joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c8b0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x45c8fa
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x45c929
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x45c96b
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x4731e0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x473218
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00471297
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047126f
jmp 0x473224
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4748d5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x474917
call fcn.0047a385
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x474917
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47490e
xor eax, eax
jmp 0x47491f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00474925
pop edi
pop esi
pop ebx
ret 4

Function at 0x47a8b5
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47a8e3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47a901
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047a81b
jmp 0x47a901
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47a901
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047a81b
test edi, edi
mov eax, edi
jne 0x47a8eb
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x438b59
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00438d09
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x438c57
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x438bfa
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x438c3d
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x438c11
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x438c2c
test al, 0x40
je 0x438c23
mov ecx, dword [edi + 0x20]
jmp 0x438c2a
test al, 0x80
je 0x438c3d
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x438c3d
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x438bc9
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x4cb7570a
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x71227e34
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4013e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xcc
mov eax, dword [0x40e01c]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
push esi
push edi
xor edi, edi
push edi
mov dword [esp + 0x10], 0x40a2a0
mov dword [esp + 0x14], 0x401530
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x40e434], eax
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x3c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x48], 2
sete cl
mov byte [0x40e428], cl
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push str._service
push eax
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
test eax, eax
je 0x4014ab
cmp byte [0x40e428], 0
je 0x40147d
lea edx, [esp + 0xc]
push edx
mov byte [0x40e429], 1
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
jmp 0x40150b
push str.KERNEL32.DLL
mov byte [0x40e429], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.RegisterServiceProcess
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4014b2
mov byte [0x40e429], 0
call fcn.00401640
test al, al
je 0x401501
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
push edi
push edi
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x40150b
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4014e0
lea ecx, [esp + 0x1c]
push ecx
call edi
lea edx, [esp + 0x1c]
push edx
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
jne 0x4014e0
jmp 0x40150b
push str.An_error_occurred_while_starting_SlimFTPd.
call fcn.004063e0
call fcn.004018c0
mov ecx, dword [esp + 0xd4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00408d59
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402110
Capabilities:
Get hostname
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x204
mov eax, dword [0x40e01c]
xor eax, esp
mov dword [esp + 0x200], eax
push esi
mov esi, dword [sym.imp.MSVCR80.dll__stricmp]
push edi
mov edi, ecx
push 0x40aab0
push edi
call esi
add esp, 8
test eax, eax
jne 0x40215b
mov dword [0x40e45c], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.00408d59
add esp, 0x204
ret
push str.Local
push edi
call esi
add esp, 8
test eax, eax
jne 0x40217b
push 0x7f000001
call sub.WSOCK32.dll_htonl
mov dword [0x40e45c], eax
jmp 0x402142
push 0x40aabc
push edi
call esi
add esp, 8
test eax, eax
jne 0x402221
push 0x200
lea eax, [esp + 0xc]
push eax
mov dword [0x40e45c], 0xffffffff
call sub.WSOCK32.dll_gethostname
lea ecx, [esp + 8]
push ecx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x4021eb
mov edi, dword [eax + 0xc]
xor esi, esi
cmp dword [edi], esi
je 0x4021eb
mov eax, edi
mov edx, dword [eax]
mov eax, dword [edx]
push eax
call fcn.004052e0
add esp, 4
cmp eax, 1
je 0x4021e0
add esi, 1
cmp dword [edi + esi*4], 0
lea eax, [edi + esi*4]
jne 0x4021c0
jmp 0x4021eb
mov ecx, dword [edi + esi*4]
mov edx, dword [ecx]
mov dword [0x40e45c], edx
cmp dword [0x40e45c], 0xffffffff
jne 0x402142
push ebx
xor edi, edi
mov esi, str.BindInterface_directive_could_not_find_a_LAN_interface.
call fcn.00401990
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.00408d59
add esp, 0x204
ret
push 0x40aaf8
push edi
call esi
add esp, 8
test eax, eax
jne 0x4022c7
push 0x200
lea eax, [esp + 0xc]
push eax
mov dword [0x40e45c], 0xffffffff
call sub.WSOCK32.dll_gethostname
lea ecx, [esp + 8]
push ecx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x402291
mov edi, dword [eax + 0xc]
xor esi, esi
cmp dword [edi], esi
je 0x402291
mov eax, edi
mov edx, dword [eax]
mov eax, dword [edx]
push eax
call fcn.004052e0
add esp, 4
cmp eax, 2
je 0x402286
add esi, 1
cmp dword [edi + esi*4], 0
lea eax, [edi + esi*4]
jne 0x402266
jmp 0x402291
mov ecx, dword [edi + esi*4]
mov edx, dword [ecx]
mov dword [0x40e45c], edx
cmp dword [0x40e45c], 0xffffffff
jne 0x402142
push ebx
xor edi, edi
mov esi, str.BindInterface_directive_could_not_find_a_WAN_interface.
call fcn.00401990
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.00408d59
add esp, 0x204
ret
push edi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [0x40e45c], eax
jne 0x402142
push ebx
mov esi, str.BindInterface_directive_does_not_recognize_argument___s_.
call fcn.00401990
mov ecx, dword [esp + 0x20c]
add esp, 4
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.00408d59
add esp, 0x204
ret
Function at 0x404e30
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, edx
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404e36
push 0
sub eax, esi
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
setne al
pop esi
ret

Function at 0x404e60
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x114
push ebp
push esi
mov esi, eax
mov eax, dword [0x40e044]
xor ebp, ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebp
lea esp, [esp]
lea ecx, [esp + 8]
push ecx
push 0
push 0
lea edx, [esp + 0x1c]
push edx
push 0
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], 1
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x404eeb
test eax, eax
je 0x404eeb
push 0
push 1
push esi
push edi
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x404eeb
test eax, eax
je 0x404eeb
mov al, byte [esi]
cmp al, 0xd
jne 0x404ec9
mov byte [esi], 0
jmp 0x404ecd
cmp al, 0xa
je 0x404edd
cmp ebp, 0x1ff
jae 0x404ed8
add esi, 1
add ebp, 1
jmp 0x404e80
mov byte [esi], 0
mov eax, ebp
pop esi
pop ebp
add esp, 0x114
ret
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x114
ret

Function at 0x404f00
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status

Disassembly:
sub esp, 0x11c
push esi
mov esi, eax
test esi, esi
push edi
mov edi, ecx
je 0x404f8b
mov eax, dword [esi]
test eax, eax
je 0x404f8b
mov ecx, dword [0x40e048]
lea edx, [esp + 0x10]
push edx
push 0
mov dword [esp + 0x24], eax
push 0
lea eax, [esp + 0x24]
push eax
push 0
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
call sub.WSOCK32.dll_select
test eax, eax
mov dword [esp + 0xc], eax
je 0x404f70
cmp eax, 0xffffffff
je 0x404f70
mov edx, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push edi
push edx
mov dword [esp + 0x18], 0x10
call sub.WSOCK32.dll_accept
mov edi, eax
jmp 0x404f72
xor edi, edi
mov eax, dword [esi]
push eax
call sub.WSOCK32.dll_closesocket
mov dword [esi], 0
mov eax, edi
pop edi
pop esi
add esp, 0x11c
ret
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
push 0x10
mov esi, eax
push edi
push esi
call sub.WSOCK32.dll_connect
test eax, eax
je 0x404fb6
push esi
call sub.WSOCK32.dll_closesocket
xor eax, eax
pop edi
pop esi
add esp, 0x11c
ret
pop edi
mov eax, esi
pop esi
add esp, 0x11c
ret
Function at 0x404fd0
Capabilities:
Get socket status
Read and send data from client to server
Read file on windows
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x6d0
mov eax, dword [0x40e01c]
xor eax, esp
mov dword [esp + 0x6cc], eax
push ebx
push ebp
mov ebp, dword [esp + 0x6e0]
push esi
mov esi, edx
xor ebx, ebx
cmp esi, ebx
push edi
mov edi, ecx
mov dword [esp + 0x18], ebp
je 0x404fff
mov dword [esi], ebx
mov eax, dword [esp + 0x6ec]
sub eax, 1
je 0x4050ab
sub eax, 1
jne 0x405180
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, edi
mov eax, dword [0x40e048]
mov esi, dword [esp + 0x6e4]
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
lea edx, [esp + 0x2c]
push edx
push ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], 1
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x405074
cmp eax, ebx
je 0x405074
push ebx
push 0x5ac
lea eax, [esp + 0x130]
push eax
push esi
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x405077
or eax, 0xffffffff
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x405180
cmp eax, ebx
je 0x405176
push ebx
lea ecx, [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x134]
push edx
push ebp
call edi
test eax, eax
jne 0x405020
jmp 0x405180
push ebx
lea eax, [esp + 0x18]
push eax
push 0x5ac
lea ecx, [esp + 0x134]
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
call ebp
test eax, eax
je 0x405180
mov ebx, dword [sym.imp.MSVCR80.dll__stricmp]
jmp 0x4050e0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x405176
push 0
push eax
mov eax, dword [esp + 0x6ec]
lea edx, [esp + 0x130]
push edx
push eax
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x405180
lea ecx, [esp + 0x14]
push ecx
push 0x4004667f
push edi
call sub.WSOCK32.dll_ioctlsocket
cmp dword [esp + 0x14], 0
je 0x405151
lea eax, [esp + 0x128]
call fcn.00404e60
lea edx, [esp + 0x128]
push str.ABOR
push edx
call ebx
add esp, 8
test eax, eax
je 0x40517a
push 0
push 0x30
push str.500_Only_command_allowed_at_this_time_is_ABOR._r_n
push edi
call sub.WSOCK32.dll_send
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x18]
push eax
push 0x5ac
lea ecx, [esp + 0x134]
push ecx
push edx
call ebp
test eax, eax
jne 0x4050e0
jmp 0x405180
mov al, 1
jmp 0x405182
mov dword [esi], 1
xor al, al
mov ecx, dword [esp + 0x6dc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00408d59
add esp, 0x6d0
ret

Function at 0x4051a0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push edi
mov esi, eax
xor edi, edi
push edi
lea eax, [esp + 0x10]
push eax
push 1
push esi
push ebx
call ebp
test eax, eax
je 0x4051f0
mov edi, edi
cmp dword [esp + 0xc], 0
je 0x4051f8
mov al, byte [esi]
cmp al, 0xa
je 0x4051fc
cmp al, 0xd
je 0x4051df
add edi, 1
cmp edi, 0x200
jae 0x4051df
add esi, 1
push 0
lea ecx, [esp + 0x10]
push ecx
push 1
push esi
push ebx
call ebp
test eax, eax
jne 0x4051c0
pop edi
pop esi
or eax, 0xffffffff
pop ebp
pop ecx
ret
test edi, edi
je 0x4051f0
mov eax, edi
pop edi
mov byte [esi], 0
pop esi
pop ebp
pop ecx
ret
Function at 0x408100
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x409979
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x40e01c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov eax, dword [0x40e01c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
xor ebx, ebx
push edi
mov eax, esi
mov dword [esp + 0x34], ebx
call fcn.00407a80
add esp, 4
test eax, eax
je 0x408164
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, 1
jmp 0x4081ac
push esi
lea eax, [esp + 0xc]
push eax
push edi
call fcn.00407950
add esp, 0xc
test eax, eax
je 0x40814e
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
jae 0x408186
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x408198
test al, 0x10
je 0x408198
mov bl, 1
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00408d59
add esp, 0x2c
ret

Function at 0x408360
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x409979
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x40e01c]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x40e01c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
push esi
lea eax, [esp + 0xc]
push eax
push edi
mov dword [esp + 0x3c], 0
call fcn.00407950
add esp, 0xc
test eax, eax
je 0x4083d7
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
jae 0x4083c5
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4083d7
mov esi, 1
jmp 0x4083d9
xor esi, esi
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00408d59
add esp, 0x2c
ret
Function at 0x408410
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x409942
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x40e01c]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebp
push esi
mov eax, dword [0x40e01c]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x5c]
mov esi, ecx
lea ecx, [esp + 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0x54], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
push esi
lea eax, [esp + 0x30]
push eax
push edi
mov byte [esp + 0x60], 1
call fcn.00407950
add esp, 0xc
test eax, eax
je 0x4084c1
push esi
lea ecx, [esp + 0x14]
push ecx
push ebp
call fcn.00407950
add esp, 0xc
test eax, eax
je 0x4084c1
mov ecx, dword [esp + 0x14]
mov eax, 0x10
cmp dword [esp + 0x28], eax
jae 0x4084a0
lea ecx, [esp + 0x14]
cmp dword [esp + 0x44], eax
mov eax, dword [esp + 0x30]
jae 0x4084ae
lea eax, [esp + 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x4084c1
mov esi, 1
jmp 0x4084c3
xor esi, esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x54], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x54], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00408d59
add esp, 0x4c
ret 4

Function at 0x408510
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x409979
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x40e01c]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x40e01c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
push esi
lea eax, [esp + 0xc]
push eax
push edi
mov dword [esp + 0x3c], 0
call fcn.00407950
add esp, 0xc
test eax, eax
je 0x408589
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
jae 0x408575
lea eax, [esp + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x408589
mov esi, 1
jmp 0x40858b
xor esi, esi
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00408d59
add esp, 0x2c
ret
Function at 0x4085c0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x409979
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x40e01c]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x40e01c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
push esi
lea eax, [esp + 0xc]
push eax
push edi
mov dword [esp + 0x3c], 0
call fcn.00407950
add esp, 0xc
test eax, eax
je 0x408637
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
jae 0x408625
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x408637
mov esi, 1
jmp 0x408639
xor esi, esi
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00408d59
add esp, 0x2c
ret

Function at 0x408d59
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e01c]
jne 0x408d63
repz ret
jmp fcn.004090e0
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40701c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x407028
push 0x407024
push 0x407020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x407028]
push dword [0x407024]
push dword [0x407020]
mov dword [0x407014], esp
call fcn.004014e0
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret