edi
jmp 0x40f58d
lea eax, [esp + 0x18]
push esi
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x220], 0xffffffff
call fcn.005e0ee7
mov ecx, dword [esp + 0x218]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x214
ret
mov edx, dword [esp + 0x10]
push edx
call ebp
jmp 0x40f58d
mov eax, dword [esp + 0x10]
push eax
call ebp
jmp 0x40f58d
Function at 0x40f7e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5f0a72
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, dword [esp + 0x170]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x40f9f5
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40f9f5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40f9f5
test al, 0x10
je 0x40f9f5
push esi
lea ecx, [esp + 0x10]
call fcn.005e0f55
push 0x5c
lea ecx, [esp + 0x10]
mov dword [esp + 0x170], ebx
call fcn.005de92d
mov ecx, 0x4e
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push 0x64c744
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.005e117c
mov eax, dword [eax]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.005e0ee7
cmp edi, 0xffffffff
mov ebx, 1
je 0x40f9dd
mov esi, dword [esp + 0x178]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [esp + 0x54]
push 0x64ca2c
push eax
call ebp
test eax, eax
je 0x40f9c1
lea ecx, [esp + 0x54]
push 0x64ca28
push ecx
call ebp
test eax, eax
je 0x40f9c1
lea edx, [esp + 0x54]
lea ecx, [esp + 0x14]
push edx
call fcn.005e0f55
mov al, byte [esp + 0x28]
mov byte [esp + 0x170], bl
test al, 0x10
push 0x6463d8
je 0x40f954
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.005e117c
lea edx, [esp + 0x14]
mov byte [esp + 0x170], 2
push edx
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.005e1116
mov eax, dword [eax]
push esi
push eax
mov byte [esp + 0x178], 3
call fcn.0040f7e0
add esp, 8
lea ecx, [esp + 0x24]
mov byte [esp + 0x170], 2
call fcn.005e0ee7
mov byte [esp + 0x170], bl
lea ecx, [esp + 0x18]
jmp 0x40f9ab
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.005e117c
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push eax
push edx
mov byte [esp + 0x17c], 4
call fcn.005e1116
mov ecx, dword [esi + 8]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x178], 5
call fcn.005df5e6
lea ecx, [esp + 0x1c]
mov byte [esp + 0x170], 4
call fcn.005e0ee7
mov byte [esp + 0x170], bl
lea ecx, [esp + 0x20]
call fcn.005e0ee7
lea ecx, [esp + 0x14]
mov byte [esp + 0x170], 0
call fcn.005e0ee7
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40f8b1
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
lea ecx, [esp + 0xc]
mov dword [esp + 0x16c], 0xffffffff
call fcn.005e0ee7
mov eax, ebx
jmp 0x40f9f7
xor eax, eax
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x40fa10
Capabilities:
Get graphical window text

Disassembly:
call fcn.00484440
test eax, eax
je 0x40fa2f
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
ret
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebp, ebp
test edi, edi
je 0x40fab0
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x40fab0
lea ecx, [esi + esi]
xor eax, eax
mov edx, ecx
push esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.005e15b8
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40fab0
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
push ebx
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebp, eax
test ebp, ebp
je 0x40fab0
push esi
mov esi, dword [esp + 0x1c]
push esi
push 0xffffffffffffffff
push ebx
xor ebp, ebp
call fcn.0042c9e0
add esp, 0x10
test eax, eax
je 0x40fab0
push esi
call fcn.0044cf30
add esp, 4
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x40fb10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
xor ecx, ecx
xor edi, edi
xor eax, eax
mov esi, 0x200
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x40fb3a
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, 1
jne 0x40fb46
mov esi, 0x400
jmp 0x40fbba
cmp eax, 2
jne 0x40fbba
xor eax, eax
lea edx, [esp + 0x38]
mov dword [esp + 0x1c], eax
push ecx
mov dword [esp + 0x24], eax
push edx
mov dword [esp + 0x2c], eax
push 0x18
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x38], eax
lea eax, [esp + 0x24]
push eax
push ecx
push ecx
push 0x70000
push ebp
mov dword [esp + 0x58], ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
mov eax, dword [0x6875c0]
je 0x40fc24
test eax, eax
je 0x40fbae
push str.CDiskInfoHelper::ReadFileBySectorSize_2
push str.Asset
push 0xf
push 0x687554
call fcn.00431af0
add esp, 0x10
mov esi, dword [esp + 0x2c]
cmp esi, 0x200
jb 0x40fc1a
push esi
call fcn.005e15b8
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebx]
lea eax, [esp + 0x18]
push eax
push esi
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test edi, edi
jne 0x40fc10
mov edx, dword [ebx]
push edx
call fcn.005e15e1
mov eax, dword [esp + 0x14]
add esp, 4
inc eax
mov dword [ebx], edi
cmp eax, 3
mov dword [esp + 0x10], eax
jl 0x40fb34
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
test eax, eax
je 0x40fc1a
push str.CDiskInfoHelper::ReadFileBySectorSize_1
push str.Asset
push 0xf
push 0x687554
call fcn.00431af0
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x40fd40
Capabilities:
Get disk information

Disassembly:
sub esp, 0x28
xor edx, edx
xor eax, eax
push ebx
mov ebx, dword [esp + 0x34]
cmp ebx, edx
je 0x40feee
cmp dword [esp + 0x38], 0x200
jne 0x40feee
push esi
push edi
mov ecx, 7
lea edi, [esp + 0x16]
mov word [esp + 0x14], dx
push 0x10
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x44], edx
rep stosd dword es:[edi], eax
mov eax, dword [0x64cc64]
mov ecx, dword [0x64cc68]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
add eax, 0x41
mov dword [esp + 0x14], ecx
mov word [esp + 0x10], ax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x40]
push ecx
push eax
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x48], edx
push ecx
push eax
push edx
lea ecx, [esp + 0x24]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x40feb4
lea edx, [esp + 0x14]
push edx
call fcn.0044cf30
lea esi, [ebx + 0x36]
push 5
push str.FAT16
push esi
mov edi, eax
call fcn.004543e0
add esp, 0x10
test eax, eax
jne 0x40fe14
cmp edi, 5
jne 0x40fe4d
push edi
lea eax, [esp + 0x18]
push 0x64cc50
push eax
call fcn.005b2f73
add esp, 0xc
test eax, eax
je 0x40fe69
push 5
push str.FAT12
push esi
call fcn.004543e0
add esp, 0xc
test eax, eax
jne 0x40fe75
cmp edi, 3
jne 0x40fe75
push edi
lea edx, [esp + 0x18]
push 0x64cc40
push edx
call fcn.005b2f73
add esp, 0xc
test eax, eax
jne 0x40fe75
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x28
ret
cmp edi, 3
jne 0x40fe14
push edi
lea ecx, [esp + 0x18]
push 0x64cc40
push ecx
call fcn.005b2f73
add esp, 0xc
test eax, eax
jne 0x40fe14
pop edi
pop esi
mov eax, 3
pop ebx
add esp, 0x28
ret
push 5
lea eax, [ebx + 0x52]
push str.FAT32
push eax
call fcn.004543e0
add esp, 0xc
test eax, eax
jne 0x40feb4
cmp edi, 5
jne 0x40feb4
push edi
lea ecx, [esp + 0x18]
push 0x64cc2c
push ecx
call fcn.005b2f73
add esp, 0xc
test eax, eax
jne 0x40feb4
pop edi
pop esi
mov eax, 2
pop ebx
add esp, 0x28
ret
lea esi, [ebx + 3]
push 5
push str.EXFAT
push esi
call fcn.004543e0
add esp, 0xc
test eax, eax
jne 0x40fed7
pop edi
pop esi
mov eax, 5
pop ebx
add esp, 0x28
ret
push 4
push str.NTFS
push esi
call fcn.004543e0
add esp, 0xc
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x410c00
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x5f0ab0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
test ebp, ebp
je 0x410d4d
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x410d4d
push ebp
lea ecx, [esp + 0x10]
call fcn.005e0f55
push 3
push 0x5c
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0
call fcn.005e1416
push 2
push 0x64cfb0
push ebp
mov esi, eax
call fcn.0044d69f
add esp, 0xc
test eax, eax
jne 0x410c7b
inc esi
lea ecx, [esp + 0xc]
push esi
push 0x5c
call fcn.005e1416
mov esi, eax
cmp esi, 0xffffffff
je 0x410d06
mov ebp, dword [esp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [esp + 0x20]
push esi
push eax
lea ecx, [esp + 0x14]
call fcn.005de339
mov ecx, dword [esp + 0x20]
mov byte [esp + 0x18], 1
push ecx
call edi
cmp eax, 0xffffffff
jne 0x410ce0
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x410d2e
mov ecx, dword [esp + 0x20]
push ecx
call edi
mov edx, ebp
or edx, 0x10
cmp eax, edx
je 0x410ce4
mov eax, dword [esp + 0x20]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x410ce4
test al, 0x10
je 0x410d2e
inc esi
lea ecx, [esp + 0xc]
push esi
push 0x5c
call fcn.005e1416
lea ecx, [esp + 0x20]
mov esi, eax
mov byte [esp + 0x18], 0
call fcn.005e0ee7
cmp esi, 0xffffffff
jne 0x410c8e
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.005e0ee7
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.005e0ee7
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.005e0ee7
mov ecx, dword [esp + 0x10]
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4113a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5f0b8c
push eax
mov dword fs:[0], esp
sub esp, 0x150
push ebx
push esi
mov esi, dword [esp + 0x168]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x411584
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x411584
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x411584
test al, 0x10
je 0x411584
push ebp
push esi
lea ecx, [esp + 0x18]
call fcn.005e0f55
push 0x5c
lea ecx, [esp + 0x18]
mov dword [esp + 0x16c], ebx
call fcn.005de92d
mov ecx, 0x4e
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x20], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push 0x64c744
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.005e117c
mov eax, dword [eax]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x10]
mov ebp, eax
call fcn.005e0ee7
cmp ebp, 0xffffffff
je 0x411568
mov esi, dword [esp + 0x178]
mov edi, dword [esp + 0x174]
mov bl, 2
lea eax, [esp + 0x4c]
push 0x64ca2c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x41153b
lea ecx, [esp + 0x4c]
push 0x64ca28
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x41153b
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x10]
push edx
call fcn.005e0f55
mov al, byte [esp + 0x20]
mov byte [esp + 0x168], 1
test al, 0x10
je 0x411520
lea eax, [esp + 0x14]
push 0x6463d8
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.005e117c
lea edx, [esp + 0x10]
mov byte [esp + 0x168], bl
push edx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.005e1116
mov eax, dword [eax]
push esi
push edi
push eax
mov byte [esp + 0x174], 3
call fcn.004113a0
add esp, 0xc
lea ecx, [esp + 0x18]
mov byte [esp + 0x168], bl
call fcn.005e0ee7
lea ecx, [esp + 0x1c]
mov byte [esp + 0x168], 1
call fcn.005e0ee7
jmp 0x411522
inc dword [edi]
test esi, esi
je 0x41152a
cmp esi, dword [edi]
jbe 0x411550
lea ecx, [esp + 0x10]
mov byte [esp + 0x168], 0
call fcn.005e0ee7
lea ecx, [esp + 0x20]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x411561
jmp 0x41146f
lea ecx, [esp + 0x10]
mov byte [esp + 0x168], 0
call fcn.005e0ee7
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x14]
mov dword [esp + 0x168], 0xffffffff
call fcn.005e0ee7
mov eax, 1
pop ebp
jmp 0x411586
xor eax, eax
mov ecx, dword [esp + 0x15c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x15c
ret
Function at 0x4121f0
Capabilities:
Compare security identifiers

Disassembly:
mov eax, 0x2818
call fcn.0044d670
mov eax, dword [esp + 0x2820]
mov ecx, dword [esp + 0x2824]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2828]
push edi
xor ebx, ebx
xor edi, edi
mov dword [eax], ebx
cmp esi, ebx
mov dword [esp + 0x1c], edi
mov dword [ecx], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], ebx
je 0x412341
mov ebp, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x2c]
push 0x2800
push eax
push 2
push esi
mov dword [esp + 0x34], ebx
call ebp
cmp eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x41228f
call ebx
cmp eax, 0x7a
jne 0x41236e
mov edi, dword [esp + 0x20]
push edi
call fcn.005e15b8
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
je 0x41235b
lea ecx, [esp + 0x20]
push ecx
push edi
push eax
push 2
push esi
call ebp
test eax, eax
je 0x41236e
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push eax
mov byte [esp + 0x40], 0
mov byte [esp + 0x41], 0
mov byte [esp + 0x42], 0
mov byte [esp + 0x43], 0
mov byte [esp + 0x44], 0
mov byte [esp + 0x45], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x412381
mov eax, dword [esp + 0x28]
xor esi, esi
test eax, eax
jbe 0x4123a6
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea edi, [esp + 0x2c]
mov ecx, dword [edi]
mov edx, dword [esp + 0x10]
push ecx
push edx
call ebx
test eax, eax
jne 0x412311
mov eax, dword [esp + 0x28]
inc esi
add edi, 8
cmp esi, eax
jb 0x4122f2
jmp 0x4123a6
mov eax, dword [esp + esi*8 + 0x30]
mov dword [esp + 0x1c], 1
test al, 8
je 0x41232e
mov ecx, dword [esp + 0x2830]
mov dword [ecx], 1
test al, 4
je 0x4123a6
mov edx, dword [esp + 0x2834]
mov dword [edx], 1
jmp 0x4123a6
cmp dword [0x6875c0], ebx
je 0x4123f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CAgentNWMgrU::CheckCurrentUserIsAdmin__ERROR___GetCurrentToken_Failed____08x_
jmp 0x412392
mov eax, dword [0x6875c0]
test eax, eax
je 0x4123a6
call ebx
push eax
push str.CAgentNWMgrU::CheckCurrentUserIsAdmin__ERROR___new_UCHAR_Failed____08x_
jmp 0x412392
mov eax, dword [0x6875c0]
test eax, eax
je 0x4123a6
call ebx
push eax
push str.CAgentNWMgrU::CheckCurrentUserIsAdmin__ERROR___GetTokenInformation_Failed____08x_
jmp 0x412392
mov eax, dword [0x6875c0]
test eax, eax
je 0x4123a6
call ebx
push eax
push str.CAgentNWMgrU::CheckCurrentUserIsAdmin__ERROR___AllocateAndInitializeSid_Failed____08x_
push str.Funclib
push 0xf
push 0x687554
call fcn.00431af0
add esp, 0x14
mov eax, dword [esp + 0x10]
xor ebx, ebx
cmp eax, ebx
je 0x4123bb
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4123cc
push eax
call fcn.005e15e1
add esp, 4
mov eax, dword [0x6875c0]
mov edi, dword [esp + 0x1c]
cmp eax, ebx
je 0x4123f3
push edi
push str.CAgentNWMgrU::CheckCurrentUserIsAdmin____d_
push str.Funclib
push 0xf
push 0x687554
call fcn.00431af0
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2818
ret