joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e3b8
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, esi
call fcn.00404818
cmp ebx, 0xffffffff
je 0x46e40d
mov eax, 0x104
call fcn.0040b950
mov dword [esp + 4], eax
push esp
push edi
push ebx
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x46e404
mov edx, esi
mov eax, dword [esp + 4]
call fcn.0040b93c
mov eax, dword [esp + 4]
call fcn.0040b9ac
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x46eff8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x46f10b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x47978c]
push eax
mov eax, dword [0x479788]
push eax
mov ecx, 0x46f120
mov edx, 0x46f130
mov eax, dword [0x479790]
call fcn.0046f178
lea edx, [ebp - 0xc]
mov eax, dword [0x4751bc]
mov eax, dword [eax]
call fcn.00453800
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040b5c4
lea eax, [ebp - 8]
mov edx, 0x46f13c
call fcn.00404ae0
mov eax, dword [ebp - 8]
call fcn.0040b52c
test al, al
je 0x46f0ad
push 5
push 0x46f150
push 0x46f150
lea edx, [ebp - 0x14]
mov eax, dword [0x4751bc]
mov eax, dword [eax]
call fcn.00453800
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040b5c4
lea eax, [ebp - 0x10]
mov edx, 0x46f13c
call fcn.00404ae0
mov eax, dword [ebp - 0x10]
call fcn.00404cd8
push eax
push 0x46f154
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x46f0f0
lea eax, [ebp - 4]
call fcn.0046e414
test al, al
je 0x46f0dc
push 5
push 0x46f150
push 0x46f150
mov eax, dword [ebp - 4]
call fcn.00404cd8
push eax
push 0x46f154
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x46f0f0
push 1
push 0
push 0
push 0x46f15c
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f112
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040483c
ret
Function at 0x46f178
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cc8
mov eax, dword [ebp - 8]
call fcn.00404cc8
mov eax, dword [ebp - 0xc]
call fcn.00404cc8
mov eax, dword [ebp + 0xc]
call fcn.00404cc8
mov eax, dword [ebp + 8]
call fcn.00404cc8
xor eax, eax
push ebp
push 0x46f2e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov dl, 1
mov eax, dword [0x454e60]
call fcn.00454ee0
mov ebx, eax
mov byte [ebx + 0xf], 1
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea edx, [ebp - 0x38]
mov ecx, 4
mov eax, 0x46f2fc
call fcn.0040be54
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.004555b0
push 0
push 0
mov eax, ebx
call fcn.0045559c
mov eax, ebx
call fcn.0041cf08
mov cl, 1
mov dl, 1
mov eax, dword [0x454e60]
call fcn.00454ee0
mov ebx, eax
mov byte [ebx + 0xf], 1
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea edx, [ebp - 0x38]
mov ecx, 4
mov eax, 0x46f34c
call fcn.0040be54
mov edx, dword [ebp - 0x3c]
mov eax, ebx
call fcn.004555b0
push 0
push 0
mov eax, ebx
call fcn.0045559c
mov eax, ebx
call fcn.0041cf08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f2ed
lea eax, [ebp - 0x3c]
call fcn.00404818
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040483c
lea eax, [ebp + 8]
mov edx, 2
call fcn.0040483c
ret
Function at 0x46f39c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cc8
xor eax, eax
push ebp
push 0x46f4cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404818
cmp dword [ebp - 4], 0
je 0x46f4b7
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00404cd8
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x46f4b7
mov eax, dword [ebp - 8]
call fcn.00402d38
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x46f4b0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x46f4dc
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 8]
shr esi, 0x10
mov dx, word [eax + 8]
and dx, 0xffff
mov word [ebp - 0x1a], dx
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 0x1c], dx
mov di, word [eax + 0xc]
and di, 0xffff
push ebx
movzx eax, si
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
movzx eax, word [ebp - 0x1a]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
movzx eax, word [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
movzx eax, di
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x3c]
mov ecx, 3
mov eax, 0x46f4e8
call fcn.0040be54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f4b7
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00402d68
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f4d4
lea eax, [ebp - 4]
call fcn.00404818
ret
Function at 0x46f4f4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46f684
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00404818
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
call fcn.004048b0
mov dword [ebp - 0x24], 0xff
mov eax, dword [ebp - 4]
call fcn.00404ad8
test eax, eax
jle 0x46f669
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.00404cd8
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jbe 0x46f647
mov eax, dword [ebp - 0x1c]
call fcn.00402d38
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x46f640
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x46f627
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x46f690
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46f5fe
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.004073dc
movzx eax, ax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
lea edx, [ebp - 0x44]
mov ecx, 2
mov eax, 0x46f6b4
call fcn.0040be54
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
call fcn.004048b0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x28]
call fcn.00404cd8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46f627
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0040b93c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f647
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.00402d68
ret
mov eax, dword [ebp - 8]
mov edx, 0x46f6dc
call fcn.00404c24
jne 0x46f669
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x46f669
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0046f39c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f68b
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.0040483c
ret
Function at 0x4051ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4087d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040429a
and dword [ebp - 0x14], 0
cmp dword [0x40c630], 0
mov dword [ebp - 0x18], eax
jne 0x40525e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405306
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405306
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40c630], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40c634], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40c638], eax
call edi
push eax
call esi
mov dword [0x40c640], eax
test eax, eax
je 0x40525e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40c63c], eax
mov eax, dword [0x40c63c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4052b7
cmp dword [0x40c640], ecx
je 0x4052b7
push eax
call esi
push dword [0x40c640]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4052b7
test ebx, ebx
je 0x4052b7
call edi
test eax, eax
je 0x4052ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4052ae
test byte [ebp - 8], 1
jne 0x4052b7
or dword [ebp + 0x10], 0x200000
jmp 0x4052ea
mov eax, dword [0x40c634]
cmp eax, dword [ebp - 0x18]
je 0x4052ea
push eax
call esi
test eax, eax
je 0x4052ea
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4052ea
mov eax, dword [0x40c638]
cmp eax, dword [ebp - 0x18]
je 0x4052ea
push eax
call esi
test eax, eax
je 0x4052ea
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40c630]
call esi
test eax, eax
je 0x405306
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405308
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405516
leave
ret

Function at 0x405516
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4087d0]
jne 0x405520
repz ret
jmp fcn.00406683

Function at 0x432006
Capabilities:
Encode data using xor

Disassembly:
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4032f5
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x218
mov ebx, dword [esp + 0x234]
mov edi, dword [esp + 0x230]
mov esi, ebx
and esi, 0x300
lea eax, [esi + 9]
mov ecx, esp
push ecx
push eax
push edi
push dword [esp + 0x238]
call fcn.00407778
test eax, eax
jne 0x4033e4
mov dword [esp + 4], esi
test bl, 2
je 0x403370
xor eax, eax
lea ecx, [esp + 8]
mov dword [ecx], eax
mov edx, dword [esp]
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x2e]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x4033c6
lea ebp, [esp + 0xe]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0x105
push ebp
push 0
push dword [esp + 0xc]
call esi
test eax, eax
jne 0x4033a0
test bl, 1
jne 0x4033c6
push ebx
push ebp
push dword [esp + 8]
call fcn.004032f5
test eax, eax
je 0x40337a
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004068d4
test eax, eax
je 0x4033d6
push 0
push dword [esp + 8]
push edi
push dword [esp + 0x238]
call eax
jmp 0x4033e4
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x4033e4
push edi
push dword [esp + 0x230]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4038b2
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
test eax, eax
js 0x4038dd
add eax, dword [0x421a84]
mov dword [0x421a48], eax
xor ecx, ecx
push ecx
push ecx
push eax
push dword [0x417014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.004039c5
test eax, eax
js 0x403951
mov eax, esp
push 4
push eax
push dword [0x417014]
call fcn.0040713a
test eax, eax
je 0x4039a9
add dword [0x421a48], 4
push dword [esp]
call fcn.004039c5
test eax, eax
js 0x403951
mov eax, dword [esp + 0x24]
test eax, eax
je 0x403955
mov ecx, dword [esp + 0x28]
mov edx, dword [esp]
cmp edx, ecx
cmovl ecx, edx
lea edx, [esp + 4]
push 0
push edx
push ecx
push eax
push dword [0x417014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, 0xfffffffd
test eax, eax
je 0x4039ae
mov esi, dword [esp + 4]
add dword [0x421a48], esi
jmp 0x4039ae
mov esi, eax
jmp 0x4039ae
mov edi, dword [esp]
test edi, edi
jle 0x4039ba
mov ebx, dword [esp + 0x20]
xor esi, esi
mov ebp, 0x4000
cmp edi, ebp
cmovge edi, ebp
push edi
push 0x421a8c
push dword [0x417014]
call fcn.0040713a
test eax, eax
je 0x4039a9
push edi
push 0x421a8c
push ebx
call fcn.0040716c
test eax, eax
je 0x4039be
add esi, edi
mov eax, dword [esp]
add dword [0x421a48], edi
sub eax, edi
mov dword [esp], eax
mov edi, eax
test eax, eax
jg 0x403967
jmp 0x4039ae
mov esi, 0xfffffffd
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
xor esi, esi
jmp 0x4039ae
mov esi, 0xfffffffe
jmp 0x4039ae
Function at 0x406848
Capabilities:
Create directory

Disassembly:
push esi
sub esp, 0x20
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0xc]
mov dword [ecx], 0x40001
mov edx, 0x40a7d4
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
xor esi, esi
mov dword [ecx + 0xc], esi
mov dword [ecx + 0x10], 0x40a7c4
mov edx, esp
mov dword [edx], 0xc
mov dword [edx + 4], ecx
mov dword [edx + 8], esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x406893
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
add esp, 0x20
pop esi
ret 4

Function at 0x40690d
Capabilities:
Create process on windows

Disassembly:
push esi
sub esp, 0x38
mov eax, dword [esp + 0x40]
mov dword [0x432b28], 0x44
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], ecx
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
movaps xmm0, xmmword [0x40a790]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [esp + 0x20], 0x432b28
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x40696d
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov esi, dword [esp + 0x28]
mov eax, esi
add esp, 0x38
pop esi
ret 4

Function at 0x406976
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x3c
mov dword [eax + 0x24], 0
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x406a22
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
push ebx
call fcn.00406a73
xor esi, esi
cmp eax, 0xffffffff
je 0x406a6a
mov edi, eax
mov eax, dword [esp + 0x18]
mov ebp, eax
test al, 1
jne 0x406a4c
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x406a53
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x406a5c
xor esi, esi
inc esi
jmp 0x406a6a
mov eax, ebp
test al, 4
jne 0x406a6a
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x406a73
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push edi
push esi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
je 0x406a94
mov eax, esi
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
pop edi
ret 4
Function at 0x406a9b
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x260
mov esi, dword [esp + 0x278]
mov ebx, dword [esp + 0x274]
push ebx
call fcn.00406ccc
mov ecx, esi
test cl, 8
jne 0x406aeb
mov edx, ecx
and edx, 4
mov dword [esp + 8], edx
test cl, 1
jne 0x406b04
mov dword [esp + 4], eax
push 0x400
push ebx
push 0x432b6c
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push ebx
call fcn.00406d83
jmp 0x406b37
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [0x40a474]
cmp eax, 1
adc dword [ecx + 8], 0
jmp 0x406cad
test cl, 2
je 0x406c6f
test eax, eax
je 0x406c6f
mov dword [esp + 4], eax
mov esi, 0x432b6c
push 0x400
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push str..
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp word [ebx], 0
jne 0x406b47
cmp word [0x432b6c], 0x5c
jne 0x406b53
push 0x40a802
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [ebx + eax*2]
lea ebp, [esp + 0x10]
push ebp
push 0x432b6c
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x406c5a
mov edi, eax
mov eax, dword [esp + 0x278]
and eax, 3
mov dword [esp + 0xc], eax
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [esp], esi
movzx ecx, word [esp + 0x3c]
movzx eax, word [esp + 0x3e]
cmp cx, 0x2e
jne 0x406ba8
test ax, ax
je 0x406c40
cmp cx, 0x2e
jne 0x406bc0
cmp ax, 0x2e
jne 0x406bc0
cmp word [esp + 0x40], 0
je 0x406c40
push 0x400
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
test byte [esp + 0x10], 0x10
jne 0x406bf8
mov esi, dword [esp + 8]
push esi
mov ebp, dword [esp + 0x278]
push ebp
call fcn.00406a22
test eax, eax
je 0x406c14
push ebp
push 0xfffffffffffffff2
call fcn.0040645c
jmp 0x406c39
cmp dword [esp + 0xc], 3
jne 0x406c40
push dword [esp + 0x278]
push dword [esp + 0x278]
call fcn.00406a9b
jmp 0x406c40
test esi, esi
jne 0x406c22
mov eax, dword [0x40a474]
inc dword [eax + 8]
jmp 0x406c39
mov ebp, dword [esp + 0x274]
push ebp
push 0xfffffffffffffff1
call fcn.0040645c
push 0
push ebp
call fcn.00406dba
mov esi, dword [esp]
lea ebp, [esp + 0x10]
push ebp
push edi
call ebx
test eax, eax
jne 0x406b8f
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [esp + 0x274]
mov eax, dword [esp + 0x278]
test al, 1
je 0x406cad
mov word [esi - 2], 0
mov eax, dword [esp + 4]
test eax, eax
je 0x406ca5
push ebx
call fcn.00406de9
test eax, eax
je 0x406cad
push ebx
call fcn.00406e11
mov esi, dword [esp + 8]
mov eax, esi
or eax, 1
push eax
push ebx
call fcn.00406a22
test eax, eax
je 0x406ca1
push ebx
push 0xffffffffffffffe5
call fcn.0040645c
jmp 0x406cad
test esi, esi
jne 0x406cba
mov eax, dword [0x40a474]
inc dword [eax + 8]
add esp, 0x260
pop esi
pop edi
pop ebx
pop ebp
ret 8
push ebx
push 0xfffffffffffffff1
call fcn.0040645c
push 0
push ebx
call fcn.00406dba
jmp 0x406cad
Function at 0x406ccc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, 0x43336c
push 0x400
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
call fcn.00406ea4
xor ebx, ebx
test eax, eax
je 0x406d5e
mov esi, eax
push eax
call fcn.00406f19
mov eax, dword [0x40a77c]
test byte [eax], 0x80
je 0x406d0f
movzx eax, word [esi]
test eax, eax
je 0x406d5e
cmp eax, 0x5c
je 0x406d5e
mov edi, 0x43336c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub esi, edi
sar esi, 1
cmp eax, esi
jle 0x406d49
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x43336c
call fcn.00406de9
test eax, eax
je 0x406d3c
test byte [eax], 0x10
je 0x406d5e
push edi
call fcn.00406d83
push edi
call ebp
cmp eax, esi
jg 0x406d29
push edi
call fcn.00406e11
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x406dba
Capabilities:
Move file

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
push 5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406ddc
push edi
push esi
call fcn.00407241
add esp, 8
mov eax, dword [0x40a474]
inc dword [eax + 0x10]
pop esi
pop edi
ret 8

Function at 0x40709a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove eax, ecx
push ecx
push eax
push ebx
push ecx
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop esi
pop edi
pop ebx
ret 0xc

Function at 0x4070cc
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x1c]
mov ebx, 0xffffff9b
mov ebp, esp
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
inc ebx
je 0x407127
mov dword [esp + 4], 0x61
mov dword [esp], 0x73006e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov edx, 0x4ec4ec4f
mul edx
shr edx, 3
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
add eax, edx
sub ecx, eax
add word [esp + 4], cx
push esi
push 0
push ebp
push dword [esp + 0x2c]
call edi
test eax, eax
je 0x4070e4
jmp 0x40712e
mov word [esi], 0
xor esi, esi
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x40713a
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
mov edi, esp
push 0
push edi
push esi
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne al
cmp dword [edi], esi
sete cl
and cl, al
movzx eax, cl
add esp, 4
pop esi
pop edi
ret 0xc