joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50b8c0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
lea ecx, [ebp - 0x30]
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004c726c
mov esi, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x30]
sub esi, eax
mov dword [esp], eax
call fcn.004c99c3
cmp esi, eax
jne 0x50b90a
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x30]
mov edx, 1
lea ecx, [ebp - 0x30]
add eax, eax
cmove eax, edx
mov dword [esp], eax
call fcn.004c72e0
push eax
mov eax, dword [ebp - 0x2c]
lea esi, [ebp - 0x28]
lea edx, [eax + 1]
mov dword [ebp - 0x2c], edx
mov byte [eax], 0
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebx]
mov dword [esp], ebx
mov eax, ecx
mov dword [esp + 4], ecx
mov ecx, esi
not eax
add eax, dword [ebp - 0x2c]
mov dword [esp + 8], eax
call dword [edx + 0xc]
lea ecx, [ebx + 0x34]
sub esp, 0xc
mov dword [esp], esi
call fcn.004c66f8
mov ecx, esi
push edi
call fcn.004c616a
mov eax, dword [ebx + 0x34]
cmp dword [eax], 0
je 0x50b976
mov ecx, dword [ebx + 0x18]
or eax, 0xffffffff
test ecx, ecx
je 0x50ba73
mov eax, dword [ecx]
mov dword [esp], 0
call dword [eax + 8]
or eax, 0xffffffff
push ebx
jmp 0x50ba73
mov eax, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x30], 0
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], edi
je 0x50ba69
mov eax, dword [edi + 0xc]
mov dword [esp + 4], edi
lea ecx, [ebp - 0x28]
mov dword [esp], ebx
mov dword [ebp - 0x3c], eax
call fcn.0050b80c
mov eax, dword [ebp - 0x28]
push edx
push edx
add eax, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ecx
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.004c616a
inc esi
je 0x50ba57
mov dword [esp + 4], edi
lea ecx, [ebp - 0x28]
mov dword [esp], ebx
call fcn.0050b550
push eax
push eax
mov eax, dword [ebp - 0x28]
add eax, 4
mov dword [esp + 4], 0x528db4
mov dword [esp], eax
call sub.msvcrt.dll_fopen
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.004c616a
test esi, esi
je 0x50ba57
lea eax, [ebp - 0x28]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x10
mov dword [esp], eax
call sub.msvcrt.dll_fgets
mov dword [esp], esi
mov dword [ebp - 0x44], eax
call sub.msvcrt.dll_fclose
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x50ba57
lea eax, [ebp - 0x34]
mov dword [esp + 4], 0x529234
mov dword [esp + 8], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_sscanf
dec eax
jne 0x50ba57
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x34]
jne 0x50ba57
mov byte [edi + 0x10], 1
jmp 0x50ba61
mov byte [edi + 0x10], 0
mov eax, dword [edi + 8]
add dword [ebx + 0x30], eax
add edi, 0x14
jmp 0x50b98d
mov ecx, ebx
call fcn.0050ba8c
mov eax, dword [ebx + 0x30]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x3c], eax
call fcn.004c71a6
mov eax, dword [ebp - 0x3c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x50c394
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov eax, dword [ecx]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.msvcrt.dll_fread
mov edx, eax
xor eax, eax
dec edx
jne 0x50c3e8
mov ecx, dword [ebx + 4]
mov al, 1
test ecx, ecx
je 0x50c3e8
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], esi
mov byte [ebp - 0x19], al
call fcn.004b9e2c
mov al, byte [ebp - 0x19]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x50c474
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov ecx, dword [ecx + 4]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test ecx, ecx
je 0x50c4dd
lea eax, [esi + 0xf]
mov edi, esp
shr eax, 4
shl eax, 4
call fcn.004cb790
sub esp, eax
lea eax, [esp + 0x10]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [ebp - 0x1c], eax
mov dword [esp], edx
call fcn.004b9e2c
mov edx, dword [ebx]
sub esp, 0xc
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov esp, edi
dec eax
sete al
jmp 0x50c4fb
mov eax, dword [ebx]
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
mov dword [esp], edx
call sub.msvcrt.dll_fwrite
dec eax
sete al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x5106a8
Capabilities:
Get common file path

Disassembly:
push ebp
lea eax, [ecx + 0x3c]
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x222]
lea esi, [ebp - 0x11d]
push ebx
mov ebx, ecx
mov ecx, eax
sub esp, 0x25c
mov dword [ebp - 0x23c], eax
call fcn.004a1b28
mov byte [ebx + 0x10a4], 0
mov dword [esp + 4], edi
mov dword [esp], 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x527ce6
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [ebx + 0x1094]
sub esp, 0x10
mov dword [esp], esi
call fcn.004c668e
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1201bf
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx + 0x109c], eax
sub esp, 0x1c
inc eax
je 0x510822
mov dword [ebx + 0x108c], 2
lea ecx, [ebp - 0x228]
lea esi, [ebp - 0x22c]
mov dword [ebx + 0x10a0], 0
mov dword [esp], str.Downloading...
call fcn.004c639a
mov ecx, ebx
add ebx, 0x1090
push eax
lea eax, [ebp - 0x228]
mov dword [esp], eax
call fcn.0051051c
lea ecx, [ebp - 0x228]
push edx
call fcn.004c616a
mov edi, dword [ebx + 0xc]
mov dword [esp], str.http:__upgrade.mikrotik.com_routeros_winbox_
mov ecx, esi
call fcn.004c639a
push ecx
mov ecx, esi
mov dword [esp], ebx
call fcn.004c6518
lea ecx, [ebp - 0x228]
push ebx
mov dword [esp], esi
call fcn.004c6316
lea ecx, [ebp - 0x228]
push eax
mov dword [esp], str._winbox.exe
call fcn.004c6550
mov ecx, dword [ebp - 0x23c]
push eax
lea eax, [ebp - 0x228]
mov dword [esp], eax
mov dword [esp + 4], edi
call fcn.004a1f18
lea ecx, [ebp - 0x228]
push eax
push eax
call fcn.004c616a
mov ecx, esi
call fcn.004c616a
mov dl, 1
jmp 0x510824
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401e40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
lea ecx, [ebp - 0xc]
call fcn.004010d0
lea ecx, [ebp - 0x18]
call fcn.004010d0
push 0x3c
push 0
lea eax, [ebp - 0x54]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], 0x3c
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x50], 0x740
mov dword [ebp - 0x38], 0xa
mov edx, dword [ebp + 0xc]
and edx, 1
je 0x401e9b
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x50]
or eax, 0x8000
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp + 0xc]
and ecx, 2
je 0x401eaa
mov dword [ebp - 0x48], str.runas
mov edx, dword [ebp + 0xc]
and edx, 0x10000
jne 0x401ec0
mov eax, dword [ebp - 0x50]
or eax, 0x100
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004038e0
add esp, 8
push eax
lea ecx, [ebp - 0x18]
call fcn.00401d50
lea ecx, [ebp - 0xc]
call fcn.0040d8e0
test eax, eax
jne 0x401f01
mov dword [ebp - 0x58], 1
lea ecx, [ebp - 0x18]
call fcn.00414ca0
lea ecx, [ebp - 0xc]
call fcn.00414ca0
mov eax, dword [ebp - 0x58]
jmp 0x401f7c
lea ecx, [ebp - 0xc]
call fcn.004012d0
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x18]
call fcn.004012d0
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x401f62
mov ecx, dword [ebp + 0xc]
and ecx, 0x10000
jne 0x401f3c
push 0xffffffffffffffff
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x5c], 1
lea ecx, [ebp - 0x18]
call fcn.00414ca0
lea ecx, [ebp - 0xc]
call fcn.00414ca0
mov eax, dword [ebp - 0x5c]
jmp 0x401f7c
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x18]
call fcn.00414ca0
lea ecx, [ebp - 0xc]
call fcn.00414ca0
mov eax, dword [ebp - 0x60]
mov esp, ebp
pop ebp
ret
Function at 0x402d40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00402f60
mov ecx, dword [ebp - 0xc]
mov dword [0x42d448], ecx
mov dword [0x42d450], 0
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x402f90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x42d44c], eax
cmp dword [0x42d44c], 0
je 0x402dac
cmp dword [0x42d480], 2
je 0x402d9d
call fcn.0040b460
push 0xffffffffffffffff
mov ecx, dword [0x42d44c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0x42d538], 0
cmp dword [0x42d450], 0
je 0x402e30
mov edx, dword [0x42d450]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x69
ja case.0x402de1.3
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x402eec]
jmp dword [edx*4 + 0x402ed8]
push 0x11
push 0
call fcn.0040b2d0
add esp, 8
jmp 0x402e26
push 0x12
push 0
call fcn.0040b2d0
add esp, 8
jmp 0x402e26
push 0x13
push 0
call fcn.0040b2d0
add esp, 8
jmp 0x402e26
jmp 0x402e26
mov eax, dword [0x42d450]
push eax
push 0x14
push 0
call fcn.0040b2d0
add esp, 0xc
mov eax, 0x80004005
jmp 0x402ed1
mov dword [ebp - 4], 0
cmp dword [0x42d540], 0
jne 0x402ec8
cmp dword [0x42d44c], 0
je 0x402e68
lea ecx, [ebp - 4]
push ecx
mov edx, dword [0x42d44c]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x402e68
cmp dword [ebp - 4], 0
je 0x402ec6
mov eax, dword [ebp - 4]
and eax, 0x80070000
cmp eax, 0x80070000
je 0x402e89
mov ecx, dword [ebp - 4]
push ecx
push 0x21
push 0
call fcn.0040b2d0
add esp, 0xc
jmp 0x402ebf
mov edx, dword [ebp - 4]
and edx, 0xffff
cmp edx, 0xe
jne 0x402ea0
cmp dword [0x42d484], 0xffffffff
je 0x402ebf
mov eax, dword [ebp - 4]
and eax, 0xffff
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
push ecx
push 0x22
push 1
call fcn.0040b2d0
add esp, 0xc
mov eax, 0x80004005
jmp 0x402ed1
jmp 0x402ecf
mov eax, 0x80004005
jmp 0x402ed1
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x403510
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], 0x4297e8
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.004010d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40355a
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.004035a0
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00403570
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x403660
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x4297e8
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.004038c0
movzx ecx, al
test ecx, ecx
jne 0x403694
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.004012d0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00414ca0
mov esp, ebp
pop ebp
ret

Function at 0x403780
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea ecx, [ebp - 0x14]
call fcn.004010d0
push 2
lea ecx, [ebp - 0x14]
call fcn.004035a0
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 8], eax
push 0
lea ecx, [ebp - 0x14]
call fcn.004016c0
cmp dword [ebp - 8], 0
jbe 0x4037d9
mov eax, dword [ebp - 8]
add eax, 1
push eax
lea ecx, [ebp - 0x14]
call fcn.004035a0
push eax
mov ecx, dword [ebp - 8]
add ecx, 1
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x14]
call fcn.00403570
lea ecx, [ebp - 0x14]
call fcn.0040d8e0
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
jmp 0x4037f6
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0xfff
jge 0x40384c
mov eax, dword [ebp - 4]
add eax, 0xf
push eax
lea ecx, [ebp - 0x14]
call fcn.004035a0
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
lea edx, [ecx + eax*2]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.00403570
lea ecx, [ebp - 0x14]
call fcn.004012d0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40384a
jmp 0x40384c
jmp 0x4037ed
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402c60
lea ecx, [ebp - 0x14]
call fcn.00414ca0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x403d10
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x403d6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb7
je 0x403d46
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x403d74
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x403d6f
mov eax, dword [ebp - 4]
and eax, 0x10
jne 0x403d6f
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x403d74
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x403d80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.004010d0
push 1
push 1
lea ecx, [ebp - 0x10]
call fcn.004035a0
push eax
mov ecx, dword [ebp + 8]
call fcn.004012d0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403dbd
lea ecx, [ebp - 0x10]
call fcn.00414ca0
jmp 0x403dff
mov eax, dword [ebp - 4]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
add ecx, 1
push ecx
lea ecx, [ebp - 0x10]
call fcn.004035a0
push eax
mov ecx, dword [ebp + 8]
call fcn.004012d0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x10]
call fcn.00403570
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402370
lea ecx, [ebp - 0x10]
call fcn.00414ca0
mov esp, ebp
pop ebp
ret
Function at 0x404ec0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
call fcn.004016a0
push 0x429854
lea ecx, [ebp - 0xc]
call fcn.00419420
lea ecx, [ebp - 0x260]
push ecx
lea ecx, [ebp - 0xc]
call fcn.004012d0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x404ffd
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0xc]
call fcn.00401d50
push 0x5c
lea ecx, [ebp - 0xc]
call fcn.00401c50
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0xc]
call fcn.00419420
mov ecx, dword [ebp - 0x260]
and ecx, 0x10
je 0x404f95
push 0x429850
lea edx, [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x404f93
push 0x429848
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x404f93
lea ecx, [ebp - 0xc]
call fcn.004012d0
push eax
call fcn.00404ec0
add esp, 4
test eax, eax
jne 0x404f93
mov dword [ebp - 0x264], 0
lea ecx, [ebp - 0xc]
call fcn.00414ca0
mov eax, dword [ebp - 0x264]
jmp 0x40505e
jmp 0x404fda
push 0
lea ecx, [ebp - 0xc]
call fcn.004012d0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x404fbd
lea ecx, [ebp - 0xc]
call fcn.004012d0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x404fda
mov dword [ebp - 0x268], 0
lea ecx, [ebp - 0xc]
call fcn.00414ca0
mov eax, dword [ebp - 0x268]
jmp 0x40505e
lea ecx, [ebp - 0x260]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404f05
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, 0x42d4a0
call fcn.004012d0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40502c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x405046
mov dword [ebp - 0x26c], 0
lea ecx, [ebp - 0xc]
call fcn.00414ca0
mov eax, dword [ebp - 0x26c]
jmp 0x40505e
mov dword [ebp - 0x270], 1
lea ecx, [ebp - 0xc]
call fcn.00414ca0
mov eax, dword [ebp - 0x270]
mov esp, ebp
pop ebp
ret

Function at 0x405070
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40509a
mov eax, 1
jmp 0x4050db
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x258]
and eax, 0x10
jne 0x4050cf
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4050cb
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4050db
xor eax, eax
jmp 0x4050db
mov eax, dword [ebp + 8]
push eax
call fcn.00404ec0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x405c10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.004010d0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x405c5e
mov ecx, dword [ebp - 4]
add ecx, 1
push ecx
mov edx, dword [ebp - 4]
add edx, 1
push edx
lea ecx, [ebp - 0x10]
call fcn.004035a0
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp - 4]
push ecx
lea ecx, [ebp - 0x10]
call fcn.004016c0
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402c60
lea ecx, [ebp - 0x10]
call fcn.00414ca0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x405d70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 1
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x14]
call fcn.004010d0
mov edx, dword [ebp - 8]
add edx, 2
push edx
lea ecx, [ebp - 0x14]
call fcn.004035a0
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
add ecx, 2
push ecx
lea ecx, [ebp - 0x14]
call fcn.004035a0
push eax
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x14]
call fcn.00403570
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402c60
lea ecx, [ebp - 0x14]
call fcn.00414ca0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x406670
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x42d458], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.0040b560
push 3
call fcn.00405e60
add esp, 4
mov dword [0x42d47c], eax
push 2
call fcn.00405e60
add esp, 4
mov dword [0x42d478], eax
push 5
call fcn.00405e60
add esp, 4
mov dword [0x42d474], eax
push 0x15
call fcn.00405e60
add esp, 4
mov dword [0x42d470], eax
push 0x16
call fcn.00405e60
add esp, 4
mov dword [0x42d46c], eax
push 0x17
call fcn.00405e60
add esp, 4
mov dword [0x42d468], eax
mov dword [0x42d460], 0
mov eax, dword [0x42d460]
mov dword [0x42d464], eax
mov dword [ebp - 0x274], 0
jmp 0x40671d
mov ecx, dword [ebp - 0x274]
add ecx, 1
mov dword [ebp - 0x274], ecx
cmp dword [ebp - 0x274], 0x40
jge 0x4067dd
push 0
mov edx, dword [ebp - 0x274]
push edx
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4067d8
mov ecx, dword [ebp - 0x274]
push ecx
push 0x42a370
lea edx, [ebp - 0x270]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 1
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x270]
push ecx
call fcn.004036b0
add esp, 0xc
mov dword [ebp - 0x278], 0
jmp 0x406799
mov edx, dword [ebp - 0x278]
add edx, 1
mov dword [ebp - 0x278], edx
cmp dword [ebp - 0x278], 5
jae 0x4067d8
mov eax, dword [ebp - 0x278]
mov ecx, dword [eax*8 + 0x42a348]
cmp ecx, dword [ebp - 0x274]
jne 0x4067d6
push 0
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x278]
mov ecx, dword [eax*8 + 0x42a34c]
push ecx
call fcn.004036b0
add esp, 0xc
jmp 0x40678a
jmp 0x40670e
mov esp, ebp
pop ebp
ret

Function at 0x406870
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x406888
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, 0x42d514
call fcn.00415e50
cmp dword [ebp - 4], eax
jge 0x4068ec
mov ecx, dword [ebp - 4]
push ecx
mov ecx, 0x42d514
call fcn.00415e70
add eax, 0xc
push eax
lea ecx, [ebp - 0x10]
call fcn.00402c60
lea edx, [ebp - 0x10]
push edx
call fcn.00406840
add esp, 4
lea ecx, [ebp - 0x10]
call fcn.004012d0
push eax
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x42d514
call fcn.00415e70
mov ecx, eax
call fcn.004012d0
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea ecx, [ebp - 0x10]
call fcn.00414ca0
jmp 0x40687f
mov esp, ebp
pop ebp
ret