joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4229ef
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov ecx, dword [0x45e2f0]
push ebx
push esi
push edi
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x454094
mov esi, eax
call fcn.0040161c
mov ecx, dword [0x45d970]
push 1
push ebx
push 0xffffffffffffffff
push ebx
call fcn.0040161c
cmp esi, ebx
je 0x422b4f
cmp byte [esi], bl
je 0x422b4f
push esi
mov esi, 0x105
mov eax, esi
lea edi, [ebp - 0x124]
call fcn.00438a10
mov eax, edi
push eax
call sub.MSVCR71.dll_strlen
cmp byte [ebp + eax - 0x125], 0x5c
pop ecx
pop ecx
je 0x422a76
lea ecx, [eax + 1]
cmp ecx, esi
jae 0x422b4f
mov byte [ebp + eax - 0x124], 0x5c
mov byte [ebp + eax - 0x123], bl
xor esi, esi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test byte [0x460ab0], 1
jne 0x422aab
or dword [0x460ab0], esi
push str.GetDiskFreeSpaceExA
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x460aac], eax
mov eax, dword [0x460aac]
cmp eax, ebx
je 0x422aed
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x124]
push ecx
call eax
test eax, eax
je 0x422b0e
cmp byte [ebp + 8], bl
je 0x422ada
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
jmp 0x422ae0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
shrd ecx, eax, 0x14
shr eax, 0x14
mov esi, ecx
mov edi, eax
jmp 0x422b2c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x422b12
mov eax, esi
jmp 0x422b52
cmp byte [ebp + 8], bl
mov eax, dword [ebp - 0x14]
jne 0x422b1d
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 4]
imul eax, dword [ebp - 0xc]
shr eax, 0x14
mov esi, eax
xor edi, edi
mov ecx, dword [0x45e2f0]
push 1
push ebx
push 0xffffffffffffffff
push 0x452954
call fcn.0040161c
mov eax, dword [0x45d970]
push edi
push esi
call fcn.00401b0f
jmp 0x422b52
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x422c14
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
test ecx, ecx
push edi
mov edi, eax
je 0x422c24
lea edi, [ecx + 8]
mov al, byte [edi]
test al, al
jne 0x422c45
mov ecx, dword [0x45e2f0]
push 1
push 0
push 0xffffffffffffffff
push 0x454094
call fcn.0040161c
jmp 0x422deb
test ecx, ecx
push esi
je 0x422c4f
mov esi, dword [ecx + 4]
jmp 0x422c51
xor esi, esi
test esi, esi
push ebx
setne bl
cmp al, 0x2a
sete al
test al, al
je 0x422ca3
inc edi
cmp byte [edi], 0
jne 0x422d6e
mov eax, dword [sym.imp.MSVCR71.dll__iob]
add eax, 0x20
push eax
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR71.dll_fputs]
pop ecx
test eax, eax
pop ecx
mov eax, 0x454094
jne 0x422c8c
mov eax, 0x452954
push 1
push 0
push 0xffffffffffffffff
push eax
mov ecx, dword [0x45e2f0]
call fcn.0040161c
jmp 0x422de9
test bl, bl
jne 0x422dac
mov eax, dword [0x45d970]
test eax, eax
je 0x422d59
mov cl, byte [eax + 0x17]
test cl, cl
jne 0x422cc7
mov edx, dword [eax + 0xc]
mov dl, byte [edx + 0x17]
jmp 0x422cc9
mov dl, cl
cmp dl, 3
jne 0x422cdc
push edi
push dword [ebp + 8]
call fcn.0043c21f
jmp 0x422de9
test cl, cl
jne 0x422ce3
mov eax, dword [eax + 0xc]
mov al, byte [eax + 0x15]
test al, 1
je 0x422d59
push 0x4569f0
push edi
call dword [sym.imp.MSVCR71.dll_fopen]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x422d90
mov eax, dword [0x45d970]
call fcn.00401b52
mov eax, dword [eax]
mov ecx, dword [0x45d970]
push esi
xor edi, edi
inc edi
push edi
inc eax
push eax
push edi
call fcn.00401c0d
push eax
call dword [sym.imp.MSVCR71.dll_fwrite]
add esp, 0x10
test eax, eax
mov eax, 0x452954
jne 0x422d39
mov eax, 0x454094
mov ecx, dword [0x45e2f0]
push edi
push 0
push 0xffffffffffffffff
push eax
call fcn.0040161c
push esi
call dword [sym.imp.MSVCR71.dll_fclose]
pop ecx
mov eax, edi
jmp 0x422de9
push 0x457058
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR71.dll_strstr]
pop ecx
test eax, eax
pop ecx
setne al
test bl, bl
jne 0x422dac
test al, al
mov eax, 0x4569ec
jne 0x422d80
mov eax, 0x4569e8
push eax
push edi
call dword [sym.imp.MSVCR71.dll_fopen]
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x422da0
push 1
push 0
push 0xffffffffffffffff
push 0x454094
jmp 0x422c93
cmp dword [ebp + 0x10], 0
je 0x422dac
mov eax, dword [ebp + 0x10]
mov dword [eax + 4], esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR71.dll_fputs]
pop ecx
test eax, eax
pop ecx
mov eax, 0x454094
jne 0x422dc6
mov eax, 0x452954
mov ecx, dword [0x45e2f0]
push 1
push 0
push 0xffffffffffffffff
push eax
call fcn.0040161c
cmp dword [ebp + 0x10], 0
jne 0x422de6
push esi
call dword [sym.imp.MSVCR71.dll_fclose]
pop ecx
xor eax, eax
inc eax
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x422df0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
push 0
push 0xffffffffffffffff
mov dword [ebp - 4], ecx
mov ecx, dword [0x45e2f0]
push 0x454094
call fcn.0040161c
mov esi, dword [ebp + 8]
test esi, esi
je 0x422e48
cmp byte [esi], 0
je 0x422e48
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x422e51
test al, 0x10
je 0x422e48
mov ecx, dword [0x45e2f0]
push edi
push 0
push 0xffffffffffffffff
push 0x452954
call fcn.0040161c
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strrchr]
mov ebx, eax
cmp ebx, esi
pop ecx
pop ecx
jbe 0x422eaa
push esi
call sub.MSVCR71.dll_strlen
cmp eax, 0x104
pop ecx
jae 0x422e48
mov eax, ebx
sub eax, esi
inc eax
push esi
lea edi, [ebp - 0x108]
call fcn.00438a10
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
push eax
call fcn.00422df0
cmp byte [ebx + 1], 0
je 0x422ea5
mov ecx, dword [0x45e2f0]
push 1
call fcn.00401c0d
cmp byte [eax], 0x31
jne 0x422eaa
xor eax, eax
inc eax
jmp 0x422e4a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov eax, 0x452954
jne 0x422ec1
mov eax, 0x454094
mov ecx, dword [0x45e2f0]
push 1
push 0
push 0xffffffffffffffff
push eax
call fcn.0040161c
jmp 0x422e4a
Function at 0x422ed8
Capabilities:
Check for time delay via gettickcount
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov ecx, dword [0x45e2f0]
push ebx
push esi
mov esi, dword [0x45d920]
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x454094
call fcn.0040161c
cmp byte [esi], bl
je 0x42307a
push edi
mov edi, 0x4569e4
mov eax, esi
call fcn.00438cc6
test eax, eax
jne 0x422f42
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x423079
mov ecx, dword [0x45e2f0]
push 1
push ebx
push 0xffffffffffffffff
push 0x452954
call fcn.0040161c
jmp 0x423079
mov ecx, dword [ebp + 8]
xor eax, eax
call fcn.0040c186
cmp eax, 0x104
jae 0x423079
lea eax, [ebp - 0x268]
push eax
push esi
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x422f79
push 0x18
push ebx
push ebx
jmp 0x42306f
lea eax, [ebp - 0x128]
push esi
push eax
call sub.MSVCR71.dll_strcpy
lea eax, [ebp - 0x128]
push 0x5c
push eax
call dword [sym.imp.MSVCR71.dll_strrchr]
add esp, 0x10
cmp eax, ebx
je 0x422fae
mov byte [eax + 1], bl
lea eax, [ebp - 0x128]
push eax
call sub.MSVCR71.dll_strlen
pop ecx
jmp 0x422fb6
mov byte [ebp - 0x128], bl
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp + eax - 0x128]
mov esi, 0x103
mov dword [ebp - 8], ecx
sub esi, eax
call edi
sub eax, dword [0x460024]
mov ecx, dword [0x45b170]
cmp eax, dword [ecx + 0xb0]
jbe 0x423007
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x423000
push 1
push 0xffffffffffffffff
call fcn.0040d9dd
pop ecx
pop ecx
call edi
mov dword [0x460024], eax
test byte [ebp - 0x268], 0x10
jne 0x423046
lea eax, [ebp - 0x23c]
push eax
call sub.MSVCR71.dll_strlen
cmp eax, esi
pop ecx
ja 0x423043
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 8]
call sub.MSVCR71.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x423046
inc dword [ebp + 8]
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x422fcd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
cdq
push 0x18
push edx
push eax
mov eax, dword [0x45e2f0]
call fcn.004019da
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 4
Function at 0x423083
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov ecx, dword [0x45e2f0]
sub esp, 0x80
push ebx
push edi
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x454094
mov edi, eax
call fcn.0040161c
mov ecx, dword [0x45d970]
push 1
push ebx
push 0xffffffffffffffff
push ebx
call fcn.0040161c
cmp edi, ebx
je 0x4230fe
cmp byte [edi], bl
je 0x4230fe
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4230fe
mov ecx, dword [0x45e2f0]
push 1
push ebx
push 0xffffffffffffffff
push 0x452954
call fcn.0040161c
push 1
push ebx
push 0xffffffffffffffff
mov edx, edi
lea eax, [esp + 0x14]
call fcn.004391cc
mov ecx, dword [0x45d970]
push eax
call fcn.0040161c
jmp 0x423101
xor eax, eax
inc eax
pop edi
pop ebx
add esp, 0x80
ret
Function at 0x42365b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10030
call fcn.0044ff40
mov eax, dword [0x45d970]
mov ecx, dword [0x45e2f0]
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x454094
mov dword [ebp - 0xc], eax
call fcn.0040161c
mov esi, dword [ebp + 0xc]
call fcn.00401ca2
mov esi, edx
cmp esi, ebx
mov dword [ebp - 0x14], eax
jg 0x4236ab
jl 0x42378f
cmp eax, edi
jb 0x42378f
push 0x454ad4
push dword [ebp + 8]
call dword [sym.imp.MSVCR71.dll_fopen]
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
je 0x42378f
cmp esi, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
jl 0x42374d
jg 0x4236d7
cmp dword [ebp - 0x14], ebx
jbe 0x42374d
push dword [ebp + 0xc]
lea eax, [ebp - 0x10030]
push 0xffff
push eax
call dword [sym.imp.MSVCR71.dll_fgets]
add esp, 0xc
test eax, eax
je 0x423785
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x460024]
mov ecx, dword [0x45b170]
cmp eax, dword [ecx + 0xb0]
jbe 0x423738
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x42372d
push edi
push 0xffffffffffffffff
call fcn.0040d9dd
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x460024], eax
add dword [ebp - 8], edi
adc dword [ebp - 4], ebx
cmp dword [ebp - 4], esi
jl 0x4236d7
jg 0x42374d
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 8], eax
jb 0x4236d7
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR71.dll_fclose]
lea eax, [ebp - 0x10030]
push eax
call sub.MSVCR71.dll_strlen
cmp eax, ebx
pop ecx
pop ecx
je 0x42377e
cmp byte [ebp + eax - 0x10031], 0xa
jne 0x42377a
dec eax
mov byte [ebp + eax - 0x10030], bl
cmp eax, ebx
jne 0x423793
push edi
push ebx
push 0xffffffffffffffff
push ebx
jmp 0x42379d
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR71.dll_fclose]
pop ecx
mov eax, edi
jmp 0x4237bd
push edi
push ebx
push eax
lea eax, [ebp - 0x10030]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.0040161c
test eax, eax
je 0x4237bd
mov ecx, dword [0x45e2f0]
push edi
push ebx
push 0xffffffffffffffff
push 0x452954
call fcn.0040161c
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x424b5b
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
mov edi, dword [0x45d970]
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
mov eax, dword [ebp + 8]
xor esi, esi
inc esi
push esi
push ebx
push ebx
call fcn.00415537
add esp, 0x10
cmp al, bl
mov byte [ebp - 1], al
jne 0x424bd6
mov eax, dword [ebp + 8]
push ebx
lea ebx, [ebp + 8]
call fcn.004220d1
pop ecx
mov ecx, eax
xor eax, eax
cmp ecx, eax
jne 0x424baf
push esi
push eax
push 0xffffffffffffffff
push 0x45282f
jmp 0x424c13
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edx
call fcn.0041e48a
fstp st(0)
add esp, 8
lea esi, [ebp - 0x18]
call fcn.00401956
jmp 0x424c1a
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
push eax
call dword [sym.imp.MSVCR71.dll_toupper]
cmp eax, 0x50
pop ecx
je 0x424bf3
cmp eax, 0x54
jne 0x424bf5
push 2
pop ebx
jmp 0x424bf5
mov ebx, esi
push ebx
mov bl, byte [ebp - 1]
call fcn.0041e83e
test al, al
pop ecx
mov eax, 0x456d38
jne 0x424c0d
mov eax, 0x456d34
push esi
push 0
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.0040161c
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42a931
Capabilities:
Create shortcut via ishelllink
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x45e2f0]
push 0x454094
mov edi, eax
call fcn.0040161c
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x451680
push 1
push ebx
push 0x451690
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x42aa91
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp byte [esi], bl
je 0x42a998
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x24]
cmp byte [edi], bl
je 0x42a9a6
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x2c]
mov ecx, dword [ebp + 0x10]
cmp byte [ecx], bl
je 0x42a9b7
mov eax, dword [ebp - 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x1c]
mov edi, dword [ebp + 0x14]
cmp byte [edi], bl
je 0x42a9da
mov esi, dword [ebp + 0x1c]
cmp byte [esi], bl
je 0x42a9cd
call fcn.0040113f
dec eax
jmp 0x42a9cf
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push eax
push edi
push ecx
call dword [edx + 0x44]
mov esi, dword [ebp + 0x18]
cmp byte [esi], bl
je 0x42aa0e
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push ebx
push ebx
mov eax, esi
call fcn.00415537
add esp, 0x10
cmp al, bl
je 0x42aa0e
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
movzx ax, al
or eax, 0x600
push eax
push ecx
call dword [edx + 0x34]
mov esi, dword [ebp + 0x20]
cmp byte [esi], bl
je 0x42aa26
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call fcn.0040113f
push eax
push dword [ebp - 4]
call dword [edi + 0x3c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push 0x4516b0
push eax
call dword [ecx]
test eax, eax
jl 0x42aa88
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x20c]
push edx
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x42aa7f
mov ecx, dword [0x45e2f0]
push 1
push ebx
push 0xffffffffffffffff
push 0x452954
call fcn.0040161c
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0x1c
Function at 0x42ad9e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov ecx, dword [0x45e2f0]
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x454094
mov esi, eax
call fcn.0040161c
mov ecx, dword [0x45d970]
push edi
push ebx
push 0xffffffffffffffff
push ebx
call fcn.0040161c
cmp esi, ebx
je 0x42aea1
cmp byte [esi], bl
je 0x42aea1
lea eax, [ebp - 0x10]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x42aea1
push eax
call dword [sym.imp.MSVCR71.dll_malloc]
pop ecx
mov edi, eax
push edi
push dword [ebp - 0xc]
mov dword [ebp - 4], edi
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0x454a70
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x42ae36
push edi
call dword [sym.imp.MSVCR71.dll_free]
xor eax, eax
pop ecx
inc eax
jmp 0x42aea3
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov esi, ecx
mov edx, 0xffff
and esi, edx
push esi
shr ecx, 0x10
push ecx
mov ecx, eax
and ecx, edx
push ecx
shr eax, 0x10
push eax
push str._u._u._u._u
mov esi, 0x80
lea edi, [ebp - 0x94]
call fcn.0040a3cc
push dword [ebp - 4]
call dword [sym.imp.MSVCR71.dll_free]
mov ecx, dword [0x45e2f0]
add esp, 0x18
push 1
push ebx
push 0xffffffffffffffff
push 0x452954
call fcn.0040161c
mov ecx, dword [0x45d970]
push 1
push ebx
push 0xffffffffffffffff
mov eax, edi
push eax
call fcn.0040161c
jmp 0x42aea3
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42aea8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x42af22
cmp byte [eax], bl
je 0x42af22
push eax
lea eax, [ebp - 0x128]
call fcn.0042b534
lea eax, [ebp - 0x128]
push eax
call sub.MSVCR71.dll_strlen
mov byte [ebp + eax - 0x127], bl
pop ecx
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
pop ecx
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 3
mov word [ebp - 0x10], 0x54
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
mov eax, 0x454094
jne 0x42af1a
mov eax, 0x452954
push 1
push ebx
push 0xffffffffffffffff
push eax
jmp 0x42af2c
push 1
push ebx
push 0xffffffffffffffff
push 0x454094
mov ecx, dword [0x45e2f0]
call fcn.0040161c
pop ebx
leave
ret
Function at 0x42b570
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push dword [ebp + 8]
lea eax, [ebp - 0x128]
call fcn.0042b534
push dword [ebp + 0xc]
lea eax, [ebp - 0x230]
call fcn.0042b534
lea eax, [ebp - 0x128]
push eax
call fcn.0042bbb4
add esp, 0xc
test al, al
je 0x42b5d0
lea eax, [ebp - 0x230]
push eax
call fcn.0042bbb4
test al, al
pop ecx
je 0x42b5bf
cmp byte [ebp + 0x10], 0
jmp 0x42b5ce
lea eax, [ebp - 0x230]
push eax
call fcn.0042b86b
pop ecx
test al, al
jne 0x42b5d4
xor al, al
leave
ret
push edi
lea eax, [ebp - 0x128]
push str..
push eax
call sub.MSVCR71.dll_strcat
lea eax, [ebp - 0x128]
push eax
call sub.MSVCR71.dll_strlen
mov byte [ebp + eax - 0x127], 0
lea eax, [ebp - 0x230]
push eax
call sub.MSVCR71.dll_strlen
and dword [ebp - 0x20], 0
add esp, 0x10
mov byte [ebp + eax - 0x22f], 0
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 2
mov word [ebp - 0x10], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb eax, eax
inc eax
pop edi
leave
ret
Function at 0x42b652
Capabilities:
Check for time delay via gettickcount
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9a8
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x238]
call fcn.0042b534
push dword [ebp + 0xc]
lea eax, [ebp - 0x588]
call fcn.0042b534
lea eax, [ebp - 0x238]
push eax
call fcn.0042bbb4
add esp, 0xc
test al, al
mov esi, str..
je 0x42b69f
lea eax, [ebp - 0x238]
push esi
push eax
call sub.MSVCR71.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x588]
push eax
call fcn.0042bbb4
test al, al
pop ecx
je 0x42b6bf
lea eax, [ebp - 0x588]
push esi
push eax
call sub.MSVCR71.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x42b6e2
xor eax, eax
jmp 0x42b868
push ebx
push edi
lea eax, [ebp - 0x9a8]
push eax
lea eax, [ebp - 0x8a0]
push eax
lea eax, [ebp - 0x690]
push eax
lea eax, [ebp - 0x798]
push eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.MSVCR71.dll__splitpath]
lea eax, [ebp - 0x690]
push eax
lea eax, [ebp - 0x798]
push eax
push 0x455e94
mov esi, 0x105
lea edi, [ebp - 0x130]
call fcn.0040a3cc
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, 0x104
add esp, 0x20
sub edi, eax
lea ecx, [ebp + eax - 0x130]
xor esi, esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], esi
jmp 0x42b753
xor esi, esi
call ebx
sub eax, dword [0x460024]
mov ecx, dword [0x45b170]
cmp eax, dword [ecx + 0xb0]
jbe 0x42b78d
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x42b786
push 1
push 0xffffffffffffffff
call fcn.0040d9dd
pop ecx
pop ecx
call ebx
mov dword [0x460024], eax
test byte [ebp - 0x480], 0x10
jne 0x42b842
lea eax, [ebp - 0x454]
push eax
call sub.MSVCR71.dll_strlen
cmp eax, edi
pop ecx
ja 0x42b83f
lea eax, [ebp - 0x454]
push eax
push dword [ebp - 0xc]
call sub.MSVCR71.dll_strcpy
lea eax, [ebp - 0x588]
push eax
lea eax, [ebp - 0x454]
push eax
lea esi, [ebp - 0x340]
call fcn.0042b945
add esp, 0x10
cmp byte [ebp + 0x14], 0
je 0x42b81e
mov eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileA]
push eax
lea eax, [ebp - 0x130]
push eax
call esi
test eax, eax
jne 0x42b842
cmp byte [ebp + 0x10], al
je 0x42b83f
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x42b83f
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x130]
push eax
call esi
jmp 0x42b83b
xor eax, eax
cmp byte [ebp + 0x10], al
sete al
push eax
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x42b842
inc dword [ebp - 4]
lea eax, [ebp - 0x480]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42b751
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42b86b
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42b8dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
dec eax
je 0x42b8cc
dec eax
jne 0x42b8e4
push edi
call sub.MSVCR71.dll_strlen
cmp eax, 0x104
pop ecx
ja 0x42b8e4
add eax, 4
and eax, 0xfffffffc
call fcn.0044ff40
mov esi, esp
push edi
push esi
call sub.MSVCR71.dll_strcpy
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strrchr]
add esp, 0x10
test eax, eax
je 0x42b8e4
push esi
mov byte [eax], 0
call fcn.0042b86b
test al, al
pop ecx
je 0x42b8e4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne al
jmp 0x42b8e6
test al, 0x10
je 0x42b8e4
mov al, 1
jmp 0x42b8e6
xor al, al
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret

Function at 0x42b8ed
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x140
push esi
mov esi, dword [sym.imp.MSVCR71.dll_strchr]
push 0x2a
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x42b91f
push 0x3f
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x42b91f
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
jmp 0x42b93d
lea eax, [esp + 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x42b934
xor al, al
jmp 0x42b93d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
pop esi
add esp, 0x140
ret

Function at 0x42bbb4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42bbcb
test al, 0x10
je 0x42bbcb
xor eax, eax
inc eax
ret
xor eax, eax
ret