joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4099f7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
sub esp, 0x98
lea ebp, [esp - 4]
mov eax, dword [0x485df0]
xor eax, ebp
mov dword [ebp + 0x98], eax
push 4
mov eax, 0x464180
call fcn.0043e9a8
mov ecx, dword [ebp + 0xac]
mov eax, dword [ebp + 0xa8]
mov edi, dword [ebp + 0xb0]
mov ebx, dword [ebp + 0xa4]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x409a4d
mov eax, 0x80004005
jmp 0x409b41
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x409a43
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x409a43
push esi
push edi
call fcn.0040a76e
pop ecx
pop ecx
test al, al
je 0x409b18
and dword [ebp - 0x10], 0
lea ecx, [ebp]
call fcn.00417943
and dword [ebp - 4], 0
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push 0
call fcn.0040a723
add esp, 0x10
lea ecx, [ebp]
cmp eax, 0xfffffffc
je 0x409ab5
call fcn.004179fc
jmp 0x409a43
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
call fcn.00417a07
push eax
call fcn.0040a723
add esp, 0x10
test eax, eax
je 0x409ae1
mov esi, 0x80004005
lea ecx, [ebp]
call fcn.004179fc
mov eax, esi
jmp 0x409b41
mov eax, dword [ebp - 0x10]
inc eax
push eax
mov ecx, ebx
call fcn.00402626
push dword [ebp - 0x10]
lea ecx, [ebp]
mov esi, eax
call fcn.0043a5b6
push eax
push esi
call fcn.0043ee10
mov eax, dword [ebp - 0x10]
add esp, 0xc
push 0xffffffffffffffff
mov ecx, ebx
mov byte [esi + eax], 0
call fcn.004017de
xor esi, esi
jmp 0x409ad5
lea eax, [esi + 1]
push eax
mov ecx, ebx
call fcn.00402626
push esi
push dword [ebp - 0x10]
mov edi, eax
push edi
call fcn.0043ee10
add esp, 0xc
push 0xffffffffffffffff
mov ecx, ebx
mov byte [edi + esi], 0
call fcn.004017de
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x98]
xor ecx, ebp
call fcn.0043e999
add ebp, 0x9c
leave
ret
Function at 0x4173c5
Capabilities:
Get system information on windows

Disassembly:
cmp byte [0x487478], 0
jne 0x417469
push esi
push edi
mov edi, 0x11c
push edi
push 0
mov esi, 0x487330
push esi
call fcn.0043f490
add esp, 0xc
mov dword [0x487330], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
call edi
test eax, eax
jne 0x417447
push esi
mov dword [0x487330], 0x114
call edi
test eax, eax
jne 0x417447
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x417447
test byte [eax + 0x1c], 1
je 0x417447
cmp byte [eax + 0x19], 2
jb 0x417447
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x485d60]
push 0x474164
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00431cff
add esp, 0x14
push 0x24
push 0
mov esi, 0x48744c
push esi
call fcn.0043f490
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
pop edi
mov byte [0x487478], 1
pop esi
mov al, 1
ret

Function at 0x417c42
Capabilities:
Get system information on windows

Disassembly:
push esi
mov esi, ecx
call fcn.0041797c
mov ecx, dword [0x4874d0]
test ecx, ecx
jne 0x417c65
push 0x4874cc
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x4874d0]
mov eax, dword [esp + 8]
xor edx, edx
div ecx
push ebx
xor ebx, ebx
push 4
cmp ebx, edx
sbb edx, edx
imul eax, ecx
and edx, ecx
add edx, eax
pop eax
push eax
push 0x1000
push edx
push ebx
mov dword [esi + 8], edx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0xc], eax
pop ebx
test eax, eax
jne 0x417ccf
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x417cc7
test byte [eax + 0x1c], 1
je 0x417cc7
cmp byte [eax + 0x19], 2
jb 0x417cc7
push 0x474218
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0041646b
add esp, 0x10
and dword [esi + 8], 0
and dword [esi + 4], 0
mov eax, dword [esi + 0xc]
pop esi
ret 4
Function at 0x418b2d
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x228
lea ebp, [esp - 4]
mov eax, dword [0x485df0]
xor eax, ebp
mov dword [ebp + 0x228], eax
push 0x34
mov eax, 0x46442f
call fcn.0043e9db
mov eax, dword [ebp + 0x234]
xor ebx, ebx
push ebx
push 0x418496
push 8
push 0x3c
push 0x474c20
push eax
mov edi, ecx
call fcn.00441286
add esp, 0x18
lea ecx, [ebp - 0x38]
mov esi, eax
call fcn.00424050
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x418bf7
mov esi, dword [esi + 4]
cmp esi, 0xf0000000
je 0x418ca4
cmp esi, 0xf0000001
je 0x418c9d
cmp esi, 0xf0000002
je 0x418c80
cmp esi, 0xf0000003
je 0x418c2b
lea eax, [ebp]
push eax
push 1
push ebx
push esi
push ebx
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathW]
test eax, eax
jge 0x418c26
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x418bf7
test byte [eax + 0x1c], 1
je 0x418bf7
cmp byte [eax + 0x19], 2
jb 0x418bf7
push 0x474c10
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0041646b
add esp, 0x10
xor esi, esi
lea ecx, [ebp - 0x38]
call fcn.00424030
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x228]
xor ecx, ebp
call fcn.0043e999
add ebp, 0x22c
leave
ret
lea eax, [ebp]
jmp 0x418ca9
push 0x4872a4
lea ecx, [ebp - 0x14]
call fcn.00401c03
lea eax, [ebp - 0x14]
push eax
push dword [0x485d74]
mov byte [ebp - 4], 2
call fcn.004184a8
pop ecx
pop ecx
test eax, eax
jge 0x418c68
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004014ff
lea ecx, [ebp - 0x38]
call fcn.00424030
xor eax, eax
jmp 0x418c03
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.00402be3
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004014ff
jmp 0x418cb1
push 0x4872a4
lea ecx, [ebp - 0x14]
call fcn.00401c03
lea eax, [ebp - 0x14]
push eax
push dword [0x485d70]
mov byte [ebp - 4], 3
jmp 0x418c46
call fcn.0041a835
jmp 0x418ca9
call fcn.0041a95d
push eax
mov ecx, edi
call fcn.00402e96
xor esi, esi
inc esi
jmp 0x418bf9
Function at 0x41a2fa
Capabilities:
Check if file exists
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x485df0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x41a490
test esi, esi
je 0x41a490
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x64
jb 0x41a490
xor eax, eax
push 0x208
push eax
mov word [esi], ax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0043f490
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x41a375
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41a493
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x41a47b
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsUNCServerW]
test eax, eax
jne 0x41a47b
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.004417fc
add esp, 0xc
test eax, eax
jne 0x41a474
push str.isolate.ini
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x41a474
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41a375
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
push str.SoftwareSymantecIsolation
push str.reghive
push str.isolation
call fcn.0041a008
add esp, 0x18
dec ebx
cmp eax, ebx
jne 0x41a417
push 0x7a
jmp 0x41a492
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a443
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41a466
cmp eax, 5
jne 0x41a455
push str.CIsolation::GetRegistryHive__:_RegOpenKeyEx___returned_ERROR_ACCESS_DENIED
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x41a466
cmp eax, 2
jne 0x41a461
push str.CIsolation::GetRegistryHive__:_RegOpenKeyEx___returned_ERROR_FILE_NOT_FOUND
jmp 0x41a44d
xor eax, eax
mov word [esi], ax
xor eax, eax
cmp word [esi], ax
setne al
dec eax
and eax, 0xd
jmp 0x41a493
mov eax, 0x54f
jmp 0x41a493
push 0x1c
push str.SoftwareSymantecIsolation
push ebx
push esi
call fcn.00441729
add esp, 0x10
xor eax, eax
jmp 0x41a493
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e999
leave
ret
Function at 0x41a4a2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x485df0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x41a5e0
test esi, esi
je 0x41a5e0
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x26
jb 0x41a5e0
xor eax, eax
push 0x208
push eax
mov word [esi], ax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0043f490
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x41a51d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41a5e3
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x41a5dc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsUNCServerW]
test eax, eax
jne 0x41a5dc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.004417fc
add esp, 0xc
test eax, eax
jne 0x41a5d5
push str.isolate.ini
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x41a5d5
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41a51d
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
push 0x46bf48
push str.silo
push str.isolation
call fcn.0041a008
add esp, 0x18
dec ebx
cmp eax, ebx
jne 0x41a5b7
push 0x7a
jmp 0x41a5e2
push esi
call fcn.004196b0
pop ecx
test al, al
jne 0x41a5c7
xor eax, eax
mov word [esi], ax
xor eax, eax
cmp word [esi], ax
setne al
dec eax
and eax, 0xd
jmp 0x41a5e3
mov eax, 0x54f
jmp 0x41a5e3
push 2
jmp 0x41a5e2
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e999
leave
ret
Function at 0x41a835
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x485df0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push edi
call fcn.0041a66e
pop ecx
test al, al
je 0x41a920
push edi
push 0xffffffffffffffff
push 0x4874fc
lea ecx, [ebp - 0x74]
call fcn.00425550
mov eax, dword [0x487524]
cmp dword [eax - 0xc], edi
je 0x41a883
mov esi, eax
lea ecx, [ebp - 0x74]
call fcn.0042275f
mov eax, esi
jmp 0x41a94f
xor eax, eax
push 0x62
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push edi
push eax
call fcn.0043f490
push 0x32
lea eax, [ebp - 0x68]
push eax
push 0x400000
call fcn.0041a5f2
add esp, 0x18
test eax, eax
je 0x41a8b0
xor esi, esi
jmp 0x41a874
push ebx
mov esi, 0x487524
push 0x105
mov ecx, esi
call fcn.00402209
push edi
push 0x1c
mov ebx, eax
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41a8f8
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x68]
push eax
push ebx
call edi
test eax, eax
je 0x41a8f6
push dword [0x48751c]
push ebx
call edi
test eax, eax
je 0x41a8f6
xor edi, edi
inc edi
jmp 0x41a8f8
xor edi, edi
push 0xffffffffffffffff
mov ecx, esi
call fcn.00401bd9
pop ebx
test edi, edi
je 0x41a911
mov esi, dword [0x487524]
jmp 0x41a874
mov ecx, esi
call fcn.00401ba4
lea ecx, [ebp - 0x74]
call fcn.0042275f
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x41a94d
test byte [eax + 0x1c], 1
je 0x41a94d
cmp byte [eax + 0x19], 2
jb 0x41a94d
push 0x474e6c
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0041646b
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043e999
leave
ret
Function at 0x41a95d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x485df0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push edi
call fcn.0041a66e
pop ecx
test al, al
je 0x41aa48
push edi
push 0xffffffffffffffff
push 0x4874fc
lea ecx, [ebp - 0x74]
call fcn.00425550
mov eax, dword [0x487528]
cmp dword [eax - 0xc], edi
je 0x41a9ab
mov esi, eax
lea ecx, [ebp - 0x74]
call fcn.0042275f
mov eax, esi
jmp 0x41aa77
xor eax, eax
push 0x62
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push edi
push eax
call fcn.0043f490
push 0x32
lea eax, [ebp - 0x68]
push eax
push 0x400000
call fcn.0041a5f2
add esp, 0x18
test eax, eax
je 0x41a9d8
xor esi, esi
jmp 0x41a99c
push ebx
mov esi, 0x487528
push 0x105
mov ecx, esi
call fcn.00402209
push edi
push 0x23
mov ebx, eax
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41aa20
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x68]
push eax
push ebx
call edi
test eax, eax
je 0x41aa1e
push dword [0x48751c]
push ebx
call edi
test eax, eax
je 0x41aa1e
xor edi, edi
inc edi
jmp 0x41aa20
xor edi, edi
push 0xffffffffffffffff
mov ecx, esi
call fcn.00401bd9
pop ebx
test edi, edi
je 0x41aa39
mov esi, dword [0x487528]
jmp 0x41a99c
mov ecx, esi
call fcn.00401ba4
lea ecx, [ebp - 0x74]
call fcn.0042275f
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x41aa75
test byte [eax + 0x1c], 1
je 0x41aa75
cmp byte [eax + 0x19], 2
jb 0x41aa75
push 0x474e6c
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0041646b
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043e999
leave
ret

Function at 0x41aea6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 4]
call fcn.00424995
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41aedc
cmp dword [ebp - 4], edi
jne 0x41aedc
xor eax, eax
inc eax
jmp 0x41af17
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
mov ecx, dword [0x485d60]
cmp ecx, 0x485d60
je 0x41af15
test byte [ecx + 0x1c], 1
je 0x41af15
cmp byte [ecx + 0x19], 2
jb 0x41af15
push eax
push 0x4753e0
push 0xe
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.00431cff
add esp, 0x14
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x41af1d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 4]
call fcn.00424995
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41af53
cmp dword [ebp - 4], edi
jne 0x41af53
xor eax, eax
inc eax
jmp 0x41af8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
mov ecx, dword [0x485d60]
cmp ecx, 0x485d60
je 0x41af8c
test byte [ecx + 0x1c], 1
je 0x41af8c
cmp byte [ecx + 0x19], 2
jb 0x41af8c
push eax
push 0x4753e0
push 0xf
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.00431cff
add esp, 0x14
xor eax, eax
pop edi
pop esi
leave
ret 8

Function at 0x41afb6
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
and dword [esi], 0
and dword [esi + 4], 0
push edi
mov edi, ecx
lea eax, [ebp - 4]
push eax
lea ecx, [edi + 4]
call fcn.00424995
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x41b025
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xc], eax
test eax, eax
je 0x41b025
mov ecx, dword [0x485d60]
cmp ecx, 0x485d60
je 0x41b021
test byte [ecx + 0x1c], 1
je 0x41b021
cmp byte [ecx + 0x19], 2
jb 0x41b021
push eax
push 0x4753e0
push 0x11
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.00431cff
add esp, 0x14
xor eax, eax
jmp 0x41b033
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 4

Function at 0x41b2c0
Capabilities:
Clear file content

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
push dword [esp + 0xc]
call fcn.0041b0ed
test eax, eax
je 0x41b2ec
lea ecx, [esi + 4]
call fcn.00424995
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x41b2ec
xor eax, eax
inc eax
jmp 0x41b327
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
mov ecx, dword [0x485d60]
cmp ecx, 0x485d60
je 0x41b325
test byte [ecx + 0x1c], 1
je 0x41b325
cmp byte [ecx + 0x19], 2
jb 0x41b325
push eax
push 0x4753e0
push 0x12
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.00431cff
add esp, 0x14
xor eax, eax
pop esi
ret 8
Function at 0x41b47c
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0x74
mov eax, 0x464577
call fcn.0043ea47
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x60]
call fcn.00424050
and dword [ebp - 4], 0
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
inc eax
push eax
lea ecx, [ebp - 0x78]
call fcn.0041b43f
push 0
lea ecx, [ebp - 0x78]
call fcn.0041b32b
mov edi, eax
push esi
push edi
mov dword [ebp - 0x38], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
je 0x41b4e7
push edi
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
push eax
push edi
call dword [sym.imp.USER32.dll_CharPrevW]
jmp 0x41b4f1
push 0x5c
push edi
call fcn.0043dece
pop ecx
pop ecx
xor ebx, ebx
inc ebx
mov edi, 0x485d60
mov esi, 0x4753e0
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x41b66f
test ebx, ebx
je 0x41b66f
push dword [ebp - 0x38]
xor ecx, ecx
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41b61d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41b5ba
cmp eax, 3
je 0x41b5ba
cmp eax, 5
jne 0x41b58b
mov eax, dword [0x485d60]
cmp eax, edi
je 0x41b56c
test byte [eax + 0x1c], 1
je 0x41b56c
cmp byte [eax + 0x19], 3
jb 0x41b56c
push 5
push dword [ebp - 0x38]
push esi
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0041ad9f
add esp, 0x18
mov eax, dword [ebp - 0x3c]
push 0x5c
pop ecx
push eax
mov word [eax], cx
call dword [sym.imp.USER32.dll_CharNextW]
push 0x5c
push eax
call fcn.0043dece
pop ecx
pop ecx
jmp 0x41b4fe
mov ecx, dword [0x485d60]
cmp ecx, edi
je 0x41b5b6
test byte [ecx + 0x1c], 1
je 0x41b5b6
cmp byte [ecx + 0x19], 2
jb 0x41b5b6
push eax
push dword [ebp - 0x38]
push esi
push 0x19
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0041ad9f
add esp, 0x18
xor ebx, ebx
jmp 0x41b56c
push 0
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test ebx, ebx
jne 0x41b56c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x485d60]
cmp ecx, edi
je 0x41b5fc
test byte [ecx + 0x1c], 1
je 0x41b5fc
cmp byte [ecx + 0x19], 2
jb 0x41b5fc
push eax
push dword [ebp - 0x38]
push esi
push 0x17
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0041ad9f
add esp, 0x18
lea ecx, [ebp - 0x78]
call fcn.0045b9ec
push dword [ebp - 0x78]
call fcn.0043d831
pop ecx
lea ecx, [ebp - 0x60]
call fcn.00424030
xor eax, eax
call fcn.0043eaa3
ret
test al, 0x10
jne 0x41b56c
mov ecx, dword [0x485d60]
cmp ecx, edi
je 0x41b650
test byte [ecx + 0x1c], 1
je 0x41b650
cmp byte [ecx + 0x19], 2
jb 0x41b650
push eax
push dword [ebp - 0x38]
push esi
push 0x1a
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0041ad9f
add esp, 0x18
lea ecx, [ebp - 0x78]
call fcn.0045b9ec
push dword [ebp - 0x78]
call fcn.0043d831
xor esi, esi
pop ecx
lea ecx, [ebp - 0x60]
call fcn.00424030
mov eax, esi
jmp 0x41b617
lea ecx, [ebp - 0x78]
call fcn.0045b9ec
push dword [ebp - 0x78]
call fcn.0043d831
mov esi, ebx
jmp 0x41b662
Function at 0x41e7ad
Capabilities:
Write file on windows

Disassembly:
push 0x10
mov eax, 0x46489c
call fcn.0043e9db
mov esi, ecx
mov eax, dword [esi + 0x34]
cmp eax, 0xffffffff
je 0x41e7ce
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x34], 0xffffffff
push 0x4872a4
lea ecx, [ebp - 0x14]
call fcn.00401c03
lea eax, [esi + 0xc]
xor edi, edi
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00402be3
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.004029a2
push dword [esi + 8]
lea eax, [ebp - 0x14]
push 0x470b04
push eax
call fcn.0040a9b4
add esp, 0xc
cmp dword [esi + 0x18], edi
je 0x41e82b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x14]
push str._0x_04X
push eax
call fcn.0040a9b4
add esp, 0xc
push str..log
lea ecx, [ebp - 0x14]
call fcn.004033ee
mov ebx, dword [ebp - 0x14]
push edi
push 0x80
push 4
push edi
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x34], eax
cmp eax, 0xffffffff
je 0x41e88f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41e882
push edi
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x34]
mov dword [ebp - 0x1c], 0xfeff
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 2
push edi
push edi
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
cmp dword [esi + 0x34], 0xffffffff
lea ecx, [ebx - 0x10]
setne al
mov esi, eax
call fcn.004014ff
mov eax, esi
jmp 0x41e8b9
call fcn.0043ea80
ret
Function at 0x41f41f
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1dc]
sub esp, 0x25c
mov eax, dword [0x485df0]
xor eax, ebp
mov dword [ebp + 0x1d8], eax
push ebx
push esi
mov esi, dword [ebp + 0x1e4]
push edi
push 0x5c
push esi
call fcn.0043def4
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x41f457
mov edi, esi
jmp 0x41f459
inc edi
inc edi
push 0x475aec
push edi
call fcn.0043dc92
pop ecx
mov ebx, eax
pop ecx
neg ebx
sbb bl, bl
push 0x4872a4
lea ecx, [ebp - 0x80]
inc bl
call fcn.00401c03
test bl, bl
jne 0x41f4b4
push 0x2e
push edi
call fcn.0043dece
pop ecx
pop ecx
test eax, eax
jne 0x41f4b4
lea eax, [ebp - 0x80]
push eax
push esi
call fcn.00416bda
pop ecx
pop ecx
test al, al
je 0x41f4ed
lea eax, [ebp - 0x80]
push 0x475a68
push eax
call fcn.00416e80
pop ecx
pop ecx
test al, al
je 0x41f4ed
mov esi, dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41f4fc
xor bl, bl
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.004014ff
mov al, bl
mov ecx, dword [ebp + 0x1d8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e999
add ebp, 0x1dc
leave
ret
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.004014ff
xor al, al
jmp 0x41f4d5
mov byte [ebp - 0x79], 0
test byte [ebp - 0x78], 0x10
je 0x41f50a
test bl, bl
jmp 0x41f511
test dword [ebp - 0x78], 0x69a3
jne 0x41f524
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41f500
jmp 0x41f528
mov byte [ebp - 0x79], 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, byte [ebp - 0x79]
jmp 0x41f4c8