joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404935
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x446878], ebx
push esi
push edi
jne 0x4049b5
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4049f0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x446878], eax
je 0x4049f0
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x44687c], eax
call esi
cmp dword [0x4466fc], 2
mov dword [0x446880], eax
jne 0x4049b5
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x446888], eax
je 0x4049b5
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x446884], eax
mov eax, dword [0x446884]
test eax, eax
je 0x4049fa
call eax
test eax, eax
je 0x4049e1
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x446888]
test eax, eax
je 0x4049e1
test byte [ebp - 8], 1
jne 0x4049fa
cmp dword [0x446708], 4
jb 0x4049f4
or byte [ebp + 0x12], 0x20
jmp 0x404a19
xor eax, eax
jmp 0x404a29
or byte [ebp + 0x12], 4
jmp 0x404a19
mov eax, dword [0x44687c]
test eax, eax
je 0x404a19
call eax
mov ebx, eax
test ebx, ebx
je 0x404a19
mov eax, dword [0x446880]
test eax, eax
je 0x404a19
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x446878]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405814
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00403500
mov eax, dword [0x446440]
xor eax, dword [ebp + 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x447b68]
mov dword [ebp - 4], eax
jae 0x405954
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x447b80]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x405954
push 1
push esi
push ebx
call fcn.00405b50
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x40595e
push 2
push esi
push ebx
call fcn.00405b50
add esp, 0xc
cmp eax, 0xffffffff
je 0x40595e
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x405901
push 0x1000
lea eax, [ebp - 0x1008]
push esi
push eax
call fcn.00406840
push 0x8000
push ebx
call fcn.00406b01
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, 0x1000
cmp edi, eax
jge 0x4058c0
mov eax, edi
push eax
lea eax, [ebp - 0x1008]
push eax
push ebx
call fcn.004068f6
add esp, 0xc
cmp eax, 0xffffffff
je 0x4058de
sub edi, eax
test edi, edi
jg 0x4058b5
jmp 0x4058f4
cmp dword [0x4466f4], 5
jne 0x4058f1
mov dword [0x4466f0], 0xd
or esi, 0xffffffff
push dword [ebp + 8]
push ebx
call fcn.00406b01
pop ecx
pop ecx
jmp 0x405941
jge 0x405941
push 0
push dword [ebp + 0xc]
push ebx
call fcn.00405b50
push ebx
call fcn.00405d6a
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x405941
mov dword [0x4466f0], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4466f4], eax
push 0
push dword [ebp - 8]
push ebx
call fcn.00405b50
add esp, 0xc
mov eax, esi
pop edi
jmp 0x405961
mov dword [0x4466f0], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.00404d1c
leave
ret
Function at 0x405970
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x447b68]
push edi
jae 0x405b37
mov eax, esi
sar eax, 5
lea ebx, [eax*4 + 0x447b80]
mov eax, dword [ebx]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x405b37
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov edi, dword [ebp + 0xc]
mov ecx, edi
je 0x405a16
test dl, 2
jne 0x405a16
test dl, 0x48
je 0x4059e0
mov al, byte [eax + 5]
cmp al, 0xa
je 0x4059e0
dec dword [ebp + 0x10]
mov byte [edi], al
mov eax, dword [ebx]
lea ecx, [edi + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [ebx]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405a29
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x405a11
mov dword [0x4466f4], ecx
jmp 0x405b3e
cmp eax, 0x6d
jne 0x405a1d
xor eax, eax
jmp 0x405b4b
push eax
call fcn.00405da6
pop ecx
jmp 0x405b48
mov eax, dword [ebx]
mov edx, dword [ebp - 0x10]
add dword [ebp - 0xc], edx
lea ecx, [eax + esi + 4]
mov al, byte [ecx]
test al, al
jns 0x405b32
test edx, edx
je 0x405a4c
cmp byte [edi], 0xa
jne 0x405a4c
or al, 4
jmp 0x405a4e
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x405b2c
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x405b1c
cmp al, 0xd
je 0x405a82
mov byte [edi], al
inc edi
inc dword [ebp - 8]
jmp 0x405b0e
dec ecx
cmp dword [ebp - 8], ecx
jae 0x405a9c
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x405a97
add dword [ebp - 8], 2
jmp 0x405af0
mov dword [ebp - 8], eax
jmp 0x405b0a
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405ac4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x405b0a
cmp dword [ebp - 0x10], 0
je 0x405b0a
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x48
je 0x405ae5
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x405af0
mov byte [edi], 0xd
mov ecx, dword [ebx]
mov byte [ecx + esi + 5], al
jmp 0x405b0d
cmp edi, dword [ebp + 0xc]
jne 0x405af5
cmp byte [ebp - 1], 0xa
jne 0x405af5
mov byte [edi], 0xa
jmp 0x405b0d
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00405b50
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x405b0e
mov byte [edi], 0xd
inc edi
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x405a66
jmp 0x405b2c
mov eax, dword [ebx]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x405b2c
or al, 2
mov byte [esi], al
sub edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0xc]
jmp 0x405b4b
and dword [0x4466f4], 0
mov dword [0x4466f0], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4068f6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x446440]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x447b68]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
jae 0x406a86
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x447b80]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x18], ebx
je 0x406a86
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
jne 0x406955
xor eax, eax
jmp 0x406a9a
test al, 0x20
je 0x406966
push 2
push edi
push edi
push ecx
call fcn.00406e8c
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x406a22
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp + 8], edi
jbe 0x406a5a
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
cmp ecx, dword [ebp + 0x10]
jae 0x4069bc
mov edx, dword [ebp - 8]
inc dword [ebp - 8]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4069ad
inc dword [ebp - 0x14]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x18]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x406992
mov edi, eax
lea eax, [ebp - 0x41c]
sub edi, eax
push 0
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4069fc
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
cmp eax, edi
jl 0x406a05
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x406986
jmp 0x406a07
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
xor edi, edi
mov eax, dword [ebp - 0xc]
cmp eax, edi
jne 0x406a81
cmp dword [ebp + 8], edi
je 0x406a5a
push 5
pop eax
cmp dword [ebp + 8], eax
jne 0x406a4f
mov dword [0x4466f4], eax
jmp 0x406a8d
push edi
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x406a44
mov eax, dword [ebp - 0x10]
mov dword [ebp + 8], edi
mov dword [ebp - 0xc], eax
jmp 0x406a07
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x406a07
push dword [ebp + 8]
call fcn.00405da6
pop ecx
jmp 0x406a97
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x406a6f
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
je 0x40694e
mov dword [0x4466f0], 0x1c
mov dword [0x4466f4], edi
jmp 0x406a97
sub eax, dword [ebp - 0x14]
jmp 0x406a9a
and dword [0x4466f4], 0
mov dword [0x4466f0], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.00404d1c
leave
ret
Function at 0x406d90
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.00403500
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x406e25
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x4466fc]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x406e25
cmp eax, 1
je 0x406e3d
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x406e25
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x406dfa
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x406e21
xor eax, eax
inc eax
jmp 0x406e59
cmp esi, ebx
jae 0x406e29
xor eax, eax
jmp 0x406e59
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4466fc]
jmp 0x406e3f
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x401642
test dl, 7
je 0x401642
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x432d70]
inc edx
mov dword [ebp + 0xc], edx
sub esi, 1
jne 0x401622
cmp esi, 8
jb 0x4016d2
push edi
mov edi, esi
shr edi, 3
xor ebx, dword [edx]
sub esi, 8
mov edx, dword [edx + 4]
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
movzx eax, al
mov ecx, dword [ecx*4 + 0x432d70]
xor ecx, dword [eax*4 + 0x433170]
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x433570]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x433d70]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x434170]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x434570]
movzx eax, dl
mov edx, dword [ebp + 0xc]
add edx, 8
mov dword [ebp + 0xc], edx
xor ecx, dword [eax*4 + 0x433970]
movzx eax, bl
xor ecx, dword [eax*4 + 0x434970]
mov ebx, ecx
sub edi, 1
jne 0x401651
pop edi
test esi, esi
je 0x4016ee
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x432d70]
inc edx
sub esi, 1
jne 0x4016d6
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x401d9e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 1
jne 0x401db7
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401e2a
mov ecx, esi
call fcn.00401ead
test al, al
je 0x401df2
mov eax, 0x4e20
cmp dword [ebp + 0xc], eax
jbe 0x401df2
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.00401d9e
jmp 0x401e2d
cmp dword [esi + 0xc], 1
jne 0x401e07
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x401e07
xor eax, eax
jmp 0x401e2d
cmp dword [esi + 0xc], 0
jne 0x401e25
mov edi, 0x8000
cmp dword [ebp + 0xc], edi
jbe 0x401e25
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x401e25
push edi
jmp 0x401de6
or eax, 0xffffffff
jmp 0x401e2d
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x401ee0
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1054
call fcn.004138f0
push ebx
mov ebx, dword [esp + 0x1060]
push ebp
push edi
mov edi, ecx
and dword [edi + 0x1024], 0
cmp byte [edi + 0x22], 0
jne 0x401f0c
test bl, 4
jne 0x401f0c
xor cl, cl
jmp 0x401f0e
mov cl, 1
mov eax, ebx
shr eax, 1
push esi
and al, 1
movzx esi, al
neg esi
sbb esi, esi
and esi, 0xc0000000
add esi, 0x80000000
test bl, 1
je 0x401f33
or esi, 0x40000000
shr ebx, 3
not ebx
and ebx, 1
test cl, cl
je 0x401f42
or ebx, 2
xor eax, eax
lea ecx, [esp + 0x1c]
cmp byte [edi + 0x1b], al
setne al
dec eax
and eax, 0x8000000
mov dword [esp + 0x10], eax
call fcn.00401b7c
cmp byte [edi + 0x20], 0
je 0x401f69
or esi, 0x100
push 0
push dword [esp + 0x14]
push 3
push 0
push ebx
push esi
push dword [esp + 0x1080]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x401feb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push 0x800
push eax
push dword [esp + 0x1070]
call fcn.004034d4
test al, al
je 0x401fda
push 0
push dword [esp + 0x14]
lea eax, [esp + 0x24]
push 3
push 0
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x401fd5
mov dword [esp + 0x14], eax
cmp ebp, 0xffffffff
jne 0x401feb
cmp dword [esp + 0x14], 2
jne 0x401feb
mov dword [edi + 0x1024], 1
cmp byte [edi + 0x20], 0
pop esi
je 0x402011
cmp ebp, 0xffffffff
je 0x402011
or dword [esp + 0x10], 0xffffffff
lea eax, [esp + 0x10]
or dword [esp + 0x14], 0xffffffff
push 0
push eax
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
xor eax, eax
cmp ebp, 0xffffffff
mov byte [edi + 0x18], al
setne bl
mov dword [edi + 0xc], eax
mov byte [edi + 0x10], al
cmp ebp, 0xffffffff
je 0x402043
push 0x800
push dword [esp + 0x1068]
lea ecx, [edi + 0x24]
mov dword [edi + 4], ebp
push ecx
call fcn.00406858
mov byte [edi + 0x21], 0
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 0x1054
ret 8
Function at 0x4023bf
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov ebx, ecx
test ebp, ebp
jne 0x4023d4
mov al, 1
jmp 0x4024d8
cmp dword [ebx + 0xc], 1
jne 0x4023e5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebx + 4], eax
push esi
push edi
mov edi, 0x4000
and dword [esp + 0x10], 0
cmp dword [ebx + 0xc], 0
mov byte [esp + 0x14], 0
je 0x402439
xor esi, esi
test ebp, ebp
je 0x40245d
mov eax, ebp
sub eax, esi
cmp eax, edi
jb 0x40240c
mov eax, edi
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esp + 0x28]
add eax, esi
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec eax
neg eax
sbb al, al
add al, 1
mov dword [esp + 0x14], eax
je 0x40245d
add esi, edi
cmp esi, ebp
jb 0x402402
jmp 0x402459
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push dword [esp + 0x28]
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec eax
neg eax
sbb al, al
inc al
mov dword [esp + 0x14], eax
test al, al
jne 0x4024ce
cmp byte [ebx + 0x1a], 0
je 0x4024ce
cmp dword [ebx + 0xc], 0
jne 0x4024ce
push 0
lea esi, [ebx + 0x24]
mov ecx, 0x451b74
push esi
call fcn.004017d2
test al, al
je 0x4024c1
cmp dword [esp + 0x10], ebp
jae 0x4023ec
cmp dword [esp + 0x10], 0
jbe 0x4023ec
mov edi, dword [ebx]
push 0
mov esi, dword [edi + 0x14]
mov ecx, esi
call dword [0x428220]
mov ecx, ebx
call esi
sub eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x10]
sbb edx, 0
push edx
push eax
call dword [0x428220]
mov ecx, ebx
call dword [edi + 0x10]
jmp 0x4023e7
push esi
push 0
mov ecx, 0x451b74
call fcn.00401acc
mov al, byte [esp + 0x14]
pop edi
mov byte [ebx + 8], 1
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 8

Function at 0x402624
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.004138f0
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402669
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.004034d4
test al, al
je 0x402669
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4026a6
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.004138f0
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.004037f7
movzx eax, word [eax]
cmp eax, 0x2e
je 0x4026d7
cmp eax, 0x20
je 0x4026d7
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40270a
push esi
call fcn.00402610
test al, al
jne 0x40271d
push 0x800
lea eax, [ebp - 0x1000]
push eax
push esi
call fcn.004034d4
test al, al
je 0x40271d
push 0
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40271d
cmp byte [ebp + 0xc], 0
je 0x402719
push dword [ebp + 0x10]
push esi
call fcn.004028e3
xor eax, eax
jmp 0x402735
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x402732
cmp eax, 3
je 0x402732
xor eax, eax
inc eax
jmp 0x402735
push 2
pop eax
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4028e3
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.004138f0
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test bl, bl
jne 0x402933
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.004034d4
test al, al
je 0x402933
push dword [ebp + 0xc]
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x402a93
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov eax, 0x1250
call fcn.004138f0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1260]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x126c]
or ebx, 0xffffffff
mov ebp, 0x800
push eax
cmp esi, ebx
jne 0x402b30
push dword [esp + 0x126c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, ebx
jne 0x402b57
push ebp
lea eax, [esp + 0x264]
push eax
push dword [esp + 0x1270]
call fcn.004034d4
test al, al
je 0x402b09
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, ebx
jne 0x402b57
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x402b23
cmp eax, 3
je 0x402b23
cmp eax, 0x12
je 0x402b23
xor eax, eax
inc eax
jmp 0x402b25
xor eax, eax
mov byte [edi + 0x1044], al
jmp 0x402c00
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402b4f
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [edi + 0x1044], al
cmp esi, ebx
je 0x402c00
push ebp
push dword [esp + 0x126c]
push edi
call fcn.00406858
push ebp
lea eax, [esp + 0x40]
push eax
push edi
call fcn.004038ce
mov ecx, dword [esp + 0x2c]
xor eax, eax
add eax, dword [esp + 0x30]
mov dword [edi + 0x1000], eax
mov eax, dword [esp + 0x10]
adc ecx, 0
mov dword [edi + 0x1008], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 0x1028], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x102c], eax
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x1030], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0x1034], eax
mov eax, dword [esp + 0x24]
mov dword [edi + 0x1038], eax
mov eax, dword [esp + 0x28]
mov dword [edi + 0x103c], eax
lea eax, [esp + 0x24]
mov dword [edi + 0x1004], ecx
lea ecx, [edi + 0x1010]
push eax
call fcn.004072ea
lea eax, [esp + 0x14]
push eax
lea ecx, [edi + 0x1018]
call fcn.004072ea
lea eax, [esp + 0x1c]
push eax
lea ecx, [edi + 0x1020]
call fcn.004072ea
and dword [edi + 0x1040], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1250
ret 0xc
Function at 0x4034d4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.004138f0
push esi
mov esi, dword [ebp + 8]
cmp word [esi], 0
jne 0x4034f2
xor al, al
jmp 0x40365c
push ebx
push edi
push esi
call fcn.00403663
push esi
call fcn.00418bf3
pop ecx
push esi
mov edi, eax
call fcn.0040368f
test al, al
je 0x403584
push esi
call fcn.00403663
test al, al
je 0x40353b
lea eax, [edi + 4]
cmp dword [ebp + 0x10], eax
jbe 0x403658
push dword [ebp + 0x10]
push 0x4285a8
push dword [ebp + 0xc]
call fcn.00406858
push dword [ebp + 0x10]
jmp 0x40364b
push 0x5c
pop eax
cmp word [esi], ax
jne 0x403658
lea ebx, [esi + 2]
cmp word [ebx], ax
jne 0x403658
mov esi, dword [ebp + 0x10]
lea eax, [edi + 6]
cmp esi, eax
jbe 0x403658
push esi
push 0x4285a8
push dword [ebp + 0xc]
call fcn.00406858
push esi
push 0x4285b4
push dword [ebp + 0xc]
call fcn.00406830
push esi
push ebx
jmp 0x40364c
lea eax, [ebp - 0x1000]
mov ebx, 0x7ff
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x403658
cmp eax, ebx
ja 0x403658
movzx eax, word [esi]
push eax
call fcn.004036c5
test al, al
je 0x4035eb
lea eax, [edi + 6]
mov edi, dword [ebp + 0x10]
cmp edi, eax
jbe 0x403658
push edi
push 0x4285a8
push dword [ebp + 0xc]
call fcn.00406858
xor eax, eax
mov word [ebp - 0xffc], ax
lea eax, [ebp - 0x1000]
push edi
push eax
push dword [ebp + 0xc]
call fcn.00406830
jmp 0x40364a
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.00403101
lea eax, [ebp - 0x1000]
push eax
call fcn.00418bf3
add edi, 4
add eax, edi
mov edi, dword [ebp + 0x10]
pop ecx
cmp edi, eax
jbe 0x403658
push edi
push 0x4285a8
push dword [ebp + 0xc]
call fcn.00406858
push edi
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 0xc]
call fcn.00406830
cmp word [esi], 0x2e
jne 0x40364a
movzx eax, word [esi + 2]
push eax
call fcn.004036c5
test al, al
je 0x40364a
add esi, 4
push edi
push esi
push dword [ebp + 0xc]
call fcn.00406830
mov al, 1
jmp 0x40365a
xor al, al
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc