joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100085e3
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10015580]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.10006f45
mov dword [ebp - 0x14], eax
cmp dword [0x10016c54], edi
jne 0x100086d4
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x10008661
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100087b4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x100087b4
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100087b4
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x10016c54], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x10016c58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x10016c5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10016c64], eax
test eax, eax
je 0x100086d1
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10016c60], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100086f9
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100086ec
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x1000870e
push 4
pop eax
jmp 0x100087b6
cmp dword [ebp - 0x14], edi
je 0x1000870e
push dword [0x10016c54]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100086f3
mov eax, dword [0x10016c60]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x1000876c
cmp dword [0x10016c64], esi
je 0x1000876c
push eax
call ebx
push dword [0x10016c64]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1000876c
test eax, eax
je 0x1000876c
call ecx
test eax, eax
je 0x10008761
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10008761
test byte [ebp - 8], 1
jne 0x1000876c
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x1000879c
mov eax, dword [0x10016c58]
cmp eax, esi
je 0x10008799
push eax
call ebx
test eax, eax
je 0x10008799
call eax
mov edi, eax
test edi, edi
je 0x10008799
mov eax, dword [0x10016c5c]
cmp eax, esi
je 0x10008799
push eax
call ebx
test eax, eax
je 0x10008799
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x10016c54]
call ebx
test eax, eax
je 0x100087b4
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x100087b6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100074a5
leave
ret
Function at 0x401d25
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x412320]
xor eax, ebp
mov dword [ebp + 0x1a0], eax
mov eax, dword [ebp + 0x1ac]
push ebx
push esi
mov esi, dword [ebp + 0x1b0]
push 0x104
lea ecx, [ebp - 0x68]
push ecx
push 0xffffffffffffffff
push eax
xor ebx, ebx
push ebx
push 0xfde9
mov dword [ebp - 0x6c], 0xfffffffd
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
je 0x401e01
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x78], eax
cmp eax, ebx
je 0x401e01
push edi
mov edi, dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
push ebx
call edi
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x70], eax
cmp eax, ebx
je 0x401e00
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x68]
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x401df3
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x40e484
push dword [ebp - 0x70]
mov dword [ebp - 0x74], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x401df3
mov eax, dword [ebp - 0x7c]
movzx ecx, word [eax + 0xa]
mov dword [esi], ecx
movzx ecx, word [eax + 8]
mov dword [esi + 4], ecx
movzx ecx, word [eax + 0xe]
mov dword [esi + 8], ecx
movzx eax, word [eax + 0xc]
mov dword [esi + 0xc], eax
mov dword [ebp - 0x6c], ebx
push dword [ebp - 0x70]
push ebx
call edi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
pop edi
mov ecx, dword [ebp + 0x1a0]
mov eax, dword [ebp - 0x6c]
pop esi
xor ecx, ebp
pop ebx
call fcn.004024bc
add ebp, 0x1a4
leave
ret

Function at 0x4024bc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412320]
jne 0x4024c6
repz ret
jmp fcn.00403ae7

Function at 0x40269e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x4026ad
pop dword [ebp - 0x38]
mov eax, 0x54b8f1ef
sub eax, 0x5478cb42
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x39125
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0xa9099f81
sub ecx, 0xa9095a04
xor ebx, ebx
add ebx, eax
mov edi, 0x9aecb773
sub edi, 0x9aab3f73
add edi, dword [ebp - 0x38]
mov edx, 0x6fddda62
mov esi, dword [edi]
sub dword [ebp - 0x18], esi
sub esi, edx
xor dword [ebp - 4], 0xa0affb80
mov dword [ebx], esi
mov dword [ebp - 0x30], 0x9622787d
add ebx, 4
add edi, 0x6c23a3bb
sub edi, 0x6c23a3b7
loop 0x402703
add eax, 0x506ac7dc
sub eax, 0x5069bf15
mov ebx, eax
add eax, 5
mov ecx, 0x8550d592
add ecx, 0x7aef2a6e
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x403e59
pop dword [ebp - 0x50]
mov eax, 0xda10da6a
sub eax, 0xd9d09c11
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x597d3c65
sub dword [ebp - 0x60], 0xb2af71a
mov dword [ebp - 0x5c], 0x1982568a
sub dword [ebp - 0x5c], 0xe74f0a45
mov dword [ebp - 0x58], 0xc68e21bd
sub dword [ebp - 0x58], 0x7a41dd8f
mov dword [ebp - 0x54], 0x3fbb488e
sub dword [ebp - 0x54], 0x3fbb488e
lea eax, [ebp - 0x60]
push eax
mov eax, 0xdf10fbf4
sub eax, 0xded08b90
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x11c6a51d
sub dword [ebp - 0x60], 0x9d543bc7
mov dword [ebp - 0x5c], 0x249e4ba
sub dword [ebp - 0x5c], 0xc0dd8345
mov dword [ebp - 0x58], 0xe3b5f1be
sub dword [ebp - 0x58], 0x80468552
mov dword [ebp - 0x54], 0x5b9555fd
add dword [ebp - 0x54], 0xa46aaa03
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x966d2c92
sub eax, 0x962cbbea
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x38d81
push 0
call eax
mov ecx, 0xcbdb54b4
add ecx, 0x3424fbaf
mov esi, eax
mov edi, 0x35a48b22
sub edi, 0x35638b22
add edi, dword [ebp - 0x50]
mov edx, 0x38091314
add edx, 0x9892f66c
sub dword [ebp - 0x1c], 0x6a20281e
mov ebx, dword [edi]
xor dword [ebp - 0x48], esi
xor ebx, edx
add dword [ebp - 0xc], ebx
mov dword [esi], ebx
add esi, 4
add edi, 0x2a749427
add edi, 0xd58b6bdd
loop 0x403f7b
add eax, 0xd055ceae
sub eax, 0xd0549a4f
xor ebx, ebx
add ebx, eax
add eax, 0x8209aa35
sub eax, 0x8209aa30
mov ecx, 0x7ed7e4b7
sub ecx, 0x7e97e4b7
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x402000
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret

Function at 0x402810
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00402820

Function at 0x402b90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00402ba0

Function at 0x404b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x404cd8
cmp dword [esi + 0x20], 0
je 0x404cd8
cmp dword [esi + 0x24], 0
je 0x404cd8
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x404cd8
cmp dword [eax], esi
jne 0x404cd8
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x404bb7
cmp eax, 0x39
je 0x404bb7
cmp eax, 0x45
je 0x404bb7
cmp eax, 0x49
je 0x404bb7
cmp eax, 0x5b
je 0x404bb7
cmp eax, 0x67
je 0x404bb7
cmp eax, 0x71
je 0x404bb7
cmp eax, 0x29a
jne 0x404cd8
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x404bf0
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x404c12
call fcn.00402b90
jmp 0x404c17
call fcn.00402810
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.004081b0
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.00415660
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x43194a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x431948]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x43194c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x43194e]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
pop ebp
ret
mov eax, 0xfffffffe
pop esi
pop ebp
ret
Function at 0x40c3f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ef85
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x459a44]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
add eax, 4
mov dword [ebp - 0x18], eax
push 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.00413963
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
add esp, 4
mov dword [ebp - 0x14], eax
lea esi, [eax + 8]
mov edx, dword [ecx]
mov ecx, edx
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c460
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.004098d0
cmp dword [esi + 0x14], 0x10
mov edx, esi
mov dword [ebp - 4], 1
jb 0x40c483
mov edx, dword [esi]
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [esi + 0x10], ecx
jbe 0x40c4a2
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [esi + 0x10]
jb 0x40c490
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push edi
push esi
push eax
call fcn.0040c230
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c52e
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov byte [edi + 4], 0
test eax, eax
je 0x40c519
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x40c4fd
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x40c4f0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c5c1
mov eax, edx
push ecx
push eax
call fcn.00413993
mov eax, dword [ebp - 0x14]
add esp, 8
push 0x20
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.00413993
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
cmp eax, 0x7ffffff
je 0x40c5c6
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4339a0]
mov eax, dword [ecx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4339a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ecx]
jbe 0x40c596
call fcn.0040e770
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push edi
push esi
push eax
call fcn.0040c230
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax]
jmp 0x40c599
mov edx, dword [ebp - 0x20]
push dword [ebp - 0x14]
push edx
push edi
call fcn.0040e520
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.0041719f
push str.unordered_map_set_too_long
call fcn.004131ab
int3
Function at 0x40f120
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
pop ebp
ret
Function at 0x411060
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
mov dword [ebp - 8], esi
push str.CommandLineToArgvW_failure
setne cl
movzx ecx, cl
push ecx
push 0xfe4
push str.D:_acactuscactus_src_base_system.cpp
call fcn.00411220
cmp dword [ebp - 4], 0
push str.Invalid_argc_value
setg al
movzx eax, al
push eax
push 0xfe5
push str.D:_acactuscactus_src_base_system.cpp
call fcn.00411220
mov eax, dword [ebp - 4]
add esp, 0x20
xor ebx, ebx
xor edi, edi
test eax, eax
jle 0x411119
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [esi + edi*4]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
push str.WideCharToMultiByte_failure
setne cl
movzx ecx, cl
push ecx
push 0xfec
push str.D:_acactuscactus_src_base_system.cpp
call fcn.00411220
mov eax, dword [ebp - 4]
add ebx, esi
mov esi, dword [ebp - 8]
inc edi
add esp, 0x10
cmp edi, eax
jl 0x4110d0
lea eax, [eax*4 + 4]
push eax
call fcn.0041720b
push ebx
mov dword [ebp - 0xc], eax
call fcn.0041720b
mov edi, eax
mov eax, dword [ebp - 0xc]
push ebx
push 0
push edi
mov dword [eax], edi
call fcn.00415660
add esp, 0x14
mov dword [ebp - 0x14], 0
cmp dword [ebp - 4], 0
jle 0x4111b8
mov ecx, dword [ebp - 0xc]
mov edx, esi
sub edx, ecx
mov dword [ebp - 0x10], ecx
mov eax, ecx
mov dword [ebp - 0x18], edx
nop
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push dword [edx + eax]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
push str.WideCharToMultiByte_failure
setne cl
movzx ecx, cl
push ecx
push 0xff8
push str.D:_acactuscactus_src_base_system.cpp
call fcn.00411220
mov eax, dword [ebp - 0x10]
add edi, esi
mov ecx, dword [ebp - 0x14]
add eax, 4
mov edx, dword [ebp - 0x18]
inc ecx
add esp, 0x10
mov dword [ebp - 0x10], eax
sub ebx, esi
mov dword [ebp - 0x14], ecx
mov dword [eax], edi
cmp ecx, dword [ebp - 4]
jl 0x411160
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [edx + eax*4], 0
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret
Function at 0x411350
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f1ed
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x459a44]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
lea ecx, [ebp - 0x28]
push 0x30
push esi
call fcn.004105d0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
cmovae ecx, dword [ebp - 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x411422
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.00412cd0
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
cmovae ecx, dword [ebp - 0x40]
push ecx
push esi
push str.GetCurrentDirectoryW_failed:__ld__s
push str.filesystem
call fcn.00411330
mov ecx, dword [ebp - 0x2c]
add esp, 0x18
mov byte [ebx], 0
cmp ecx, 0x10
jb 0x41141e
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411414
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4114c2
push ecx
push edx
call fcn.00413993
add esp, 8
xor ebx, ebx
jmp 0x41146f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00412f50
add esp, 8
cmp byte [ebp - 0x44], 0
mov byte [ebx], 0
jne 0x411447
xor ebx, ebx
jmp 0x411467
cmp dword [ebp - 0x48], 0x10
lea ecx, [ebp - 0x5c]
mov eax, dword [ebp + 0xc]
cmovae ecx, dword [ebp - 0x5c]
dec eax
push eax
push ecx
push ebx
call fcn.0041c310
push ebx
call fcn.00412b30
add esp, 0x10
lea ecx, [ebp - 0x5c]
call fcn.004108f0
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x4114a5
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41149b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4114c7
push ecx
push edx
call fcn.00413993
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413b9e
mov esp, ebp
pop ebp
ret
call fcn.0041719f
call fcn.0041719f
int3
Function at 0x4114d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x459a44]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00412e10
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 8
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x411513
test al, 0x10
je 0x411513
mov esi, 1
jmp 0x411515
xor esi, esi
mov ecx, dword [ebp - 8]
cmp ecx, 8
jb 0x41154b
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411541
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41155c
push ecx
push edx
call fcn.00413993
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00413b9e
mov esp, ebp
pop ebp
ret
call fcn.0041719f
int3
Function at 0x4116a0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f23b
mov eax, dword fs:[0]
push eax
sub esp, 0x490
mov eax, dword [0x459a44]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x480], eax
mov eax, dword [ebp + 0x14]
push str._s_
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x210]
push 0x200
push eax
call fcn.00412780
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.00412e10
add esp, 0x18
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x478]
lea eax, [ebp - 0x228]
mov dword [ebp - 4], 0
cmovae eax, dword [ebp - 0x228]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x411863
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop word [eax + eax]
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.00412f50
add esp, 8
cmp byte [ebp - 0x484], 0
mov byte [ebp - 4], 1
jne 0x41178a
push edi
push str.ERROR:_file_folder_name_containing_invalid_UTF_16_found_in_folder__s
push str.filesystem
push 0
call fcn.0040feb0
add esp, 0x10
jmp 0x4117c2
cmp dword [ebp - 0x488], 0x10
lea ecx, [ebp - 0x49c]
push dword [ebp - 0x47c]
cmovae ecx, dword [ebp - 0x49c]
mov eax, dword [ebp - 0x478]
push dword [ebp + 0x10]
shr eax, 4
and eax, 1
push eax
push ecx
call dword [ebp - 0x480]
add esp, 0x10
test eax, eax
jne 0x41181d
cmp byte [ebp - 0x484], 0
mov byte [ebp - 4], 0
je 0x411809
mov ecx, dword [ebp - 0x488]
cmp ecx, 0x10
jb 0x411809
mov edx, dword [ebp - 0x49c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4117ff
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118bb
push ecx
push edx
call fcn.00413993
add esp, 8
lea eax, [ebp - 0x478]
push eax
push esi
call ebx
test eax, eax
jne 0x411750
jmp 0x41185c
cmp byte [ebp - 0x484], 0
je 0x41185c
mov ecx, dword [ebp - 0x488]
cmp ecx, 0x10
jb 0x41185c
mov edx, dword [ebp - 0x49c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411852
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118bb
push ecx
push edx
call fcn.00413993
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x214]
cmp ecx, 8
jb 0x41189f
mov edx, dword [ebp - 0x228]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411895
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118c0
push ecx
push edx
call fcn.00413993
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413b9e
mov esp, ebp
pop ebp
ret
call fcn.0041719f
call fcn.0041719f
int3