joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ece3
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x420164]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], eax
push ecx
mov esi, 0x104
mov dword [eax], edi
mov edx, esi
mov dword [eax + 4], edi
lea ecx, [esp + 0x1c]
call fcn.0040d9fc
push 0x4016f0
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.0040da31
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x40ed69
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x40eda3
mov ecx, dword [ebp + 4]
mov edx, 0xc9
push 0x401664
call fcn.0040e97d
mov edi, eax
jmp 0x40eda3
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.0040ebc6
mov ebx, eax
test ebx, ebx
jns 0x40ed95
mov ecx, dword [ebp + 4]
mov edx, 0xcf
push ebx
push 0x401664
call fcn.0040e960
mov edi, ebx
jmp 0x40eda3
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x40edad
push esi
call fcn.0040e9d7
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041d370
mov esp, ebp
pop ebp
ret 8

Function at 0x4118c2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
inc esi
cmp dword [0x420704], 0
jne 0x411949
push edi
lea eax, [ebp - 4]
mov dword [0x420704], 2
push eax
push 0x20019
xor edi, edi
push edi
push 0x401c08
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x411939
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x401cb0
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x411939
cmp dword [ebp - 8], esi
jne 0x411939
mov dword [0x420704], esi
cmp dword [ebp - 4], 0
pop edi
je 0x411949
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [0x420704], esi
pop esi
sete al
leave
ret
Function at 0x4126e5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
push 0
push 0x18
push 0x401f60
xor ebx, ebx
mov esi, ecx
push 0x401f90
inc ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
cmp dword [ebp - 8], ebx
mov edi, 0x402150
sete bl
test eax, eax
je 0x41275c
jle 0x41273f
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x41275c
push eax
push 0x4020a8
push edi
push 0x420710
push 0x4014c4
push 2
call fcn.00411c1c
add esp, 0x18
lea eax, [ebp - 1]
push eax
call fcn.0041264f
test eax, eax
jns 0x412784
push eax
push 0x4021b8
push edi
push 0x420710
push 0x4014c4
push 2
call fcn.00411c1c
add esp, 0x18
mov al, byte [ebp - 1]
test bl, bl
je 0x41281d
test al, al
je 0x41281d
cmp dword [esi + 0x10], 1
jne 0x4127c3
mov ecx, esi
call fcn.00413e84
test eax, eax
jns 0x4127c3
push eax
push 0x402260
push edi
push 0x420710
push 0x4014c4
push 2
call fcn.00411c1c
add esp, 0x18
cmp dword [esi + 0x18], 1
jne 0x4127ef
mov ecx, esi
call fcn.00413f96
test eax, eax
jns 0x4127ef
push eax
push 0x402308
push edi
push 0x420710
push 0x4014c4
push 2
call fcn.00411c1c
add esp, 0x18
cmp dword [esi + 0x14], 1
jne 0x412838
mov ecx, esi
call fcn.004140a6
test eax, eax
jns 0x412838
push eax
push 0x4023b0
push edi
push 0x420710
push 0x4014c4
push 2
call fcn.00411c1c
add esp, 0x18
jmp 0x412838
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x412838
test al, al
mov eax, 0x402458
jne 0x412832
mov eax, 0x402470
push eax
call fcn.0041081e
mov ecx, esi
call fcn.004141b6
test eax, eax
jns 0x41285e
push eax
push 0x402480
push edi
push 0x420710
push 0x4014c4
push 2
call fcn.00411c1c
add esp, 0x18
mov ecx, esi
call fcn.0041425b
test eax, eax
jns 0x412884
push eax
push 0x402528
push edi
push 0x420710
push 0x4014c4
push 2
call fcn.00411c1c
add esp, 0x18
mov ecx, esi
call fcn.00414300
test eax, eax
jns 0x4128aa
push eax
push 0x4025d0
push edi
push 0x420710
push 0x4014c4
push 2
call fcn.00411c1c
add esp, 0x18
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x412d03
Capabilities:
Create bits job

Disassembly:
push 0x14
mov eax, 0x41e251
call fcn.0041dba2
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x420710
cmp dword [ebx], eax
jne 0x412d59
push ebx
push 0x40a654
push 4
push eax
push 0x40a644
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jns 0x412d6e
push edi
push 0x403838
push 0x4038e0
push esi
push 0x40149c
push 2
call fcn.00411c1c
add esp, 0x18
test edi, edi
jns 0x412d6e
push edi
push 0x403940
push 0x4039e8
push esi
jmp 0x412eab
mov eax, dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
lea edi, [ebx + 0x24]
push edi
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x10]
call dword [0x421350]
call dword [esi + 0x10]
test eax, eax
je 0x412db9
mov eax, dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0
mov esi, dword [eax]
push 0x403a40
push eax
mov ecx, dword [esi + 0xc]
call dword [0x421350]
call dword [esi + 0xc]
mov edi, eax
test edi, edi
jns 0x412db9
push edi
push 0x403a70
jmp 0x412ea1
mov eax, dword [ebp - 0x10]
add ebx, 4
push ebx
push 0x40a634
push eax
mov ecx, dword [eax]
mov esi, dword [ecx]
mov ecx, esi
call dword [0x421350]
call esi
mov edi, eax
test edi, edi
jns 0x412de5
push edi
push 0x403b18
jmp 0x412ea1
mov eax, dword [ebx]
push 0
push 0
push 3
mov esi, dword [eax]
push eax
mov esi, dword [esi + 0x80]
mov ecx, esi
call dword [0x421350]
call esi
mov edi, eax
test edi, edi
jns 0x412e11
push edi
push 0x403bc0
jmp 0x412ea1
mov eax, dword [ebx]
push 2
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x421350]
call esi
mov edi, eax
test edi, edi
jns 0x412e33
push edi
push 0x403c68
jmp 0x412ea1
mov eax, dword [ebx]
lea esi, [ebp - 0x20]
sub esp, 0x10
mov dword [ebp - 0x20], 0x80000021
mov edi, esp
mov ecx, dword [eax]
push 1
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ecx + 0xd4]
mov ecx, esi
call dword [0x421350]
call esi
mov edi, eax
test edi, edi
jns 0x412e6b
push edi
push 0x403d10
jmp 0x412ea1
mov eax, dword [ebx]
lea esi, [ebp - 0x20]
sub esp, 0x10
mov dword [ebp - 0x20], 3
mov edi, esp
mov ecx, dword [eax]
push 6
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ecx + 0xd4]
mov ecx, esi
call dword [0x421350]
call esi
mov edi, eax
test edi, edi
jns 0x412eba
push edi
push 0x403db8
push 0x4039e8
push 0x420710
push 0x40149c
push 2
call fcn.00411c1c
add esp, 0x18
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x412ed5
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x421350]
call esi
mov eax, edi
call fcn.0041db70
ret
Function at 0x413902
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
xor esi, esi
test ecx, ecx
jne 0x413918
mov esi, 0x80070057
push esi
push 0x4059f8
jmp 0x413948
push 0x104
push ecx
push 0x405b10
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x413961
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x413942
movzx esi, si
or esi, 0x80070000
push esi
push 0x405b60
push 0x405aa0
push 0x420710
push 0x40149c
push 2
call fcn.00411c1c
add esp, 0x18
mov eax, esi
pop esi
ret

Function at 0x413965
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x401494]
xor edx, edx
push ebx
push esi
mov esi, edx
mov dword [ebp - 8], eax
push edi
mov edi, edx
mov dword [ebp - 4], edx
cmp dword [ebp + 8], edx
je 0x413a74
lea ebx, [ecx + 0x474]
cmp word [ebx], dx
je 0x413a74
push 0x401490
push 0x20a
call fcn.0041db19
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4139c0
mov edi, 0x8007000e
push edi
push 0x405d18
jmp 0x413a7f
push ebx
push 0x402678
push 0x104
push esi
call dword [sym.imp.msvcrt.dll_swprintf_s]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcstok_s]
mov ebx, eax
add esp, 0x1c
test ebx, ebx
je 0x413a4b
jmp 0x413a31
push ebx
push esi
push 0x4026c4
push 0x104
push esi
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x14
push 0
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x413a2e
call fcn.00416327
mov edi, eax
cmp edi, 0x800700b7
je 0x413a2c
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x413a2e
xor edi, edi
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
call dword [sym.imp.msvcrt.dll_wcstok_s]
add esp, 0xc
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x4139ee
push ebx
push esi
push 0x4026c4
mov ebx, 0x104
push ebx
push esi
call dword [sym.imp.msvcrt.dll_swprintf_s]
push esi
push 0x402678
push ebx
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x24
jmp 0x413a98
mov edi, 0x80070057
push edi
push 0x405c08
push 0x405cb0
push 0x420710
push 0x40149c
push 2
call fcn.00411c1c
add esp, 0x18
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x413e84
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x420164]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x413eae
push 0x406890
call fcn.00411d0e
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x413efe
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x413edb
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x413efe
push esi
push 0x406898
push 0x406940
push 0x420710
push 0x40149c
push 2
call fcn.00411c1c
add esp, 0x18
jmp 0x413f77
push 0x4069a8
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.0041597c
mov esi, eax
mov dword [ebp - 0x210], esi
test esi, esi
jns 0x413f25
push esi
push 0x4069e0
jmp 0x413ee3
push ebx
xor ebx, ebx
cmp dword [edi + 0x5fec], ebx
jle 0x413f76
lea esi, [edi + 0x1eaa]
push esi
mov ecx, edi
call fcn.00413c83
test eax, eax
jns 0x413f61
push eax
push 0x406a88
push 0x406940
push 0x420710
push 0x4014c4
push 2
call fcn.00411c1c
add esp, 0x18
inc ebx
add esi, 0x20a
cmp ebx, dword [edi + 0x5fec]
jl 0x413f36
mov esi, dword [ebp - 0x210]
pop ebx
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x413f84
push esi
call fcn.00411e77
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0041d370
leave
ret

Function at 0x413f96
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x420164]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x413fc0
push 0x406b30
call fcn.00411d0e
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x414010
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x413fed
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x414010
push esi
push 0x406b38
push 0x406be0
push 0x420710
push 0x40149c
push 2
call fcn.00411c1c
add esp, 0x18
jmp 0x414089
push 0x406c4c
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.0041597c
mov esi, eax
mov dword [ebp - 0x210], esi
test esi, esi
jns 0x414037
push esi
push 0x406c88
jmp 0x413ff5
push ebx
xor ebx, ebx
cmp dword [edi + 0x5fec], ebx
jle 0x414088
lea esi, [edi + 0x1eaa]
push esi
mov ecx, edi
call fcn.00413d2e
test eax, eax
jns 0x414073
push eax
push 0x406d30
push 0x406be0
push 0x420710
push 0x4014c4
push 2
call fcn.00411c1c
add esp, 0x18
inc ebx
add esi, 0x20a
cmp ebx, dword [edi + 0x5fec]
jl 0x414048
mov esi, dword [ebp - 0x210]
pop ebx
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x414096
push esi
call fcn.00411e77
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0041d370
leave
ret
Function at 0x4140a6
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x420164]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x4140d0
push 0x406dd8
call fcn.00411d0e
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
test eax, eax
jne 0x414120
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4140fd
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x414120
push esi
push 0x406de0
push 0x406e88
push 0x420710
push 0x40149c
push 2
call fcn.00411c1c
add esp, 0x18
jmp 0x414199
push 0x406ef0
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.0041597c
mov esi, eax
mov dword [ebp - 0x210], esi
test esi, esi
jns 0x414147
push esi
push 0x406f30
jmp 0x414105
push ebx
xor ebx, ebx
cmp dword [edi + 0x5fec], ebx
jle 0x414198
lea esi, [edi + 0x1eaa]
push esi
mov ecx, edi
call fcn.00413dd9
test eax, eax
jns 0x414183
push eax
push 0x406fd8
push 0x406e88
push 0x420710
push 0x4014c4
push 2
call fcn.00411c1c
add esp, 0x18
inc ebx
add esi, 0x20a
cmp ebx, dword [edi + 0x5fec]
jl 0x414158
mov esi, dword [ebp - 0x210]
pop ebx
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x4141a6
push esi
call fcn.00411e77
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0041d370
leave
ret
Function at 0x4151eb
Capabilities:
Delete file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x420164]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x210
xor esi, esi
lea eax, [ebp - 0x238]
push esi
push eax
mov edi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x23c], esi
cmp dword [edi + 0x5ff4], esi
je 0x415348
lea eax, [edi + 0x1a96]
cmp word [eax], si
je 0x415348
cmp dword [edi + 0x5ff8], esi
jle 0x415348
push 0x4099b0
push eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.msvcrt.dll__wfopen_s]
mov ebx, eax
add esp, 0xc
mov dword [ebp - 0x240], ebx
test ebx, ebx
je 0x415296
mov eax, 0x80070005
push eax
push 0x4099b8
push 0x409958
push 0x420710
push 0x40149c
push 2
mov esi, eax
call fcn.00411c1c
add esp, 0x18
jmp 0x415376
mov ebx, esi
cmp dword [edi + 0x5ff8], esi
jle 0x415374
lea eax, [ebp - 0x28]
push eax
mov eax, dword [edi + 0x5ff4]
push dword [eax + ebx*8 + 4]
call dword [sym.imp.msvcrt.dll__wstat]
pop ecx
pop ecx
test eax, eax
jne 0x41531a
mov eax, dword [edi + 0x5ff4]
push dword [eax + ebx*8 + 4]
lea eax, [ebp - 0x238]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcscpy_s]
push dword [ebp - 0x23c]
mov eax, dword [ebp - 0xc]
push 1
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x238]
push 0x210
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x1c
cmp eax, 1
jne 0x41530d
inc ebx
cmp ebx, dword [edi + 0x5ff8]
jl 0x4152a4
jmp 0x415340
mov eax, 0x80070005
push eax
push 0x409b08
jmp 0x415325
mov eax, 0x80070005
push eax
push 0x409a60
push 0x409958
push 0x420710
push 0x40149c
push 2
mov esi, eax
call fcn.00411c1c
add esp, 0x18
mov ebx, dword [ebp - 0x240]
jmp 0x415376
mov esi, 0x80070057
push esi
push 0x4098b0
push 0x409958
push 0x420710
push 0x40149c
push 2
call fcn.00411c1c
mov ebx, dword [ebp - 0x23c]
add esp, 0x18
jmp 0x415376
mov ebx, eax
cmp dword [ebp - 0x23c], 0
je 0x41538c
push dword [ebp - 0x23c]
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
test ebx, ebx
jne 0x415394
test esi, esi
jns 0x4153a1
lea ecx, [edi + 0x1a96]
push ecx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d370
leave
ret
Function at 0x4153b2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x420164]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x210
xor esi, esi
lea eax, [ebp - 0x238]
push esi
push eax
mov edi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x23c], esi
mov ebx, 0x80070005
test edi, edi
je 0x4154d9
cmp word [edi], si
je 0x4154d9
push 0x409cb8
lea eax, [ebp - 0x23c]
push edi
push eax
call dword [sym.imp.msvcrt.dll__wfopen_s]
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41543e
push ebx
push 0x409cc0
mov esi, ebx
push 0x409c58
push 0x420710
push 0x40149c
push 2
call fcn.00411c1c
jmp 0x415502
push dword [ebp - 0x23c]
lea eax, [ebp - 0x238]
push 1
push 0x210
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x415468
push ebx
push 0x409d68
jmp 0x415421
push dword [ebp - 0x23c]
call dword [sym.imp.msvcrt.dll_feof]
pop ecx
jmp 0x4154c1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.msvcrt.dll__wstat]
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x4154c7
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x2c]
jne 0x4154c7
push dword [ebp - 0x23c]
lea eax, [ebp - 0x238]
push 1
push 0x210
push eax
call dword [sym.imp.msvcrt.dll_fread]
push dword [ebp - 0x23c]
call dword [sym.imp.msvcrt.dll_feof]
add esp, 0x14
test eax, eax
je 0x415477
jmp 0x415505
mov eax, 0x80070057
push eax
mov esi, eax
push 0x409e10
jmp 0x415423
mov eax, 0x80070057
push eax
push 0x409bb0
push 0x409c58
push 0x420710
push 0x40149c
push 2
mov esi, eax
call fcn.00411c1c
mov edi, dword [ebp - 0x23c]
add esp, 0x18
cmp dword [ebp - 0x23c], 0
je 0x41551b
push dword [ebp - 0x23c]
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
test edi, edi
jne 0x415523
test esi, esi
jns 0x415525
mov esi, ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d370
leave
ret
Function at 0x415536
Capabilities:
Delete file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x420164]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x210
xor esi, esi
lea eax, [ebp - 0x238]
push esi
push eax
mov ebx, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x23c], esi
cmp dword [ebx + 0x5ff4], esi
je 0x41564f
lea eax, [ebx + 0x1ca0]
cmp word [eax], si
je 0x41564f
cmp dword [ebx + 0x5ff8], esi
jle 0x41564f
push 0x4099b0
push eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.msvcrt.dll__wfopen_s]
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4155d8
mov eax, 0x80070005
push eax
push 0x409fc8
push 0x409f60
push 0x420710
push 0x40149c
push 2
mov esi, eax
call fcn.00411c1c
jmp 0x415676
lea ecx, [ebp - 0x28]
lea eax, [ebx + 0x1a96]
push ecx
push eax
call dword [sym.imp.msvcrt.dll__wstat]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4155fe
mov eax, 0x80070005
push eax
push 0x40a070
jmp 0x4155bb
lea eax, [ebx + 0x1a96]
push eax
lea eax, [ebp - 0x238]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcscpy_s]
push dword [ebp - 0x23c]
mov eax, dword [ebp - 0xc]
push 1
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x238]
push 0x210
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x1c
cmp eax, 1
je 0x415679
mov eax, 0x80070005
push eax
push 0x40a118
jmp 0x4155bb
mov esi, 0x80070057
push esi
push 0x409eb8
push 0x409f60
push 0x420710
push 0x40149c
push 2
call fcn.00411c1c
mov edi, dword [ebp - 0x23c]
add esp, 0x18
add ebx, 0x1ca0
cmp dword [ebp - 0x23c], 0
je 0x415695
push dword [ebp - 0x23c]
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
test edi, edi
jne 0x41569d
test esi, esi
jns 0x4156a4
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d370
leave
ret
Function at 0x4156b5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x420164]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x210
xor esi, esi
lea eax, [ebp - 0x238]
push esi
push eax
mov ebx, edx
mov edi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x23c], esi
test edi, edi
je 0x4157b3
cmp word [edi], si
je 0x4157b3
test ebx, ebx
je 0x4157b3
push 0x409cb8
lea eax, [ebp - 0x23c]
push edi
push eax
call dword [sym.imp.msvcrt.dll__wfopen_s]
add esp, 0xc
test eax, eax
jne 0x415743
push dword [ebp - 0x23c]
lea eax, [ebp - 0x238]
push 1
push 0x210
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x41574a
mov eax, 0x80070005
jmp 0x4157b8
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.msvcrt.dll__wstat]
pop ecx
pop ecx
test eax, eax
jne 0x4157b3
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x2c]
jne 0x4157b3
lea ecx, [ebp - 0x238]
call fcn.004153b2
test eax, eax
js 0x4157b8
lea eax, [ebp - 0x238]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
jne 0x415794
mov eax, 0x800c0002
jmp 0x4157b8
lea ecx, [ebp - 0x238]
sub eax, ecx
sar eax, 1
push eax
mov eax, ecx
push eax
push 0x104
push ebx
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
jmp 0x4157ba
mov eax, 0x80070057
mov esi, eax
cmp dword [ebp - 0x23c], 0
je 0x4157d0
push dword [ebp - 0x23c]
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d370
leave
ret
Function at 0x4157e1
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x420164]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
test eax, eax
je 0x415945
cmp word [eax], si
je 0x415945
push 0x40a2d0
push eax
lea eax, [ebp - 0x21c]
push 0x4026c4
push eax
call fcn.00416096
add esp, 0x10
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x415856
mov esi, 0x80070005
push esi
push 0x40a2d8
jmp 0x415950
mov dword [ebx + 0x5fec], esi
mov dword [ebp - 0x470], esi
test byte [ebp - 0x46c], 0x10
jbe 0x415915
mov ecx, 0x40a630
lea eax, [ebp - 0x440]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4158a0
test dx, dx
je 0x41589c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4158a0
add eax, 4
add ecx, 4
test dx, dx
jne 0x41587a
mov eax, esi
jmp 0x4158a5
sbb eax, eax
or eax, 1
test eax, eax
je 0x415915
mov ecx, 0x409218
lea eax, [ebp - 0x440]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4158da
test dx, dx
je 0x4158d6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4158da
add eax, 4
add ecx, 4
test dx, dx
jne 0x4158b4
mov eax, esi
jmp 0x4158df
sbb eax, eax
or eax, 1
test eax, eax
je 0x415915
mov ecx, dword [ebp - 0x470]
lea eax, [ecx + 1]
mov dword [ebx + 0x5fec], eax
lea eax, [ebp - 0x440]
push eax
imul eax, ecx, 0x20a
push 0x105
add eax, 0x1eaa
add eax, ebx
push eax
call dword [sym.imp.msvcrt.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x46c]
push eax
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
je 0x41593c
mov eax, dword [ebx + 0x5fec]
mov dword [ebp - 0x470], eax
cmp eax, 0x20
jl 0x415862
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
jmp 0x415969
mov esi, 0x80070057
push esi
push 0x40a1c0
push 0x40a268
push 0x420710
push 0x40149c
push 2
call fcn.00411c1c
add esp, 0x18
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d370
leave
ret 4