joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x5c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
pop edi
add esp, 0x54
ret

Function at 0x402000
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [esp + 8]
ret 8

Function at 0x402030
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
ret 8

Function at 0x4015bc
Capabilities:
Encode data using xor

Disassembly:
push 0x40d330
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov esi, dword [edx + ebx*8 - 0x79]
fst qword [eax + ecx*2 - 0x5b4157bd]
invalid
Function at 0x25817901
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x25817910
pop dword [ebp - 0x50]
mov eax, 0x7493661d
add eax, 0xb0ee12f3
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xa8b09b1e
sub dword [ebp - 0x60], 0x5a5e55d3
mov dword [ebp - 0x5c], 0x27f6191
sub dword [ebp - 0x5c], 0xd04c154c
mov dword [ebp - 0x58], 0xe860c5c
add dword [ebp - 0x58], 0x3dc637d2
mov dword [ebp - 0x54], 0x207b4cc0
sub dword [ebp - 0x54], 0x207b4cc0
lea eax, [ebp - 0x60]
push eax
mov eax, 0xc3c7d9c
sub eax, 0xe6baad58
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x4016e73f
sub dword [ebp - 0x60], 0xcba47de9
mov dword [ebp - 0x5c], 0xf6a63b14
add dword [ebp - 0x5c], 0x4ac62661
mov dword [ebp - 0x58], 0x7c1c3037
add dword [ebp - 0x58], 0xe7533c35
mov dword [ebp - 0x54], 0xb175888a
add dword [ebp - 0x54], 0x4e8a7776
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xb9b1940f
add eax, 0x6bd03c71
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x39552
push 0
call eax
mov ecx, 0xc4972c5
add ecx, 0xf3b6c7f0
xor esi, esi
add esi, eax
mov edi, 0x878b30ce
add edi, 0x9df76532
add edi, dword [ebp - 0x50]
mov ebx, 0xc58649e0
xor dword [ebp - 0x38], 0xe3357fa4
mov edx, dword [edi]
add dword [ebp - 0x48], 0x795aa63c
add edx, ebx
xor dword [ebp - 0x20], ecx
mov dword [esi], edx
sub dword [ebp - 0x20], edx
add esi, 4
add edi, 0x3bd9c6f0
sub edi, 0x3bd9c6ec
loop 0x25817a2e
add eax, 0x19d47509
sub eax, 0x19d39762
mov ebx, eax
add eax, 0x6f9725e9
sub eax, 0x6f9725e4
mov ecx, 0x35b4134f
add ecx, 0xefcbecb1
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x403210
Capabilities:
Check for peb beingdebugged flag
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x41ccf7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42b75c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
mov dword [esp + 0x18], ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push ebx
call ebp
mov esi, dword [esp + 0x30]
mov edi, eax
mov ecx, esi
add edi, 2
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0x28], ebx
mov ebx, 1
push edi
mov ecx, esi
mov dword [esp + 0x18], ebx
call dword [sym.imp.mfc90.dll_Ordinal_2691]
push eax
push edi
call ebp
push 0xffffffffffffffff
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_5835]
push ebx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_5997]
push 0x420f50
mov ecx, eax
mov dword [esp + 0x2c], ebx
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
lea ecx, [esp + 0x18]
setne bl
mov byte [esp + 0x28], 0
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, bl
je 0x4032e6
push 0x420f50
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.00403140
add esp, 0xc
push eax
mov ecx, esi
mov dword [esp + 0x2c], 2
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 0
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x34]
sub eax, 1
je 0x403348
sub eax, 1
je 0x40331e
push str.MarsHtml_
lea edx, [esp + 0x38]
push esi
push edx
call fcn.00403140
add esp, 0xc
push eax
mov ecx, esi
mov dword [esp + 0x2c], 5
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [esp + 0x34]
jmp 0x403370
push str.mr_html_
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.00403140
add esp, 0xc
push eax
mov ecx, esi
mov dword [esp + 0x2c], 3
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [esp + 0x18]
jmp 0x403370
push str.hut_html_
lea ecx, [esp + 0x20]
push esi
push ecx
call fcn.00403140
add esp, 0xc
push eax
mov ecx, esi
mov dword [esp + 0x2c], 4
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4039e0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x41ce6a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x42b75c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], 0
mov esi, 0x5e78
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0x4211ec
push eax
push str.BBUILCID
push str.MagicNumber
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, dword [esp + 0x24]
push str.string_enu.ini
mov ecx, edi
mov ebx, eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov eax, ebx
and eax, 0x3ff
add eax, 0xfffffffc
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], 1
cmp eax, 0x1b
ja case.0x403a6b.13
jmp dword [eax*4 + 0x403bc0]
xor ecx, ecx
cmp ebx, 0x804
setne cl
mov eax, str.string_chs.ini
add ecx, 0x5e73
movzx esi, cx
cmp ebx, 0x804
je 0x403a98
mov eax, str.string_cht.ini
push eax
jmp 0x403b98
mov esi, 0x5e75
push str.string_csy.ini
jmp 0x403b98
mov esi, 0x5e76
push str.string_dan.ini
jmp 0x403b98
mov esi, 0x5e77
push str.string_deu.ini
jmp 0x403b98
mov esi, 0x5e78
push str.string_enu.ini
jmp 0x403b98
mov esi, 0x5e79
push str.string_esn.ini
jmp 0x403b98
mov esi, 0x5e7a
push str.string_fin.ini
jmp 0x403b98
mov esi, 0x5e7b
push str.string_fra.ini
jmp 0x403b98
mov esi, 0x5e7c
push str.string_ell.ini
jmp 0x403b98
mov esi, 0x5e7d
push str.string_hun.ini
jmp 0x403b98
mov esi, 0x5e7e
push str.string_ita.ini
jmp 0x403b98
mov esi, 0x5e7f
push str.string_jpn.ini
jmp 0x403b98
mov esi, 0x5e80
push str.string_kor.ini
jmp 0x403b98
mov esi, 0x5e81
push str.string_nld.ini
jmp 0x403b98
mov esi, 0x5e82
push str.string_nor.ini
jmp 0x403b98
mov esi, 0x5e83
push str.string_plk.ini
jmp 0x403b98
mov esi, 0x5e84
push str.string_ptb.ini
jmp 0x403b98
mov esi, 0x5e85
push str.string_rus.ini
jmp 0x403b98
mov esi, 0x5e86
push str.string_sve.ini
jmp 0x403b98
mov esi, 0x5e88
push str.string_trk.ini
mov ecx, edi
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x403bab
mov word [eax], si
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x403dd0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x7d4
mov eax, dword [0x42b75c]
xor eax, esp
mov dword [esp + 0x7d0], eax
push ebp
mov ebp, dword [esp + 0x7dc]
cmp dword [ebp], 0
je 0x403e98
cmp dword [ebp + 4], 0
je 0x403e98
push 0x7cf
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call sub.MSVCR90.dll_memset
mov eax, dword [esp + 0x7ec]
add esp, 0xc
test eax, eax
je 0x403e64
push ebx
push esi
push edi
lea ebx, [esp + 0x7ec]
mov edi, edi
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403e32
lea edi, [esp + 0x10]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403e40
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
add ebx, 4
mov ecx, eax
mov eax, dword [ebx]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test eax, eax
jne 0x403e30
pop edi
pop esi
pop ebx
lea eax, [esp + 4]
lea edx, [eax + 1]
jmp 0x403e70
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403e70
mov ecx, dword [ebp + 4]
push ecx
sub eax, edx
push 1
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
mov edx, dword [ebp + 4]
push edx
call dword [sym.imp.MSVCR90.dll_fflush]
add esp, 0x14
mov ecx, dword [esp + 0x7d4]
pop ebp
xor ecx, esp
call fcn.0041bd34
add esp, 0x7d4
ret

Function at 0x405200
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes
Write file on windows

Disassembly:
cmp dword [esp + 0x10], 0
push edi
mov edi, dword [esp + 0x10]
je 0x40521c
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4052a9
push ebx
push ebp
push esi
call sub.mfc90.dll_Ordinal_1137
mov ecx, dword [esp + 0x18]
movzx edx, word [esp + 0x14]
mov eax, dword [eax + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
call sub.mfc90.dll_Ordinal_1137
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
call sub.mfc90.dll_Ordinal_1137
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov edi, eax
lea eax, [esp + 0x24]
push eax
push ebx
push ebp
push edi
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
pop ebp
pop ebx
pop edi
ret
Function at 0x405b00
Capabilities:
Create process on windows
Get geographical location
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x41d232
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x42b75c]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov eax, dword [0x42b75c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0x4211ec
push eax
push str.BBUILCID
push str.MagicNumber
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
push 5
lea eax, [esp + 0x18]
push eax
push 3
push esi
mov dword [esp + 0x24], 0x554e45
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_316]
push str.hpdjjs.com
mov dword [esp + 0x2c], 0
call fcn.00403980
add esp, 4
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov eax, dword [esp + 0x10]
movzx ecx, si
push ecx
lea edx, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x18]
push str.http:___s_jumpstation_actionprivacystatementlang_slangid0x_04Xcontextoverland
push ecx
mov byte [esp + 0x3c], 1
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0x14
test edi, edi
je 0x405bc4
mov edi, dword [edi + 0x20]
push 1
push 0
push 0
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
push 0
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041bd34
add esp, 0x20
ret
Function at 0x408cd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41d808
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
mov eax, dword [0x42b75c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x186c]
push eax
lea ecx, [esp + 0x30]
call fcn.00401a40
push eax
lea ecx, [esp + 0x18]
push 0x421268
push ecx
mov dword [esp + 0x4c], 0
call fcn.00401ea0
add esp, 0xc
lea ecx, [esp + 0x2c]
mov byte [esp + 0x40], 2
call fcn.00401cb0
lea ecx, [esp + 0xc]
call fcn.004019f0
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 3
call fcn.004019f0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 4
call fcn.004019f0
mov ecx, esi
mov byte [esp + 0x40], 5
call fcn.00404150
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
push str.ThresholdConsent
push eax
call fcn.00414960
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x28]
push ecx
push str.ContentConsent
push edx
call fcn.00414960
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x24]
push eax
push str.HUTtype
push ecx
call fcn.00414960
add esp, 0x24
push str.Threshold
lea ecx, [esp + 0x10]
call fcn.00401750
test eax, eax
jne 0x408dde
sub esp, 8
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
call fcn.00401a10
mov ecx, esi
call fcn.00404370
mov eax, dword [esi + 0x38d8]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
push str.Content
lea ecx, [esp + 0x10]
call fcn.00401750
test eax, eax
jne 0x408e23
sub esp, 8
lea edx, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
call fcn.00401a10
mov ecx, esi
call fcn.00406060
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push 0x42099c
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov ecx, esi
call fcn.00405cf0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 4
call fcn.00401cb0
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 3
call fcn.00401cb0
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 2
call fcn.00401cb0
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], 0xffffffff
call fcn.00401cb0
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41d8a7
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x42b75c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x38], 1
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov esi, dword [esp + 0x40]
mov ecx, esi
mov byte [esp + 0x38], 4
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
push eax
push ecx
push edx
lea eax, [esp + 0x18]
push str._s__s__s
push eax
mov dword [esp + 0x28], 1
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0x14
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_4477]
push esi
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [edi + 0x38f4]
call sub.mfc90.dll_Ordinal_4463
push str.__DeactivationDate
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_1607]
test eax, eax
jne 0x409337
push eax
call dword [sym.imp.MSVCR90.dll__time64]
fldz
add esp, 4
fstp qword [esp + 0x24]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x30], 0
call fcn.00406d50
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push 0x400
mov dword [esp + 0x1c], edx
push 2
lea edx, [esp + 0x18]
mov dword [esp + 0x28], ecx
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x28], eax
call fcn.00404db0
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov byte [esp + 0x3c], 5
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x44]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x48]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x4c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 0x10
Function at 0x40bb10
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x40f700
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x41e368
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x42b75c]
xor eax, esp
mov dword [esp + 0x284], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42b75c]
xor eax, esp
push eax
lea eax, [esp + 0x29c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2b8]
mov esi, dword [esp + 0x2ac]
mov ebp, dword [esp + 0x2b0]
mov ebx, dword [esp + 0x2b4]
mov edi, dword [esp + 0x2bc]
push 0x13c
lea ecx, [esp + 0x58]
push 0
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x5c], 0
call sub.MSVCR90.dll_memset
xor edx, edx
push 0x104
push edx
lea eax, [esp + 0x1a6]
push eax
mov word [esp + 0x1a8], dx
call sub.MSVCR90.dll_memset
add esp, 0x18
lea ecx, [esp + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov ecx, dword [esp + 0x14]
push ecx
push ebx
push ebp
lea edx, [esp + 0x19c]
push esi
push edx
mov dword [esp + 0x2b8], 0
call dword [sym.imp.MSVCR90.dll__makepath]
add esp, 0x14
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x194]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov ebx, 1
cmp esi, 0xffffffff
je 0x40f837
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, edi
lea edx, [esp + 0x7c]
push edx
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov byte [esp + 0x2a8], bl
call fcn.0040f4e0
lea ecx, [esp + 0x18]
mov byte [esp + 0x2a4], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x50]
push ecx
push esi
call ebp
test eax, eax
jne 0x40f7f0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x34]
mov dword [esp + 0x2a4], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, ebx
mov ecx, dword [esp + 0x29c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x284]
xor ecx, esp
call fcn.0041bd34
add esp, 0x294
ret
Function at 0x40fed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x108
mov eax, dword [0x42b75c]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
test esi, esi
je 0x40ff47
push 0x103
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0
lea ecx, [esp + 8]
push ecx
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0041bd34
add esp, 0x108
ret
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
xor al, al
call fcn.0041bd34
add esp, 0x108
ret
Function at 0x410960
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x41e454
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x42b75c]
xor eax, esp
mov dword [esp + 0x194], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42b75c]
xor eax, esp
push eax
lea eax, [esp + 0x1ac]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1bc]
mov esi, dword [esp + 0x1c0]
mov edi, dword [esp + 0x1c4]
xor ebx, ebx
push 0x13c
lea eax, [esp + 0x70]
push ebx
push eax
mov dword [esp + 0x74], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebp
lea ecx, [esp + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x1b8], ebx
call fcn.00410590
add esp, 4
push esi
lea ecx, [esp + 0x34]
call dword [0x42017c]
lea edx, [esp + 0x68]
push edx
lea ecx, [esp + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x410a9e
push ebp
lea ecx, [esp + 0x50]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [esp + 0x4c]
push eax
mov byte [esp + 0x1b8], 1
call fcn.00410590
mov ebp, dword [sym.imp.MSVCP90.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char__struct_std::char_traits_char___class_std::allocator_char___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
add esp, 4
lea ecx, [esp + 0x94]
push ecx
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x1c]
push eax
call ebp
add esp, 0xc
push eax
mov ecx, edi
mov byte [esp + 0x1b8], 2
call fcn.0040f4e0
lea ecx, [esp + 0x14]
mov byte [esp + 0x1b4], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x68]
push ecx
push esi
call ebx
test eax, eax
jne 0x410a40
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x4c]
mov byte [esp + 0x1b4], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x30]
mov dword [esp + 0x1b4], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, 1
mov ecx, dword [esp + 0x1ac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0041bd34
add esp, 0x1a4
ret