joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100014b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10020170]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100014d7
sub eax, edx
sar eax, 1
jne 0x100014f4
push ebx
push str.There_is_currently_no_matching_version_Lowest_Supported_Version:_s
push edi
jmp 0x1000159a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000150c
push esi
push str.Runtime_path_not_exist__path:__s_
push edi
jmp 0x1000159a
mov ecx, dword [0x1001b340]
mov eax, dword [str.atl100.dll]
mov edx, dword [0x1001b344]
mov dword [ebp - 0x50], ecx
mov ecx, dword [0x1001b34c]
mov dword [ebp - 0x54], eax
mov eax, dword [0x1001b348]
mov dword [ebp - 0x4c], edx
mov dx, word [0x1001b350]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], eax
mov word [ebp - 0x40], dx
mov dword [ebp - 0x3e], 0
mov ecx, 6
mov esi, str.msvcr100.dll
lea edi, [ebp - 0x3a]
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
movsw word es:[edi], word [esi]
mov ecx, 6
mov esi, str.msvcp100.dll
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
lea edi, [ebp - 0x54]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x100015b9
push eax
call ebx
inc esi
add edi, 0x1a
cmp esi, 3
jb 0x10001576
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x58]
push edx
push str.Load_library_failed__dll_name:_pbvm.dll__runtime_path:_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.10007b8d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x58]
imul esi, esi, 0x1a
lea eax, [ebp + esi - 0x54]
push eax
push str.The_program_cant_start_because__s_is_missing_from_your_computer.
push ecx
jmp 0x1000159a

Function at 0x100015d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x10020170]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 0x1001b4a4
push eax
call fcn.10008176
mov esi, eax
push esi
push 1
lea eax, [ebp - 0x58]
push 0x40
push eax
call fcn.1000809b
mov ecx, dword [ebp - 0x1c]
push 0
add ecx, 4
push ecx
push esi
call fcn.10007dd5
push esi
push 1
lea edx, [ebp - 0x18]
push 0x14
push edx
call fcn.1000809b
push esi
call fcn.10007cd7
mov ax, word [ebp - 0x18]
add esp, 0x38
mov ecx, 0x200
pop esi
cmp ax, cx
je 0x10001651
mov edx, 0x8664
cmp ax, dx
je 0x10001651
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007b8d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10007b8d
mov esp, ebp
pop ebp
ret
Function at 0x10002160
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x10020170]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x24c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov cx, word [esi]
add esi, 2
cmp cx, 0x22
jne 0x100021d0
push 0x22
push esi
call fcn.10007acd
add esp, 8
test eax, eax
je 0x100021e7
mov ecx, eax
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x100021b0
sub ecx, esi
sar ecx, 1
cmp ecx, 2
ja 0x100021cb
mov esi, 0x1001b724
jmp 0x100021e7
lea esi, [eax + 4]
jmp 0x100021e7
push 0x20
push esi
call fcn.10007acd
add esp, 8
mov esi, 0x1001b728
test eax, eax
je 0x100021e7
lea esi, [eax + 2]
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x246]
push eax
mov word [ebp - 0x248], dx
call fcn.10007bf0
mov ecx, dword [str.PBVM]
mov edx, dword [0x1001b730]
mov ax, word [0x1001b734]
push 0x32
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x36]
push 0
push ecx
mov dword [ebp - 0x3c], edx
mov word [ebp - 0x38], ax
call fcn.10007bf0
lea eax, [ebp - 0x40]
add esp, 0x18
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10002234
mov edx, dword [str..dll]
mov ecx, dword [0x1001b73c]
mov dword [eax], edx
mov dx, word [0x1001b740]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x40]
push ebx
push ecx
call fcn.100018b0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x100022bf
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002280
sub eax, edx
sar eax, 1
je 0x100022aa
push 0x1010
push 0x1001b744
lea edx, [ebp - 0x248]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007b8d
mov esp, ebp
pop ebp
ret 0x10
push str.FN_RunExecutable
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x24c]
push 0
push 0x3e8
push ecx
push esi
push edx
push ebx
call eax
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007b8d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10002830
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 8], edi
test ebx, ebx
jne 0x10002858
push ebx
push ebx
push ebx
push 2
call fcn.100061d0
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
mov esi, dword [edi + 0x18]
test esi, esi
je 0x10002871
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
test esi, esi
jne 0x10002860
xor ecx, ecx
push 2
or eax, 0xffffffff
push ecx
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], ecx
push ebx
mov dword [edi + 8], eax
mov dword [edi + 4], eax
call fcn.10007dd5
push ebx
call fcn.10008ecb
push 0
mov ebx, eax
mov eax, dword [ebp + 8]
push 0
push eax
call fcn.10007dd5
add esp, 0x1c
test ebx, ebx
jg 0x100028c1
push 0
push 0
push 0
push 0xc
mov ecx, edi
call fcn.100061d0
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebx + 1]
push ecx
call fcn.10008259
mov edx, dword [ebp + 8]
push edx
mov esi, eax
push 1
push ebx
push esi
mov dword [ebp - 4], esi
mov byte [esi], 0
call fcn.1000809b
add esp, 0x14
cmp eax, 1
je 0x1000290a
push esi
call fcn.10007b82
add esp, 4
push 0
push 0
push 0
push 2
mov ecx, edi
call fcn.100061d0
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
add ebx, eax
mov byte [ebx], 0
cmp byte [eax], 0
mov edi, esi
je 0x1000298c
lea esp, [esp]
cmp esi, ebx
jb 0x1000293b
push 0x3ec
push 0x1001ba9c
push str.p____buf__length_
call fcn.100083de
add esp, 0xc
cmp edi, ebx
jbe 0x10002956
push 0x3ed
push 0x1001badc
push 0x1001baf4
call fcn.100083de
add esp, 0xc
cmp edi, esi
jbe 0x10002971
push 0x3ee
push 0x1001bb1c
push str.q___p
call fcn.100083de
add esp, 0xc
mov al, byte [esi]
cmp al, 0xd
jne 0x10002983
mov byte [edi], 0xa
inc esi
inc edi
cmp byte [esi], 0xa
jne 0x10002987
jmp 0x10002986
mov byte [edi], al
inc edi
inc esi
cmp byte [esi], 0
jne 0x10002920
cmp edi, ebx
jbe 0x100029a7
push 0x3fb
push 0x1001bb44
push str.q____buf__length_
call fcn.100083de
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 4]
push ecx
mov byte [edi], 0
mov eax, dword [esi]
mov eax, dword [eax + 8]
push 0
push edx
mov ecx, esi
call eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.10007b82
add esp, 4
xor eax, eax
cmp byte [esi + 0x2c], al
pop esi
pop edi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10007b8d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10020170]
jne 0x10007b97
repz ret
jmp fcn.1000a338
Function at 0x1000dbe7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10020170]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000d0ad
and dword [ebp - 0x14], 0
cmp dword [0x100217c0], 0
mov dword [ebp - 0x18], eax
jne 0x1000dc9a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000dd42
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001ce50
push ebx
call edi
test eax, eax
je 0x1000dd42
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x100217c0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x100217c4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x100217c8], eax
call edi
push eax
call esi
mov dword [0x100217d0], eax
test eax, eax
je 0x1000dc9a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x100217cc], eax
mov eax, dword [0x100217cc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000dcf3
cmp dword [0x100217d0], ecx
je 0x1000dcf3
push eax
call esi
push dword [0x100217d0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000dcf3
test ebx, ebx
je 0x1000dcf3
call edi
test eax, eax
je 0x1000dcea
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000dcea
test byte [ebp - 8], 1
jne 0x1000dcf3
or dword [ebp + 0x10], 0x200000
jmp 0x1000dd26
mov eax, dword [0x100217c4]
cmp eax, dword [ebp - 0x18]
je 0x1000dd26
push eax
call esi
test eax, eax
je 0x1000dd26
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000dd26
mov eax, dword [0x100217c8]
cmp eax, dword [ebp - 0x18]
je 0x1000dd26
push eax
call esi
test eax, eax
je 0x1000dd26
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100217c0]
call esi
test eax, eax
je 0x1000dd42
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000dd44
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007b8d
leave
ret

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x4013a9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push dword [ebp + 8]
call esi
push dword [ebp + 0xc]
mov edi, eax
call esi
lea eax, [edi + eax + 1]
push eax
call fcn.00402df4
mov dword [ebp - 4], eax
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
mov dword [ebp - 0x58], 0x44
pop ecx
push dword [ebp + 8]
stosd dword es:[edi], eax
push dword [ebp - 4]
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40b0e8
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, ebx
je 0x401453
cmp dword [ebp + 0x10], ebx
je 0x401443
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x10]
call edi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4017b9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
movzx eax, word [ebp + 8]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x12c]
push str.0x_04x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x35c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x35c]
push 0x40b0ec
push eax
call fcn.0040298e
pop ecx
lea eax, [ebp - 0x35c]
pop ecx
mov esi, str.Caption
push eax
lea eax, [ebp - 0x258]
push 0x12c
push eax
push 0x40de38
lea eax, [ebp - 0x12c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
jne 0x401849
lea eax, [ebp - 0x12c]
push str.0x0409
push eax
call ebx
lea eax, [ebp - 0x12c]
push eax
push 3
push 0x40e35c
push esi
call fcn.00401965
lea eax, [ebp - 0x12c]
push eax
push 4
push 0x40e488
push str.Cancel
call fcn.00401965
lea eax, [ebp - 0x12c]
push eax
push 5
push 0x40e5b4
push str.LocalLaunch
call fcn.00401965
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x258]
push 8
push eax
push str.Copying
call fcn.00401965
add esp, 0x40
lea eax, [ebp - 0x258]
mov esi, 0x40e6e0
push eax
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.__s
push esi
call edi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x258]
push 0xa
push eax
push 0x40b12c
call fcn.00401965
add esp, 0x10
lea eax, [ebp - 0x258]
push eax
push esi
call edi
push 0x40b128
push esi
call edi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x258]
push 9
push eax
push str.Scanning
call fcn.00401965
add esp, 0x10
lea eax, [ebp - 0x258]
mov esi, 0x40e80c
push eax
push esi
call ebx
push 0x40b128
push esi
call fcn.00403160
lea eax, [ebp - 0x12c]
push eax
push 6
push 0x40e938
push str.PrepMessage
call fcn.00401965
lea eax, [ebp - 300]
push eax
push 7
push 0x40ea64
push str.WaitMessage
call fcn.00401965
add esp, 0x28
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401bd6
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x401cc2
mov esi, 0x40eb90
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.00402b7a
pop ecx
test eax, eax
pop ecx
je 0x401cc2
push 0x40b16c
push 0x69
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [ebp - 4], ebx
mov dword [ebp - 8], eax
je 0x401cc2
cmp edi, ebx
je 0x401cc2
cmp eax, ebx
je 0x401cc2
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
setne al
mov esi, eax
cmp esi, ebx
je 0x401cbe
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [ebp - 4]
push ebx
push eax
push esi
mov dword [ebp - 4], ebx
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401cb5
cmp dword [ebp - 4], esi
jne 0x401cb5
push 1
pop esi
jmp 0x401cb7
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x401cc4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401d63
Capabilities:
Delete file

Disassembly:
cmp byte [0x40eb90], 0
push esi
je 0x401d8f
xor esi, esi
push 0x40eb90
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x401d8f
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x401d6f
pop esi
ret
Function at 0x401f0b
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
push esi
push edi
cmp dword [0x40edb4], 0
jne 0x402026
and byte [ebp - 0x104], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push eax
call fcn.00402a18
lea eax, [ebp - 0x104]
push eax
call fcn.00401e5c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push 0x40b170
push eax
call edi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402026
cmp dword [0x40edb4], 0
jne 0x40201f
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push eax
call fcn.00402a18
pop ecx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call edi
test byte [ebp - 0x244], 0x10
je 0x401fed
cmp byte [ebp - 0x218], 0x2e
je 0x402009
lea eax, [ebp - 0x104]
push eax
call fcn.00401f0b
pop ecx
jmp 0x402009
inc dword [0x40eda8]
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00402ce0
add dword [0x40edac], eax
pop ecx
pop ecx
lea eax, [ebp - 0x244]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401f9a
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40202b
Capabilities:
Create directory
Delete file
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 4]
and byte [ebp - 0x210], al
mov dword [ebp - 8], ebx
stosd dword es:[edi], eax
push 0x40
lea edi, [ebp - 0x20f]
pop ecx
and byte [ebp - 0x33c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x4a
xor eax, eax
pop ecx
lea edi, [ebp - 0x33b]
rep stosd dword es:[edi], eax
and byte [ebp - 0x468], bl
push 0x4a
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x467]
and byte [ebp - 0x10c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x210]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4020c1
lea eax, [ebp - 0x210]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x402130
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00402a70
pop ecx
test eax, eax
pop ecx
je 0x402130
mov eax, dword [0x40edac]
xor ecx, ecx
cmp ecx, dword [ebp - 4]
ja 0x40213c
jb 0x4020ea
cmp eax, dword [ebp - 8]
jae 0x40213c
mov esi, 0x40ec94
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00402b7a
pop ecx
test eax, eax
pop ecx
je 0x402130
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x402130
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x402130
cmp dword [0x40edb4], ebx
je 0x402128
push ebx
push ebx
jmp 0x402228
push 1
pop eax
jmp 0x40223b
push ebx
call fcn.00401cc9
pop ecx
jmp 0x402239
movzx eax, word [0x40de40]
push eax
lea eax, [ebp - 0x33c]
push str.0x_04x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x10c]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x10c]
push 0x40b0ec
push eax
call fcn.0040298e
pop ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop ecx
lea eax, [ebp - 0x10c]
mov esi, 0x12c
push eax
mov edi, 0x40e35c
push esi
push edi
push 0x40de38
lea eax, [ebp - 0x33c]
push str.Caption
push eax
call ebx
test eax, eax
jne 0x4021bb
push esi
push edi
push 3
push dword [0x40dd30]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x468]
push esi
push eax
push 0x40de38
lea eax, [ebp - 0x33c]
push str.NoSpace
push eax
call ebx
test eax, eax
jne 0x4021f7
lea eax, [ebp - 0x468]
push esi
push eax
push 1
push dword [0x40dd30]
call dword [sym.imp.USER32.dll_LoadStringA]
push 4
lea eax, [ebp - 0x468]
push edi
push eax
push dword [0x40eda0]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x402224
push dword [0x40eda0]
push 0x40de48
call fcn.00401261
pop ecx
pop ecx
push 0
push 0
push 0x415
push dword [0x40eda0]
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402240
Capabilities:
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push ebx
push esi
xor ebx, ebx
push edi
cmp dword [0x40edb4], ebx
jne 0x4023b3
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x107]
mov byte [ebp - 0x108], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x20b]
mov byte [ebp - 0x20c], bl
rep stosd dword es:[edi], eax
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x108]
push eax
call fcn.00402a18
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
mov dword [esp], 0x40b170
push eax
call edi
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4023b3
cmp dword [0x40edb4], ebx
jne 0x4023aa
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x108]
push eax
call fcn.00402a18
pop ecx
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x108]
push eax
call edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00402a18
pop ecx
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
mov eax, dword [ebp - 0x34c]
and eax, 0x10
test al, al
jne 0x40235a
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004023b8
jmp 0x402390
cmp byte [ebp - 0x320], 0x2e
je 0x402392
lea eax, [ebp - 0x20c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40237d
push ebx
call fcn.00401cc9
jmp 0x402391
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00402240
pop ecx
pop ecx
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4022da
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret