joyce8/EMBER2024-capa huggingface dataset:
Function at 0x132e5b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10c
cmp byte [eax], 0
push esi
mov esi, ecx
je 0x132e73
mov byte [esi + 0x14], 1
cmp byte [eax + 2], 0
je 0x132e7d
mov byte [esi + 0x16], 1
cmp byte [eax + 3], 0
je 0x132e87
mov byte [esi + 0x17], 1
xor eax, eax
cmp byte [esi + 0x14], al
je 0x132e96
cmp byte [esi + 0x1a], al
je 0x132e96
mov byte [esi + 0x14], al
cmp byte [esi + 0x15], al
je 0x132ea3
cmp byte [esi + 0x1b], al
je 0x132ea3
mov byte [esi + 0x15], al
cmp byte [esi + 0x16], al
je 0x132eb0
cmp byte [esi + 0x1c], al
je 0x132eb0
mov byte [esi + 0x16], al
cmp byte [esi + 0x17], al
je 0x132ebd
cmp byte [esi + 0x1d], al
je 0x132ebd
mov byte [esi + 0x17], al
cmp byte [esi + 0x18], al
je 0x132eca
cmp byte [esi + 0x1e], al
je 0x132eca
mov byte [esi + 0x18], al
cmp dword [esi + 0x20], eax
je 0x132f4c
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x133084
mov cl, byte [esi + 0x1a]
mov dl, byte [esi + 0x1b]
test cl, cl
sete al
dec al
and byte [ebp - 0x6c], al
test dl, dl
sete al
dec al
and byte [ebp - 0x6b], al
test cl, cl
jne 0x132f0f
test dl, dl
sete al
dec al
and byte [ebp - 0xfc], al
cmp byte [esi + 0x1c], 0
sete al
dec al
and byte [ebp - 0xfb], al
cmp byte [esi + 0x1d], 0
sete al
dec al
and byte [ebp - 0xfa], al
test cl, cl
sete al
dec al
and byte [ebp - 0xb1], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x133084
push ebx
push edi
lea ecx, [ebp - 0xc]
call fcn.00132ab3
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call ebx
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x132f84
push 0xa0
call edi
mov ecx, 0x8000
test cx, ax
je 0x132fa2
cmp byte [esi + 0x1a], 0
jne 0x132fa2
push 0xa0
lea ecx, [ebp - 0xc]
call fcn.001341de
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00133a61
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x132fc4
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
je 0x132fe2
cmp byte [esi + 0x1b], 0
jne 0x132fe2
push 0xa1
lea ecx, [ebp - 0xc]
call fcn.001341de
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00133a61
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x132ffe
push 0x11
call edi
mov ecx, 0x8000
test cx, ax
je 0x133019
cmp byte [esi + 0x1c], 0
jne 0x133019
push 0x11
lea ecx, [ebp - 0xc]
call fcn.001341de
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00133a61
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x133035
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
je 0x133050
cmp byte [esi + 0x1d], 0
jne 0x133050
push 0x12
lea ecx, [ebp - 0xc]
call fcn.001341de
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00133a61
push 0x5b
call ebx
mov ebx, 0x8000
test bx, ax
jne 0x133067
push 0x5b
call edi
test bx, ax
je 0x133082
cmp byte [esi + 0x1e], 0
jne 0x133082
push 0x5b
lea ecx, [ebp - 0xc]
call fcn.001341de
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00133a61
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x1338a3
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
movzx edi, al
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bl, 1
cmp byte [ebp + 0xc], bl
je 0x133904
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push ecx
push 0
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0013411c
mov ecx, dword [ebp - 4]
call fcn.00132b1c
push ecx
push 2
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0013411c
mov ecx, dword [ebp - 4]
call fcn.00132b03
pop esi
pop edi
mov al, bl
pop ebx
leave
ret 8

Function at 0x13390c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, word [edi + 8]
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
mov byte [ebp - 8], bl
mov byte [ebp - 4], bh
mov dword [ebp - 0xc], eax
je 0x1339f7
cmp bl, 0x14
je 0x1339f7
cmp bl, 0x90
je 0x1339f7
cmp bl, 0x91
je 0x1339f7
mov ecx, edi
call fcn.00132e0a
test al, al
je 0x1339de
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x133988
movzx eax, bl
or byte [ebp + eax - 0x128], 0x80
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov ecx, dword [ebp + 8]
movzx edi, bh
shl edi, 0x10
or edi, 1
call fcn.00132d4a
cmp al, 1
jne 0x1339a3
or edi, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x1339b4
cmp byte [esi + 0x1d], 0
jne 0x1339b4
cmp bl, 0x12
jne 0x1339d2
cmp byte [esi + 0x16], 0
jne 0x1339d2
cmp byte [esi + 0x1c], 0
jne 0x1339d2
or edi, 0x20000000
movzx eax, bl
push edi
push eax
push 0x104
jmp 0x1339ec
movzx eax, bl
push edi
push eax
push 0x100
jmp 0x1339ec
mov eax, dword [ebp - 0xc]
movzx eax, ax
push 1
push eax
push 0x102
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x133a53
mov ecx, edi
call fcn.00132e0a
test al, al
je 0x133a23
mov ecx, edi
call fcn.00132d4a
push ecx
mov ecx, esi
cmp al, 1
jne 0x133a14
push 1
jmp 0x133a16
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0013411c
jmp 0x133a53
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
xor eax, eax
mov word [ebp - 0x24], ax
movzx eax, word [edi + 8]
mov word [ebp - 0x22], ax
push 0x1c
xor ecx, ecx
lea eax, [ebp - 0x28]
inc ecx
push eax
push ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 4
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.00132b1c
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x133a61
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov bl, byte [edi]
cmp dword [esi + 0x20], 0
mov bh, byte [edi + 7]
mov byte [ebp - 4], bl
mov byte [ebp - 8], bh
je 0x133b3c
cmp bl, 0x14
je 0x133b3c
cmp bl, 0x90
je 0x133b3c
cmp bl, 0x91
je 0x133b3c
mov ecx, edi
call fcn.00132e0a
test al, al
je 0x133b98
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x133ada
movzx eax, bl
xor byte [ebp + eax - 0x124], 0x80
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov ecx, dword [ebp + 8]
movzx edi, bh
shl edi, 0x10
or edi, 0xc0000001
call fcn.00132d4a
cmp al, 1
jne 0x133af8
or edi, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x133b09
cmp byte [esi + 0x1d], 0
jne 0x133b09
cmp bl, 0x12
jne 0x133b27
cmp byte [esi + 0x16], 0
jne 0x133b27
cmp byte [esi + 0x1c], 0
jne 0x133b27
or edi, 0x20000000
movzx eax, bl
push edi
push eax
push 0x105
jmp 0x133b31
movzx eax, bl
push edi
push eax
push 0x101
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x133b98
mov ecx, edi
call fcn.00132e0a
test al, al
je 0x133b68
mov ecx, edi
call fcn.00132d4a
push ecx
mov ecx, esi
cmp al, 1
jne 0x133b59
push 3
jmp 0x133b5b
push 2
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0013411c
jmp 0x133b98
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
xor eax, eax
mov word [ebp - 0x20], ax
movzx eax, word [edi + 8]
mov word [ebp - 0x1e], ax
push 0x1c
xor ecx, ecx
lea eax, [ebp - 0x24]
inc ecx
push eax
push ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], 6
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.00132b03
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x133bc3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
cmp byte [esi], 0
mov edi, ecx
jne 0x133bf4
cmp byte [esi + 1], 0
jne 0x133bf4
cmp byte [esi + 2], 0
jne 0x133bf4
cmp byte [esi + 3], 0
jne 0x133bf4
cmp byte [esi + 4], 0
je 0x133da2
cmp dword [edi + 0x20], 0
push ebx
je 0x133d2a
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x133d2a
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x133c7e
cmp byte [esi], 0
mov al, byte [ebp - 0xf0]
mov ecx, 0x80
je 0x133c3c
or al, cl
or byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x133c4d
or al, cl
or byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x133c59
or byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x133c65
or byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x133c71
or byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x133c8f
cmp byte [esi + 1], 0
je 0x133ca6
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 1
push eax
push 0x10
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x133cc3
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push 0x100
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x133d07
cmp byte [esi + 2], 0
jne 0x133cec
cmp byte [edi + 0x1c], 0
jne 0x133cec
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0x20000001
push eax
push 0x12
push 0x104
jmp 0x133d02
test al, al
je 0x133d07
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 1
push eax
push 0x12
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x133d9a
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 1
push eax
push 0x5b
push 0x100
push dword [edi + 0x20]
call ebx
jmp 0x133d9a
xor ebx, ebx
cmp byte [esi], bl
je 0x133d43
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.0013411c
cmp byte [esi + 1], bl
je 0x133d5b
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.0013411c
cmp byte [esi + 2], bl
je 0x133d70
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.0013411c
cmp byte [esi + 3], bl
je 0x133d85
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.0013411c
cmp byte [esi + 4], bl
je 0x133d9a
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.0013411c
mov ecx, edi
call fcn.00132b1c
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x133da8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
cmp byte [esi], 0
mov edi, ecx
jne 0x133dd9
cmp byte [esi + 1], 0
jne 0x133dd9
cmp byte [esi + 2], 0
jne 0x133dd9
cmp byte [esi + 3], 0
jne 0x133dd9
cmp byte [esi + 4], 0
je 0x133f95
cmp dword [edi + 0x20], 0
push ebx
je 0x133f17
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x133f17
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x133e63
cmp byte [esi], 0
mov al, byte [ebp - 0xf0]
mov ecx, 0x80
je 0x133e21
xor al, cl
xor byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x133e32
xor al, cl
xor byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x133e3e
xor byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x133e4a
xor byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x133e56
xor byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x133e74
cmp byte [esi + 1], 0
je 0x133e8d
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x10
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x133eac
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x11
push 0x101
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x133ef2
cmp byte [esi + 2], 0
jne 0x133ed5
cmp byte [edi + 0x1c], 0
jne 0x133ed5
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
jmp 0x133eed
test al, al
je 0x133ef2
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x133f8d
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push dword [edi + 0x20]
call ebx
jmp 0x133f8d
cmp byte [esi], 0
push 2
pop ebx
je 0x133f32
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.0013411c
cmp byte [esi + 1], 0
je 0x133f4b
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.0013411c
cmp byte [esi + 2], 0
je 0x133f61
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.0013411c
cmp byte [esi + 3], 0
je 0x133f77
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.0013411c
cmp byte [esi + 4], 0
je 0x133f8d
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.0013411c
mov ecx, edi
call fcn.00132b03
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x133f9b
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [ebp + 8]
test esi, esi
js 0x134020
jne 0x133faf
push 0
jmp 0x13401a
cmp esi, 0xf
jae 0x134019
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x134019
mov dword [ebp + 8], esi
fild dword [ebp + 8]
test esi, esi
jns 0x133fd2
fadd qword [0x1a6a00]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fstp qword [ebp - 0x28]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
sbb eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fstp qword [ebp - 0x20]
call fcn.0010e2bd
fdivr qword [ebp - 0x20]
fcomp qword [ebp - 0x28]
fnstsw ax
test ah, 5
jnp 0x133fdb
jmp 0x134020
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
leave
ret 4

Function at 0x134170
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 4], eax
mov byte [esi + 0xa], al
mov eax, dword [ebp + 8]
mov dword [esi], 0xff
mov word [esi + 8], ax
test ax, ax
jne 0x134194
xor al, al
jmp 0x1341d9
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
je 0x134190
push ebx
mov ebx, eax
mov byte [esi], al
movzx eax, al
push 0
push eax
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
test bl, 1
je 0x1341c4
mov byte [esi + 1], 1
test bl, 2
je 0x1341cd
mov byte [esi + 3], 1
test bl, 4
pop ebx
je 0x1341d7
mov byte [esi + 4], 1
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x135dde
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.00135baf
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
leave
ret 8
Function at 0x135f85
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20020
call fcn.0011f8a0
push esi
lea eax, [ebp - 0x20020]
mov esi, edx
push eax
mov edx, 0x7fff
call fcn.00136ebb
lea eax, [ebp - 0x10020]
push eax
mov edx, 0x7fff
mov ecx, esi
call fcn.00136ebb
pop ecx
pop ecx
lea eax, [ebp - 0x10020]
push eax
lea eax, [ebp - 0x20020]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
pop esi
test eax, eax
jne 0x13600e
cmp byte [ebp + 8], al
je 0x13600a
lea eax, [ebp - 0x10020]
push eax
lea eax, [ebp - 0x20020]
push eax
call fcn.001115e3
pop ecx
pop ecx
test eax, eax
je 0x136006
lea eax, [ebp - 0x10020]
push eax
lea eax, [ebp - 0x20020]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
leave
ret
xor al, al
leave
ret
lea ecx, [ebp - 0x20020]
call fcn.001372cb
test al, al
je 0x13600a
lea ecx, [ebp - 0x10020]
call fcn.001372cb
test al, al
je 0x1360b8
cmp byte [ebp + 8], 0
je 0x13600a
lea eax, [ebp - 0x20020]
push 0x1a3744
push eax
call fcn.00110cf4
lea eax, [ebp - 0x20020]
push eax
call fcn.00110cdb
xor ecx, ecx
mov word [ebp + eax*2 - 0x2001e], cx
lea eax, [ebp - 0x10020]
push eax
call fcn.00110cdb
xor ecx, ecx
mov word [ebp + eax*2 - 0x1001e], cx
lea eax, [ebp - 0x20020]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10020]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0x20], eax
mov eax, 0x614
add esp, 0x10
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb al, al
inc al
leave
ret
lea ecx, [ebp - 0x10020]
call fcn.00136318
test al, al
je 0x13600a
lea ecx, [ebp - 0x10020]
call fcn.001372cb
test al, al
jmp 0x136034
Function at 0x1360dd
Capabilities:
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40864
call fcn.0011f8a0
push ebx
push esi
push edi
lea eax, [ebp - 0x20860]
mov esi, edx
mov edi, 0x7fff
xor ebx, ebx
push eax
mov edx, edi
mov byte [ebp - 1], bl
call fcn.00136ebb
pop ecx
lea eax, [ebp - 0x40860]
push eax
mov edx, edi
mov ecx, esi
call fcn.00136ebb
pop ecx
lea edx, [ebp - 0x40860]
lea ecx, [ebp - 0x20860]
call fcn.0013725e
lea ecx, [ebp - 0x20860]
mov byte [ebp - 3], al
call fcn.001372cb
mov esi, 0x1a3744
test al, al
je 0x136150
lea eax, [ebp - 0x20860]
push esi
push eax
call fcn.00110cf4
pop ecx
pop ecx
lea ecx, [ebp - 0x40860]
call fcn.001372cb
test al, al
je 0x13616e
lea eax, [ebp - 0x40860]
push esi
push eax
call fcn.00110cf4
pop ecx
pop ecx
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20860]
push eax
call fcn.00111dfc
add esp, 0x14
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x20860]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [ebp - 2], al
cmp esi, 0xffffffff
je 0x136307
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp al, 1
jne 0x136307
test byte [ebp - 0x260], 0x10
jne 0x1362d9
lea eax, [ebp - 0x30860]
push eax
lea eax, [ebp - 0x40860]
push eax
lea eax, [ebp - 0x860]
push eax
lea edx, [ebp - 0x460]
lea ecx, [ebp - 0x234]
call fcn.0013690b
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10860]
push eax
call fcn.00110d23
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x10860]
push eax
call fcn.00110cf4
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x10860]
push eax
call fcn.00110cf4
add esp, 0x18
lea ecx, [ebp - 0x30860]
call fcn.00136524
test al, al
je 0x136270
cmp byte [ebp + 8], bl
je 0x1362fc
lea eax, [ebp - 0x30860]
push eax
lea eax, [ebp - 0x10860]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
lea eax, [ebp - 0x30860]
push eax
je 0x136291
call edi
cmp byte [ebp + 0xc], 1
lea eax, [ebp - 0x30860]
jne 0x1362c2
cmp byte [ebp - 3], bl
jne 0x1362a4
push eax
lea eax, [ebp - 0x10860]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x1362d1
lea eax, [ebp - 0x10860]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x13630a
jmp 0x1362d5
push ebx
push eax
lea eax, [ebp - 0x10860]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1362fc
lea eax, [ebp - 0x10860]
push eax
call edi
jmp 0x1362d1
push ebx
push eax
lea eax, [ebp - 0x10860]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1362fc
mov byte [ebp - 1], 1
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov al, byte [ebp - 2]
jne 0x1361c0
mov al, bl
mov byte [ebp - 2], al
jmp 0x1361c0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x136313
mov bl, byte [ebp - 1]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x136318
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10000
call fcn.0011f8a0
push ebx
push esi
mov edx, ecx
push 0x7fff
lea ecx, [ebp - 0x10000]
call fcn.000f50e6
lea eax, [ebp - 0x10000]
push eax
call fcn.00110cdb
pop ecx
pop ecx
push 0x5c
pop ebx
test eax, eax
je 0x136362
cmp word [ebp + eax*2 - 0x10002], bx
jne 0x136362
xor ecx, ecx
mov word [ebp + eax*2 - 0x10002], cx
lea eax, [ebp - 0x10000]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1363ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x136396
push 0
lea eax, [ebp - 0x10000]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x13639b
mov al, 1
jmp 0x1363f5
cmp eax, 3
jne 0x1363f3
lea ecx, [ebp - 0x10000]
call fcn.0010c6f4
mov esi, eax
push ebx
push esi
call fcn.001124e6
pop ecx
pop ecx
test eax, eax
jne 0x1363be
push esi
call fcn.0010f55e
pop ecx
jmp 0x1363f3
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
call fcn.00136318
push esi
mov bl, al
call fcn.0010f55e
pop ecx
test bl, bl
je 0x1363eb
push 0
lea eax, [ebp - 0x10000]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
mov al, bl
jmp 0x1363f5
test al, 0x10
jne 0x136392
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x1363f9
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10460
call fcn.0011f8a0
push ebx
lea eax, [esp + 0x464]
push esi
xor ebx, ebx
push eax
mov edx, 0x7fff
mov byte [esp + 0x13], bl
call fcn.00136ebb
pop ecx
lea ecx, [esp + 0x468]
call fcn.001372cb
test al, al
je 0x136448
lea eax, [esp + 0x468]
push 0x1a3744
push eax
call fcn.00110cf4
pop ecx
pop ecx
push ebx
push ebx
lea eax, [esp + 0x270]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x478]
push eax
call fcn.00111dfc
add esp, 0x14
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [esp + 0xe], al
cmp esi, 0xffffffff
je 0x136501
cmp al, 1
jne 0x136501
test byte [esp + 0x18], 0x10
jne 0x1364e5
mov byte [esp + 0xf], al
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x46c]
push eax
call fcn.00110d23
lea eax, [esp + 0x270]
push eax
lea eax, [esp + 0x474]
push eax
call fcn.00110cf4
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x47c]
push eax
call fcn.00110cf4
add esp, 0x18
lea eax, [esp + 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x136505
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov al, byte [esp + 0xe]
jne 0x136487
mov al, bl
mov byte [esp + 0xe], al
jmp 0x136487
mov bl, byte [esp + 0xf]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret