joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov esi, dword [0x429fa8]
xor ebx, ebx
push edi
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
add ebp, esi
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add edi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x4015b7
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
add eax, esi
push eax
call fcn.00401741
lea ecx, [esp + 0x1c]
call fcn.0040131c
cmp eax, dword [esp + 0x14]
je 0x4015cf
lea ecx, [esp + 0x1c]
add edi, 4
call fcn.0040171e
inc ebx
cmp ebx, dword [esp + 0x18]
jb 0x401587
xor edi, edi
mov ecx, dword [esp + 0x34]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401a79
add esp, 0x2c
ret
mov eax, dword [ebp + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x1c]
call fcn.0040171e
jmp 0x4015b9

Function at 0x401652
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
movsd xmm0, qword [0x4198a8]
push esi
push edi
push ecx
push ecx
movsd qword [esp], xmm0
push 0x419890
call fcn.00401006
add esp, 0xc
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x429fa8], eax
push 0x27
mov esi, 0x428f30
mov edx, 0x547
push 0x41b900
mov ecx, esi
call fcn.00401112
pop ecx
pop ecx
mov edx, 0x8aafdc01
call fcn.00401550
lea ecx, [ebp - 4]
push ecx
push 0x40
push 0x4e4
push esi
call eax
test eax, eax
je 0x4016c8
call fcn.004015ed
push 0x1000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x4016e0
or eax, 0xffffffff
jmp 0x4016f6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
call dword [sym.imp.KERNEL32.dll_GetSystemFileCacheSize]
xor eax, eax
pop edi
pop esi
leave
ret 0x10

Function at 0x402327
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402366
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402366
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402366
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402366
cmp dword [ecx + 0x74], 0xe
jbe 0x402366
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x408324
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4155b8
push 0x4155b0
push str.FlsAlloc
push 0x1e
call fcn.00408242
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408358
push dword [ebp + 8]
mov ecx, esi
call dword [0x414118]
call esi
jmp 0x40835e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x412f50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x412f7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x412f7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x432006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x4ca258ed
nop
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..tls
nop
mov ebx, 0x42f314
nop
mov ecx, 0x35c71bd2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x3000ff10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x30004da4
push 0x30004d88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x3000ff45
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ebx, 0x30004d84
push ebx
call edi
test esi, esi
mov dword [0x30004d84], esi
jne 0x3000ffa9
mov dword [0x30004d84], 0xbb40e64e
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ebx
call edi
pop edi
pop esi
mov dword [0x3001242c], 0x44bf19b1
pop ebx
leave
ret

Function at 0x3000ffc4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x30004d84]
jne 0x30010aa7
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x300126b8], eax
mov dword [0x300126b4], ecx
mov dword [0x300126b0], edx
mov dword [0x300126ac], ebx
mov dword [0x300126a8], esi
mov dword [0x300126a4], edi
mov word [0x300126d0], ss
mov word [0x300126c4], cs
mov word [0x300126a0], ds
mov word [0x3001269c], es
mov word [0x30012698], fs
mov word [0x30012694], gs
pushfd
pop dword [0x300126c8]
mov eax, dword [ebp]
mov dword [0x300126bc], eax
mov eax, dword [ebp + 4]
mov dword [0x300126c0], eax
lea eax, [ebp + 8]
mov dword [0x300126cc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x30012608], 0x10001
mov eax, dword [0x300126c0]
mov dword [0x300125bc], eax
mov dword [0x300125b0], 0xc0000409
mov dword [0x300125b4], 1
mov eax, dword [0x30004d84]
mov dword [ebp - 0x328], eax
mov eax, dword [0x3001242c]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x30012600], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x30005110
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x30012600], 0
jne 0x30010b97
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x3000ffd1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x30004dd0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x30010029
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0
push 0
push 0x30004dc8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x30010029
mov al, 1
jmp 0x3001002b
xor al, al
leave
ret 8
Function at 0x3001086e
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x30010f28
call fcn.30010966
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x300128ec
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x3001060d
cmp eax, esi
jne 0x30010600
xor esi, esi
inc esi
mov ebx, esi
jmp 0x30010610
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x300105e7
xor esi, esi
inc esi
mov eax, dword [0x300128e8]
cmp eax, esi
jne 0x30010623
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x30010652
mov eax, dword [0x300128e8]
test eax, eax
jne 0x3001064c
mov dword [0x300128e8], esi
push 0x300012b0
push 0x300012a8
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x30010652
jmp 0x3001077a
mov dword [0x300125ac], esi
mov eax, dword [0x300128e8]
cmp eax, esi
jne 0x30010676
push 0x300012a4
push 0x30001284
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x300128e8], 2
test ebx, ebx
jne 0x30010682
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x300128f8], 0
je 0x300106a6
push 0x300128f8
call fcn.30010c6a
pop ecx
test eax, eax
je 0x300106a6
push 0
push 2
push 0
call dword [0x300128f8]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x30010702
test al, al
je 0x300106c0
cmp dword [ebp - 0x1c], 0
jne 0x30010702
mov al, byte [esi]
test al, al
je 0x300106d0
cmp al, 0x20
ja 0x300106d0
inc esi
mov dword [ebp - 0x20], esi
jmp 0x300106c0
test byte [ebp - 0x3c], 1
je 0x300106dc
movzx eax, word [ebp - 0x38]
jmp 0x300106df
push 0xa
pop eax
push eax
push esi
push 0
push 0x30000000
call main
mov dword [0x300125a8], eax
cmp dword [0x3001259c], 0
jne 0x30010756
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x30010711
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x30010724
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x300106ad
cmp dword [0x300125ac], 0
jne 0x30010765
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x300125a8]
jmp 0x30010786
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.300109ab
ret
call fcn.3000ff10
jmp 0x300105ad
Function at 0x13a7058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.013a71a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x13a707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13a706a
add dl, dl
jne 0x13a7089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13a70dc
xor eax, eax
add dl, dl
jne 0x13a7096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13a717d
add dl, dl
jne 0x13a70a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13a70b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13a70bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13a70c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x13a70d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x13a7075
mov eax, 1
add dl, dl
jne 0x13a70ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13a70f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13a70e1
sub eax, ebx
mov ebx, 1
jne 0x13a7128
mov ecx, 1
add dl, dl
jne 0x13a710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x13a7119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13a7105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13a7075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x13a713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x13a714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13a7136
cmp eax, 0x7d00
jae 0x13a716d
cmp eax, 0x500
jb 0x13a7168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13a7075
cmp eax, 0x7f
ja 0x13a7170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13a7075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x13a719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x13a7075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x719058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007191a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x71907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x71906a
add dl, dl
jne 0x719089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7190dc
xor eax, eax
add dl, dl
jne 0x719096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x71917d
add dl, dl
jne 0x7190a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7190b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7190bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7190c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7190d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x719075
mov eax, 1
add dl, dl
jne 0x7190ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7190f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7190e1
sub eax, ebx
mov ebx, 1
jne 0x719128
mov ecx, 1
add dl, dl
jne 0x71910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x719119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x719105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x719075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x71913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x71914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x719136
cmp eax, 0x7d00
jae 0x71916d
cmp eax, 0x500
jb 0x719168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x719075
cmp eax, 0x7f
ja 0x719170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x719075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x71919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x719075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401ba0
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x401bc3
xor eax, eax
pop ebx
add esp, 0x208
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov esi, eax
test esi, esi
je 0x401c27
push 0x104
lea eax, [esp + 0x10]
push eax
push str..tmp
push ebx
push 0
call fcn.00401a10
add esp, 0x14
test eax, eax
je 0x401c27
lea ecx, [esp + 0xc]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x401c23
push 4
xor esi, esi
push esi
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x401c27
call edi
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x208
ret
call edi
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x208
ret

Function at 0x401fd0
Capabilities:
Get common file path

Disassembly:
cmp dword [esp + 0xc], 0
push esi
push edi
mov edi, dword [esp + 0x10]
jne 0x402007
push 0
call fcn.00403c90
add esp, 4
test eax, eax
je 0x402007
mov esi, dword [esp + 0xc]
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x40205c
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
cmp word [0x475370], 0
jne 0x402043
push 0x104
push 0x475370
push str.DYNAMORIO_HOME
push 0
push 0x461214
call fcn.004067e0
add esp, 0x14
test eax, eax
jne 0x40203c
cmp word [0x475370], ax
jne 0x402043
mov eax, 0x461158
jmp 0x402048
mov eax, 0x475370
mov esi, dword [esp + 0xc]
push eax
push str._slib
push edi
push esi
call fcn.00431593
add esp, 0x10
xor eax, eax
mov word [esi + edi*2 - 2], ax
cmp dword [esp + 0x18], eax
je 0x402072
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
pop edi
xor eax, eax
pop esi
ret

Function at 0x4020f0
Capabilities:
Delete registry key

Disassembly:
push ecx
mov eax, dword [0x47536c]
test eax, eax
jne 0x40210a
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x47536c], eax
cmp dword [0x475368], 0
jne 0x40213e
test eax, eax
je 0x40212c
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x475368], eax
test eax, eax
jne 0x40213e
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop ecx
ret
lea edx, [esp]
push edx
mov dword [esp + 4], 0
call fcn.00401ca0
mov eax, dword [esp + 4]
add esp, 4
cmp eax, 0x82
je 0x4021a6
cmp eax, 0x64
je 0x4021a6
mov eax, dword [0x475780]
sub eax, 0
je 0x4021a6
dec eax
je 0x40218c
dec eax
jne 0x4021a6
mov ecx, dword [esp + 8]
push 0
mov eax, 0x100
push eax
mov eax, dword [esp + 0x14]
push eax
push ecx
call dword [0x475368]
pop ecx
ret
mov ecx, dword [esp + 8]
push 0
mov eax, 0x200
push eax
mov eax, dword [esp + 0x14]
push eax
push ecx
call dword [0x475368]
pop ecx
ret
mov ecx, dword [esp + 8]
xor eax, eax
push eax
push eax
mov eax, dword [esp + 0x14]
push eax
push ecx
call dword [0x475368]
pop ecx
ret
Function at 0x4025a0
Capabilities:
Acquire debug privileges

Disassembly:
cmp dword [0x475784], 0
je 0x4025af
mov eax, 0x4df
ret
push 0x475784
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x4025e7
push 0x475784
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4025e7
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x476494
push str.SeDebugPrivilege
push 0
mov dword [0x476490], 1
mov dword [0x47649c], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [0x475784]
push section..data
push 0x4764b0
push 0x10
push 0x476490
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x402636
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x514
setne cl
lea eax, [ecx - 1]
and eax, 0x514
ret

Function at 0x4026f0
Capabilities:
Create directory

Disassembly:
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push esi
push edi
push 0x104
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.004316e2
push 0x5c
lea eax, [esp + 0x18]
xor edx, edx
push 0x2f
push eax
mov word [esp + 0x226], dx
call fcn.00402690
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 0x18
lea esi, [esp + 8]
push 0x5c
push esi
call fcn.004319bb
mov esi, eax
add esp, 8
test esi, esi
je 0x40274a
xor ecx, ecx
mov word [esi], cx
push 0
lea edx, [esp + 0xc]
push edx
call edi
test esi, esi
je 0x402765
add esi, 2
mov eax, 0x5c
mov word [esi - 2], ax
jne 0x402734
pop edi
pop esi
add esp, 0x208
ret

Function at 0x4027d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x208
push ebp
push esi
mov esi, dword [esp + 0x214]
push 0x104
lea eax, [esp + 0xc]
push esi
push eax
xor ebp, ebp
call fcn.004316e2
lea edx, [esp + 0x14]
xor ecx, ecx
push 0x5c
push edx
mov word [esp + 0x222], cx
call fcn.00431565
add esp, 0x14
test eax, eax
je 0x402820
lea edx, [esp + 8]
xor ecx, ecx
push edx
mov word [eax], cx
call fcn.004026f0
add esp, 4
push 0x4613a0
push esi
call fcn.00431d52
add esp, 8
test eax, eax
je 0x402852
cmp dword [esp + 0x21c], ebp
jne 0x402849
pop esi
mov eax, 0xb7
pop ebp
add esp, 0x208
ret
push eax
call fcn.00431c20
add esp, 4
push edi
push 0x46139c
push esi
call fcn.00431d52
mov edi, eax
add esp, 8
test edi, edi
jne 0x40288a
push esi
call fcn.00401ba0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x4028d0
push 0x46139c
push esi
call fcn.00431d52
mov edi, eax
add esp, 8
test edi, edi
je 0x4028d0
push ebx
mov ebx, dword [esp + 0x220]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402897
sub eax, edx
mov esi, eax
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4028a7
push edi
sub eax, edx
push eax
push 1
push ebx
call fcn.00431b39
add esp, 0x10
pop ebx
cmp esi, eax
je 0x4028c7
mov ebp, 0x1d
push edi
call fcn.00431c20
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x208
ret
Function at 0x4028e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x404
mov eax, dword [esp + 0x408]
push esi
push edi
push 0x4613a0
xor edi, edi
push eax
mov dword [esp + 0x10], edi
call fcn.00431d52
mov esi, eax
add esp, 8
cmp esi, edi
jne 0x402915
lea eax, [edi + 2]
pop edi
pop esi
add esp, 0x404
ret
push ebx
push ebp
mov ebp, dword [esp + 0x41c]
cmp ebp, edi
je 0x402943
mov ebx, dword [esp + 0x420]
push esi
push ebx
push 1
push ebp
call fcn.00432067
mov edi, eax
add esp, 0x10
cmp edi, ebx
jne 0x40293f
lea eax, [edi - 1]
mov byte [eax + ebp], 0
push esi
mov ebx, edi
call fcn.00431db0
add esp, 4
test eax, eax
jne 0x4029a1
mov dword [esp + 0x10], 0xea
lea ebx, [ebx]
push esi
push 0x400
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.00432067
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x402988
push esi
call fcn.00431db0
add esp, 4
test eax, eax
je 0x402999
push esi
add ebx, edi
call fcn.00431db0
add esp, 4
test eax, eax
je 0x402960
jmp 0x4029a1
mov dword [esp + 0x10], 0x1e
mov eax, dword [esp + 0x424]
test eax, eax
je 0x4029af
inc ebx
mov dword [eax], ebx
push esi
call fcn.00431c20
mov eax, dword [esp + 0x14]
add esp, 4
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x404
ret
Function at 0x4029d0
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x660
push esi
mov esi, dword [esp + 0x668]
test esi, esi
jne 0x4029ed
lea eax, [esi + 0x57]
pop esi
add esp, 0x660
ret
push edi
push esi
push 0x4613bc
lea eax, [esp + 0x468]
push 0x104
push eax
call fcn.00431593
add esp, 0x10
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x464]
xor ecx, ecx
push eax
mov word [esp + 0x66e], cx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x402b4c
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x402a40
mov ecx, 0x4613b8
lea eax, [esp + 0x38]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402a76
test dx, dx
je 0x402a72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402a76
add eax, 4
add ecx, 4
test dx, dx
jne 0x402a50
xor eax, eax
jmp 0x402a7b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402b25
mov ecx, 0x4613b0
lea eax, [esp + 0x38]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402ab6
test dx, dx
je 0x402ab2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402ab6
add eax, 4
add ecx, 4
test dx, dx
jne 0x402a90
xor eax, eax
jmp 0x402abb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402b25
lea ecx, [esp + 0x38]
push str..tmp
push ecx
call fcn.00431682
add esp, 8
test eax, eax
jne 0x402b25
lea edx, [esp + 0x38]
push edx
push esi
push 0x4613a4
lea eax, [esp + 0x268]
push 0x104
push eax
call fcn.00431593
xor ecx, ecx
add esp, 0x14
test byte [esp + 0xc], 0x10
mov word [esp + 0x462], cx
je 0x402b15
lea edx, [esp + 0x25c]
push edx
call fcn.004029d0
jmp 0x402b22
lea eax, [esp + 0x25c]
push eax
call fcn.00401ba0
add esp, 4
lea ecx, [esp + 0xc]
push ecx
push edi
call ebp
test eax, eax
jne 0x402a40
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
test eax, eax
je 0x402b4c
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x402b5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
add esp, 0x660
ret
pop edi
xor eax, eax
pop esi
add esp, 0x660
ret