joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420294
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x5f88af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202cf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202e8
lea eax, [ebp - 0x10]
mov edx, dword [0x615348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202fb
lea eax, [ebp - 0x10]
mov edx, dword [0x615348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x420307
adc edx, 0
mov edx, dword [edx*4 + 0x614178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420481
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420474
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420474
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420412
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420412
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420412
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420412
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420474
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420474
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420499
inc ebx
cmp ebx, 0x19
jne 0x4202c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f88b6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x1000215f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1000216e
pop dword [ebp - 0x50]
mov eax, 0x1daacc1d
add eax, 0xf2555551
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x374ce
push 0
mov eax, 0x7304e788
sub eax, 0x630416ac
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x4447
mov esi, eax
mov edx, 0x10015200
add edx, dword [ebp - 0x50]
mov ebx, 0xeadd3bd6
mov edi, dword [edx]
xor dword [ebp - 0x24], 0xf4a0bf2b
xor edi, ebx
add dword [ebp - 0x24], eax
mov dword [esi], edi
mov dword [ebp - 0x14], 0x34c23ad6
add esi, 0xb4b4d854
sub esi, 0xb4b4d850
add edx, 0xb93abb3b
sub edx, 0xb93abb37
loop 0x100021bb
add eax, 0x7af56773
add eax, 0x850b9c7c
xor ebx, ebx
add ebx, eax
add eax, 0xcfffaa7d
sub eax, 0xcfffaa78
mov ecx, 0x6b88a761
sub ecx, 0x5b88a761
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x1000655b
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi - 0x6c]
mov ecx, esi
call fcn.1000215f
test eax, eax
jne 0x1000657b
mov eax, 0x80070005
jmp 0x100065ec
push esi
mov ecx, esi
call fcn.1000215f
test eax, eax
js 0x100065ea
cmp dword [edi + 0x44], 0
je 0x100065ea
and dword [ebp + 8], 0
lea eax, [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
push eax
call esi
lea eax, [ebp - 8]
push eax
call esi
push 0x14
pop ecx
call fcn.100099b8
test eax, eax
je 0x100065c7
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
and dword [eax + 8], 0
mov dword [eax], vtable.CNameShowContactCardJob.0
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
jmp 0x100065c9
xor eax, eax
push eax
lea ecx, [ebp + 8]
call fcn.1000215f
mov esi, dword [ebp + 8]
test esi, esi
je 0x100065ea
mov ecx, dword [edi + 0x44]
push esi
call fcn.1000215f
test eax, eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x1001b560
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov dword [ebp - 4], eax
jb 0x1001b57b
mov edi, dword [edx]
mov ebx, dword [edx + 0x10]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x1001b5a4
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x1001b590
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.1001d750
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x1001b5c4
add eax, 0x20
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__
int3
Function at 0x1001cf50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100df320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1001cf80
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1001cfb0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1001cfb0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1001d0ab
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001cfd9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001d00d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1001d06c
sub eax, 1
je 0x1001d06c
sub eax, 2
jne 0x1001d0ab
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1001d750
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001d08a
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1001d0ab
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1001d0ab
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
Function at 0x1001d750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1001d75f
pop dword [ebp - 0x1c]
mov eax, 0x1001d75f
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x4da1c8b1
sub dword [ebp - 0x2c], 0xff4f8366
mov dword [ebp - 0x28], 0x583c4ebe
sub dword [ebp - 0x28], 0x26090279
mov dword [ebp - 0x24], 0x600009dc
sub dword [ebp - 0x24], 0x13b3c5ae
mov dword [ebp - 0x20], 0x7b140ea6
add dword [ebp - 0x20], 0x84ebf15a
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x3b313667
add dword [ebp - 0x2c], 0x394132ef
mov dword [ebp - 0x28], 0x51785fb2
add dword [ebp - 0x28], 0xeff401c3
mov dword [ebp - 0x24], 0xeca35538
sub dword [ebp - 0x24], 0x8933e8cc
mov dword [ebp - 0x20], 0xea45c2fb
sub dword [ebp - 0x20], 0xea45c2fb
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x2684c982
sub eax, 0x167958e6
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x601d6
push 0
call eax
mov ecx, 0x648e3399
add ecx, 0x9b721da7
mov edi, eax
mov esi, 0x2bd84710
sub esi, 0x1bc91310
add esi, dword [ebp - 0x1c]
mov ebx, 0x2cb1050e
xor dword [ebp - 0xc], edi
mov edx, dword [esi]
add edx, ebx
mov dword [edi], edx
add edi, 0x1841cb55
sub edi, 0x1841cb51
add esi, 4
loop 0x1001d871
add eax, 0x137d3
mov ebx, eax
add eax, 0x778fca04
add eax, 0x88703601
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x40121d
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1714]
mov eax, 0x1794
call fcn.00413c90
mov eax, dword [0x43bc80]
xor eax, ebp
mov dword [ebp + 0x1710], eax
mov eax, dword [ebp + 0x171c]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x1720]
xor edi, edi
cmp dword [ebp + 0x1728], ebx
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x6c], ebx
jl 0x401326
jg 0x401272
cmp dword [ebp + 0x1724], ebx
jbe 0x401326
mov ecx, dword [ebp + 0x1724]
sub ecx, dword [ebp - 0x6c]
mov eax, dword [ebp + 0x1728]
sbb eax, edi
js 0x401299
jg 0x40128f
cmp ecx, 0x1770
jbe 0x401299
mov ecx, 0x1770
mov dword [ebp - 0x7c], ebx
jmp 0x40129c
mov dword [ebp - 0x7c], eax
push ebx
lea eax, [ebp - 0x64]
push eax
push ecx
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40135f
mov eax, dword [ebp - 0x64]
cmp eax, ebx
je 0x40135f
cmp byte [ebp + 0x172c], bl
je 0x4012da
xor ecx, ecx
cmp eax, ebx
jbe 0x4012da
xor byte [ebp + ecx - 0x60], 0x88
inc ecx
cmp ecx, eax
jb 0x4012d0
xor esi, esi
cmp eax, ebx
jbe 0x401304
push ebx
lea ecx, [ebp - 0x70]
push ecx
sub eax, esi
push eax
lea eax, [ebp + esi - 0x60]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401340
add esi, dword [ebp - 0x70]
mov eax, dword [ebp - 0x64]
cmp esi, eax
jb 0x4012e0
add dword [ebp - 0x6c], eax
adc edi, ebx
cmp edi, dword [ebp + 0x1728]
jl 0x401272
jg 0x401326
mov eax, dword [ebp + 0x1724]
cmp dword [ebp - 0x6c], eax
jb 0x401272
xor eax, eax
mov ecx, dword [ebp + 0x1710]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c78
add ebp, 0x1714
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x64]
sub eax, esi
push eax
push str.WriteFile_failed__d__d
call fcn.0040e9dd
add esp, 0xc
push 2
pop eax
jmp 0x401328
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x64]
push str.ReadFile_failed__d__d__I64d
call fcn.0040e9dd
xor eax, eax
add esp, 0x14
inc eax
jmp 0x401328
Function at 0x403ade
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x1708]
mov eax, 0x1788
call fcn.00413c90
mov eax, dword [0x43bc80]
xor eax, ebp
mov dword [ebp + 0x1704], eax
push ebx
push esi
push str.extracting_files
call fcn.0040ea46
mov dword [esp], 0x7d2
call fcn.004038cb
mov esi, eax
push esi
push 0x430d90
mov dword [ebp - 0x80], esi
call fcn.0040ea46
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
jne 0x403b43
cmp byte [ebp + 0x1710], bl
je 0x403b3c
mov byte [0x448cd8], bl
xor eax, eax
jmp 0x403c9b
cmp byte [ebp + 0x1710], bl
je 0x403b50
call fcn.004107c6
push edi
call fcn.0040106b
push ebx
push ebx
push dword [0x43d068]
mov dword [ebp - 0x74], eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x7d3
call fcn.00403870
mov dword [esp], 0x430d8c
push eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], ebx
call fcn.00414590
cmp esi, ebx
pop ecx
pop ecx
mov dword [ebp - 0x70], eax
jle 0x403c69
mov edi, 0x448cd8
cmp dword [ebp - 0x70], ebx
je 0x403c69
push dword [ebp - 0x70]
call fcn.00413700
pop ecx
test eax, eax
je 0x403c69
push dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
push edi
push 0x430d84
push eax
call fcn.00414711
push 0x5c
push dword [ebp - 0x70]
call fcn.00413640
mov esi, eax
add esp, 0x18
cmp esi, ebx
je 0x403c23
push edi
call fcn.00413700
sub esi, dword [ebp - 0x70]
lea ecx, [ebp + esi - 0x6b]
mov byte [ecx + eax], bl
lea eax, [ebp - 0x6c]
push eax
push str.creating_directory__S
call fcn.0040ea46
add esp, 0xc
push ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x403c23
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403c23
lea eax, [ebp - 0x6c]
push eax
push str.failed_to_create_directory__S
call fcn.0040e9dd
pop ecx
pop ecx
push dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
push edi
push 0x430d84
push eax
call fcn.00414711
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
call fcn.004027aa
mov esi, eax
add esp, 0x18
cmp esi, ebx
jne 0x403cb2
inc dword [ebp - 0x78]
push 0x430d8c
push ebx
call fcn.00414590
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x80]
pop ecx
pop ecx
jl 0x403b97
push dword [ebp - 0x7c]
call fcn.00413a45
pop ecx
push 1
push ebx
push ebx
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x74]
mov dword [0x43d060], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.extracting_files_done
call fcn.0040ea46
pop ecx
xor eax, eax
pop edi
mov ecx, dword [ebp + 0x1704]
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c78
add ebp, 0x1708
leave
ret
lea eax, [ebp - 0x6c]
push eax
push str.Failed_to_extract__S
call fcn.0040e9dd
push dword [ebp - 0x7c]
call fcn.00413a45
add esp, 0xc
mov eax, esi
jmp 0x403c9a
Function at 0x404034
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3024
call fcn.00413c90
mov eax, dword [0x43bc80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 1
push 0x430efc
push esi
call fcn.00414651
add esp, 0xc
test eax, eax
je 0x404206
push esi
call fcn.00413700
pop ecx
test eax, eax
je 0x404206
push esi
push 0x430ee4
call fcn.0040ea46
push esi
call fcn.00413700
add esp, 0xc
test eax, eax
je 0x404206
push edi
lea eax, [ebp - 0x2ee4]
push esi
push eax
call fcn.00413b80
lea eax, [ebp - 0x2ee4]
push eax
call fcn.00413700
add esp, 0xc
cmp byte [ebp + eax - 0x2ee4], 0x5c
mov edi, 0x430ee0
je 0x4040cd
lea eax, [ebp - 0x2ee4]
push edi
push eax
call fcn.00413b90
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x2ee4]
push 0x430edc
push eax
call fcn.00413b90
pop ecx
pop ecx
lea eax, [ebp - 0x3024]
push eax
lea eax, [ebp - 0x2ee4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404204
lea eax, [ebp - 0x2ff8]
push 0x430efc
push eax
call fcn.004150b0
pop ecx
pop ecx
test eax, eax
je 0x4041e7
lea eax, [ebp - 0x2ff8]
push 0x430ed8
push eax
call fcn.004150b0
pop ecx
pop ecx
test eax, eax
je 0x4041e7
lea eax, [ebp - 0x1774]
push esi
push eax
call fcn.00413b80
lea eax, [ebp - 0x1774]
push eax
call fcn.00413700
add esp, 0xc
cmp byte [ebp + eax - 0x1774], 0x5c
je 0x40416b
lea eax, [ebp - 0x1774]
push edi
push eax
call fcn.00413b90
pop ecx
pop ecx
lea eax, [ebp - 0x2ff8]
push eax
lea eax, [ebp - 0x1774]
push eax
call fcn.00413b90
test byte [ebp - 0x3024], 0x10
pop ecx
pop ecx
jbe 0x4041c7
movzx eax, byte [ebp + 0xc]
push eax
lea eax, [ebp - 0x1774]
push eax
push str.attempting_to_remove__S___d_
call fcn.0040ea46
add esp, 0xc
cmp byte [ebp + 0xc], 0
je 0x4041b8
lea eax, [ebp - 0x1774]
push 0
push eax
call fcn.00404034
pop ecx
pop ecx
lea eax, [ebp - 0x1774]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x4041e7
lea eax, [ebp - 0x1774]
push eax
push str.attempting_to_delete__S
call fcn.0040ea46
pop ecx
pop ecx
lea eax, [ebp - 0x1774]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x3024]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x404100
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00413c78
leave
ret

Function at 0x404340
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404364
cmp dword [ebp - 8], 2
jae 0x404382
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error__d_n
call fcn.0040ea46
push str.Internal_Error:_readShort
call fcn.00403ff4
add esp, 0xc
mov ax, word [ebp - 4]
leave
ret
Function at 0x4043d4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.004042f6
mov ebx, eax
cdq
sub eax, edx
mov esi, eax
sar esi, 1
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00412d69
pop ecx
pop ecx
mov edi, eax
xor eax, eax
push eax
mov word [edi + esi*2], ax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404426
cmp dword [ebp - 4], ebx
jae 0x404431
push str.Internal_Error:_readWString
call fcn.00403ff4
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405898
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x177c
call fcn.00413c90
mov eax, dword [0x43bc80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1774]
push eax
call fcn.004057ef
lea eax, [ebp - 0x1774]
push eax
push 0x4314fc
call fcn.0040ea46
add esp, 0xc
push esi
push 0
push 0x4314f8
lea eax, [ebp - 0x1774]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405972
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetTempFileName_failed__last_error__d_
call fcn.0040ea46
lea eax, [ebp - 0x1774]
push eax
call fcn.00413700
add esp, 0xc
test eax, eax
jle 0x405936
mov al, byte [ebp + eax - 0x1775]
cmp al, 0x5c
je 0x405936
cmp al, 0x2f
je 0x405936
lea eax, [ebp - 0x1774]
push 0x430ee0
push eax
call fcn.00413b90
pop ecx
pop ecx
push edi
push 0
call fcn.00415036
pop ecx
mov edi, eax
mov dword [ebp - 0x1778], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
imul eax, edi
push eax
call fcn.0041558c
call fcn.0041559e
push eax
lea eax, [ebp - 0x1774]
push eax
push str._se4j_d
push esi
call fcn.00414711
add esp, 0x14
pop edi
push esi
push str.tempFile_is__S
call fcn.0040ea46
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00413c78
leave
ret
Function at 0x406161
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x18b4]
mov eax, 0x18b4
call fcn.00413c90
push 0xffffffffffffffff
push 0x42ea26
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x43bc80]
xor eax, ebp
mov dword [ebp + 0x18b0], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x18bc]
mov edi, dword [ebp + 0x18c0]
mov esi, dword [ebp + 0x18c4]
push eax
lea eax, [ebp + 0x140]
push eax
call fcn.00413b80
lea eax, [ebp + 0x140]
push 0x431534
push eax
call fcn.00413b90
add esp, 0x10
cmp byte [edi], 0x2e
je 0x4061e8
lea eax, [ebp + 0x140]
push 0x430efc
push eax
call fcn.00413b90
pop ecx
pop ecx
lea eax, [ebp + 0x140]
push edi
push eax
call fcn.00413b90
pop ecx
pop ecx
lea eax, [ebp]
push eax
lea eax, [ebp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x406216
xor eax, eax
jmp 0x4062af
lea ecx, [ebp - 0x2c]
call fcn.00405fe9
and dword [ebp - 4], 0
push 0x1770
call fcn.00415727
lea ecx, [ebp + 0x2c]
push ecx
push eax
mov dword [ebp - 0x10], eax
call fcn.00413b80
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406138
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406222
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
imul eax, eax, 0x1770
push eax
call fcn.00415727
cmp dword [ebp - 0x14], 0
pop ecx
mov dword [esi], eax
jbe 0x40629b
xor edi, edi
lea ecx, [ebp - 0x2c]
call fcn.00405eac
mov ecx, dword [esi]
mov eax, dword [eax]
mov dword [edi + ecx], eax
lea ecx, [ebp - 0x2c]
call fcn.00406020
add edi, 4
cmp dword [ebp - 0x14], 0
ja 0x40627b
lea ecx, [ebp - 0x2c]
call fcn.00405da8
push dword [ebp - 0x2c]
call fcn.00413a45
mov eax, dword [ebp - 0x10]
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x18b0]
xor ecx, ebp
call fcn.00413c78
add ebp, 0x18b4
leave
ret