joyce8/EMBER2024-capa huggingface dataset:
Function at 0x719e6948
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x719f7264]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x108], 0xf5
lea esi, [ebx + 0x1ac]
jmp 0x719e6987
lea eax, [esi + 4]
push eax
call dword [sym.imp.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_11]
test eax, eax
je 0x719e69c1
cmp eax, 0xffffffff
je 0x719e69c1
mov esi, dword [esi]
test esi, esi
jne 0x719e6972
cmp dword [ebx + 0x224], esi
je 0x719e6997
mov al, 1
jmp 0x719e69d4
push edi
mov esi, 0x719e69e4
lea edi, [ebp - 0x104]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x108]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xf9]
push eax
push 2
movsd dword es:[edi], dword [esi]
call dword [sym.imp._CKERNEL.DLL_GetComputerNameExA]
test eax, eax
pop edi
jne 0x719e69c5
xor al, al
jmp 0x719e69d4
push 0x21
lea eax, [ebp - 0x104]
push eax
push ebx
call fcn.719e66fd
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.719c15f6
leave
ret 4

Function at 0x719e69f5
Capabilities:
Query or enumerate registry value
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x719f7264]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x114]
push eax
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0x719e6b4c
push reloc.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_2
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x108], ebx
call dword [sym.imp._CADVAPI.DLL_RegOpenKeyExA]
test eax, eax
jne 0x719e6a93
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x110]
push eax
push ebx
push 0x719e6b38
push dword [ebp - 0x114]
mov dword [ebp - 0x118], 0x100
mov dword [ebp - 0x110], ebx
call dword [sym.imp._CADVAPI.DLL_RegQueryValueExA]
push dword [ebp - 0x114]
mov esi, eax
call dword [sym.imp._CADVAPI.DLL_RegCloseKey]
cmp esi, ebx
jne 0x719e6a93
cmp dword [ebp - 0x110], edi
je 0x719e6aa3
mov esi, 0x719e6b24
lea edi, [ebp - 0x104]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push ebx
lea eax, [ebp - 0x108]
push eax
push ebx
push 8
push 1
lea eax, [ebp - 0x104]
push eax
call sub.DNSAPI.dll_DnsQuery_A
test eax, eax
jne 0x719e6b0f
mov eax, dword [ebp - 0x108]
cmp eax, ebx
je 0x719e6b0f
mov ecx, dword [eax + 0xc]
and cl, 3
cmp cl, 1
jne 0x719e6adc
cmp word [eax + 8], 1
je 0x719e6ae2
mov eax, dword [eax]
cmp eax, ebx
jne 0x719e6aca
cmp eax, ebx
je 0x719e6b02
push dword [ebp - 0x11c]
push dword [eax + 0x18]
call sub.iphlpapi.dll_GetBestInterface
test eax, eax
jne 0x719e6b02
mov dword [ebp - 0x10c], 2
push 1
push dword [ebp - 0x108]
call sub.DNSAPI.dll_DnsRecordListFree
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10c]
pop edi
pop esi
pop ebx
call fcn.719c15f6
leave
ret 4
Function at 0x719e8267
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp._CKERNEL.DLL_CreateFileA]
push edi
xor ebx, ebx
push ebx
mov edi, 0x80
push edi
push 3
push ebx
push 3
push 0xc0000000
push 0x719d5f30
mov byte [0x719f8190], bl
call esi
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x719e82c3
call dword [sym.imp._CKERNEL.DLL_GetLastError]
push eax
push 0x7d2
push 2
call fcn.719e7f6d
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp._CKERNEL.DLL_CloseHandle]
jmp 0x719e8359
push ebx
push edi
push 3
push ebx
push 3
push 0x40000000
push 0x719d5f28
call esi
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0xc], edi
jne 0x719e8304
call dword [sym.imp._CKERNEL.DLL_GetLastError]
push eax
push 0x7d3
push 2
call fcn.719e7f6d
mov esi, dword [sym.imp._CKERNEL.DLL_CloseHandle]
add esp, 0xc
push dword [ebp - 8]
call esi
push edi
jmp 0x719e8357
mov esi, dword [ebp + 8]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x719e830c
sub eax, edx
push eax
push esi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CharToOemBuffA]
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push edi
call dword [sym.imp._CKERNEL.DLL_WriteFile]
test eax, eax
jne 0x719e8360
call dword [sym.imp._CKERNEL.DLL_GetLastError]
push eax
push 0x7d6
push 2
call fcn.719e7f6d
mov esi, dword [sym.imp._CKERNEL.DLL_CloseHandle]
add esp, 0xc
push dword [ebp - 8]
call esi
push edi
call esi
mov eax, 0x719f8190
jmp 0x719e83cc
push ebx
lea eax, [ebp - 4]
push eax
push 0x20
mov esi, 0x719f8190
push esi
push dword [ebp - 8]
call dword [sym.imp._CKERNEL.DLL_ReadFile]
test eax, eax
jne 0x719e8390
call dword [sym.imp._CKERNEL.DLL_GetLastError]
push eax
push 0x7d7
push 2
call fcn.719e7f6d
add esp, 0xc
push dword [ebp - 4]
push esi
push esi
call dword [sym.imp.USER32.dll_OemToCharBuffA]
mov eax, dword [ebp - 4]
dec eax
cmp eax, ebx
jl 0x719e83ba
lea edi, [eax + 0x719f8190]
mov cl, byte [edi]
cmp cl, 0xa
je 0x719e83b5
cmp cl, 0xd
jne 0x719e83b7
mov byte [edi], bl
dec eax
jns 0x719e83a3
push dword [ebp - 8]
mov ebx, dword [sym.imp._CKERNEL.DLL_CloseHandle]
call ebx
push dword [ebp - 0xc]
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x719eb092
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp dword [0x719f74dc], ebx
push esi
mov esi, 0x1f0003
jne 0x719eb0dd
push 0xffffffffffffffff
push ebx
push esi
push 0x719f74dc
call dword [sym.imp._Cntl.DLL_NtCreateIoCompletion]
cmp eax, ebx
jl 0x719eb162
push 2
lea eax, [ebp - 4]
push eax
push 4
push dword [0x719f74dc]
mov byte [ebp - 3], 1
mov byte [ebp - 4], bl
call dword [sym.imp._Cntl.DLL_NtSetInformationObject]
push ebx
push ebx
push ebx
push esi
push 0x719f85e0
call dword [sym.imp._Cntl.DLL_NtCreateEvent]
cmp eax, ebx
jl 0x719eb162
push 0x719f859c
push dword [0x719f85e0]
push dword [0x719f74dc]
call fcn.719d876d
mov esi, eax
cmp esi, ebx
jl 0x719eb14e
mov eax, dword [0x719f74dc]
push 0x1e
mov dword [ebp - 0xc], eax
push 8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [0x719f859c]
mov dword [ebp - 8], fcn.719f1e05
call dword [sym.imp._Cntl.DLL_NtSetInformationFile]
mov esi, eax
cmp esi, ebx
jl 0x719eb13d
xor eax, eax
jmp 0x719eb162
push dword [0x719f859c]
call fcn.719d8d4c
mov dword [0x719f859c], ebx
push dword [0x719f85e0]
call dword [sym.imp._Cntl.DLL_NtClose]
mov dword [0x719f85e0], ebx
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x719eb830
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x719f7264]
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], esi
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0xf6c]
lea eax, [ebp - 0x24]
push eax
push 1
push esi
push 0x719f7670
push 6
push 1
push 2
mov dword [ebp - 0x44], ebx
mov dword [ebx + 4], esi
call dword [edi + 0x98]
cmp eax, 0xffffffff
mov dword [ebp - 0x34], eax
jne 0x719eb892
cmp dword [ebp - 0x24], esi
jne 0x719eb889
mov dword [ebp - 0x24], 0x277b
or dword [ebx + 4], 0xffffffff
jmp 0x719eb9d2
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x24]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x2c]
push ecx
push 0x1c
lea ecx, [ebp - 0x20]
push ecx
push esi
push esi
mov ebx, 0x48000016
push ebx
push eax
call dword [edi + 0x68]
cmp eax, 0xffffffff
jne 0x719eb925
cmp dword [ebp - 0x24], 0x271e
jne 0x719eb9a4
push dword [ebp - 0x2c]
push esi
push dword [0x719f71dc]
call dword [sym.imp._Cntl.DLL_RtlAllocateHeap]
cmp eax, esi
mov dword [ebp - 0x28], eax
jne 0x719eb8ea
mov dword [ebp - 0x24], 8
jmp 0x719eb9a4
lea ecx, [ebp - 0x24]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x2c]
push ecx
push dword [ebp - 0x2c]
push eax
push esi
push esi
push ebx
push dword [ebp - 0x34]
call dword [edi + 0x68]
cmp eax, 0xffffffff
jne 0x719eb925
cmp dword [ebp - 0x24], esi
jne 0x719eb913
mov dword [ebp - 0x24], 0x277b
push dword [ebp - 0x28]
push esi
push dword [0x719f71dc]
call dword [sym.imp._Cntl.DLL_RtlFreeHeap]
jmp 0x719eb9a4
mov ecx, dword [ebp - 0x28]
cmp dword [ecx], esi
mov dword [ebp - 0x40], esi
jle 0x719eb99b
lea eax, [ecx + 4]
mov dword [ebp - 0x38], eax
cmp dword [0x719f85d8], esi
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
mov dword [ebp - 0x30], esi
jbe 0x719eb98d
mov dword [ebp - 0x3c], esi
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x719f85dc]
add eax, edx
mov edx, dword [ebx + 4]
cmp edx, dword [eax]
jne 0x719eb97b
cmp dword [eax + 0xc], esi
jne 0x719eb963
mov dword [eax + 0xc], edi
jmp 0x719eb97b
push dword [ebx + 4]
call sub.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_12
push eax
push 0x719d58c8
call sub._Cntl.DLL_DbgPrint
pop ecx
pop ecx
mov ecx, dword [ebp - 0x28]
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x3c], 0x10
cmp eax, dword [0x719f85d8]
jb 0x719eb948
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
add dword [ebp - 0x38], 8
cmp eax, dword [ecx]
jl 0x719eb935
push dword [ebp - 0x34]
push edi
call fcn.719eb79a
mov eax, dword [ebp - 0x44]
or dword [eax + 4], 0xffffffff
cmp dword [ebp - 0x28], esi
je 0x719eb9c8
lea eax, [ebp - 0x20]
cmp dword [ebp - 0x28], eax
je 0x719eb9c8
push dword [ebp - 0x28]
push esi
push dword [0x719f71dc]
call dword [sym.imp._Cntl.DLL_RtlFreeHeap]
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x34]
call dword [edi + 0x40]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
pop edi
pop esi
pop ebx
call fcn.719c15f6
leave
ret 4
Function at 0x719ebdb8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
push edi
call fcn.719cc600
xor edi, edi
cmp eax, edi
jne 0x719ebede
push ebx
push esi
mov esi, 0x719f8560
push esi
call dword [sym.imp._CKERNEL.DLL_EnterCriticalSection]
mov eax, dword [0x719f8654]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [0x719f8650]
mov dword [ebp - 0xc], eax
mov dword [eax + 4], ecx
mov eax, 0x719f8650
push esi
mov dword [0x719f8654], eax
mov dword [0x719f8650], eax
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
push 0x719d7478
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp._Cntl.DLL_RtlInitUnicodeString]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
push 0x20019
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp._Cntl.DLL_NtOpenKey]
mov ebx, eax
cmp ebx, edi
jl 0x719ebec2
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x64], 0x719eb66d
push 0x40000000
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
call dword [sym.imp._Cntl.DLL_RtlQueryRegistryValues]
push dword [ebp - 4]
mov ebx, eax
call dword [sym.imp._Cntl.DLL_NtClose]
jmp 0x719ebec2
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
mov dword [eax + 4], ecx
lea eax, [esi + 8]
push eax
call dword [sym.imp._CKERNEL.DLL_InterlockedDecrement]
test eax, eax
jne 0x719ebec2
push esi
call fcn.719eb62f
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0xc]
cmp esi, eax
jne 0x719ebea3
pop esi
cmp ebx, edi
pop ebx
jl 0x719ebed9
call fcn.719eba3d
jmp 0x719ebede
mov eax, 0x277b
pop edi
leave
ret
Function at 0x719ef8ad
Capabilities:
Create thread

Disassembly:
push 0x124
push 0x719d5968
call fcn.719c1450
mov eax, dword [0x719f7264]
mov dword [ebp - 0x1c], eax
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], esi
mov dword [0x719f8300], esi
push 0x40
pop ecx
xor eax, eax
mov edi, 0x719f8320
rep stosd dword es:[edi], eax
mov dword [0x719f830c], esi
mov dword [0x719f82cc], esi
mov byte [0x719f82c8], 1
mov dword [ebp - 0x128], esi
push 0x104
lea eax, [ebp - 0x120]
push eax
push dword [0x719f71d8]
call dword [sym.imp._CKERNEL.DLL_GetModuleFileNameA]
test eax, eax
je 0x719ef92e
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp._CKERNEL.DLL_LoadLibraryA]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], esi
je 0x719efaa5
push esi
push esi
push esi
push 0x1f0003
lea eax, [ebp - 0x124]
push eax
mov edi, dword [sym.imp._Cntl.DLL_NtCreateEvent]
call edi
cmp eax, esi
jl 0x719efa1b
mov dword [ebp - 4], esi
push 0x719f82e0
call dword [sym.imp._CKERNEL.DLL_InitializeCriticalSection]
xor eax, eax
inc eax
mov dword [ebp - 0x130], eax
or dword [ebp - 4], 0xffffffff
push esi
push eax
push esi
push 0x1f0003
push 0x719f8320
call edi
test eax, eax
jl 0x719efa1b
mov dword [0x719f830c], 1
mov eax, dword fs:[0x18]
push 0x28
push esi
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp._Cntl.DLL_RtlAllocateHeap]
mov ebx, eax
cmp ebx, esi
je 0x719efa1b
push 0xa
pop ecx
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x128]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x124]
mov dword [ebx], eax
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], esi
push 0x719f82f8
push esi
push ebx
push 0x719ef254
push esi
push esi
call dword [sym.imp._CKERNEL.DLL_CreateThread]
mov dword [0x719f82fc], eax
cmp eax, esi
je 0x719efa1b
xor eax, eax
inc eax
jmp 0x719efaa7
cmp dword [ebp - 0x124], esi
je 0x719efa2f
push dword [ebp - 0x124]
call dword [sym.imp._Cntl.DLL_NtClose]
mov dword [ebp - 0x12c], esi
cmp dword [0x719f830c], esi
jle 0x719efa68
mov edi, dword [ebp - 0x12c]
lea edi, [edi*4 + 0x719f8320]
push dword [edi]
call dword [sym.imp._Cntl.DLL_NtClose]
mov dword [edi], esi
inc dword [ebp - 0x12c]
mov eax, dword [ebp - 0x12c]
cmp eax, dword [0x719f830c]
jl 0x719efa3d
mov dword [0x719f830c], esi
cmp dword [ebp - 0x130], esi
je 0x719efa81
push 0x719f82e0
call dword [sym.imp._CKERNEL.DLL_DeleteCriticalSection]
cmp ebx, esi
je 0x719efa99
mov eax, dword fs:[0x18]
push ebx
push esi
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp._Cntl.DLL_RtlFreeHeap]
push dword [ebp - 0x128]
call dword [sym.imp._CKERNEL.DLL_FreeLibrary]
xor eax, eax
mov ecx, dword [ebp - 0x1c]
call fcn.719c15f6
call fcn.719c1430
ret
Function at 0x401100
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push 0xa
push str.F00000000
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x40111c
pop edi
pop esi
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, 0x10
jae 0x401132
pop edi
pop esi
xor eax, eax
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401143
pop edi
pop esi
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x401152
pop edi
pop esi
pop ebx
ret
mov ecx, dword [esp + 0x10]
mov edx, eax
mov esi, ecx
mov ebx, dword [edx]
mov dword [esi], ebx
mov ebx, dword [edx + 4]
mov dword [esi + 4], ebx
mov ebx, dword [edx + 8]
mov dword [esi + 8], ebx
xor ebx, ebx
mov edx, dword [edx + 0xc]
mov dword [esi + 0xc], edx
mov bl, byte [ecx + 0xe]
mov dl, byte [ecx + 0xc]
mov esi, ebx
xor ebx, ebx
mov bl, byte [ecx + 0xd]
add esi, ebx
mov ebx, edx
and ebx, 0xff
lea esi, [esi + ebx + 0x10]
cmp edi, esi
je 0x401197
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp dl, 0x1f
mov byte [esp + 0x10], dl
jbe 0x4011a5
mov byte [esp + 0x10], 0x1f
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push ebp
and edi, 0xff
lea ebp, [eax + 0x10]
jle 0x4011d2
mov esi, edx
sub ebp, edx
mov dword [esp + 0x18], edi
mov bl, byte [esi + ebp]
mov byte [esi], bl
mov ebx, dword [esp + 0x18]
inc esi
dec ebx
mov dword [esp + 0x18], ebx
jne 0x4011c1
mov byte [edi + edx], 0
mov dl, byte [ecx + 0xd]
mov byte [esp + 0x14], dl
mov edx, dword [esp + 0x14]
and edx, 0xff
cmp edx, 0x104
jl 0x4011f4
mov byte [esp + 0x14], 3
mov esi, dword [esp + 0x14]
xor edx, edx
mov dl, byte [ecx + 0xc]
and esi, 0xff
lea ebp, [edx + eax + 0x10]
mov edx, dword [esp + 0x1c]
jle 0x401226
mov edi, edx
sub ebp, edx
mov dword [esp + 0x18], esi
mov bl, byte [edi + ebp]
mov byte [edi], bl
mov ebx, dword [esp + 0x18]
inc edi
dec ebx
mov dword [esp + 0x18], ebx
jne 0x401215
mov byte [esi + edx], 0
mov dl, byte [ecx + 0xe]
mov byte [esp + 0x14], dl
mov ebp, dword [esp + 0x20]
xor edx, edx
xor ebx, ebx
mov dl, byte [ecx + 0xc]
mov bl, byte [ecx + 0xd]
mov ecx, dword [esp + 0x14]
add eax, edx
and ecx, 0xff
lea esi, [ebx + eax + 0x10]
jle 0x401260
mov eax, ebp
sub esi, ebp
mov edi, ecx
mov dl, byte [esi + eax]
mov byte [eax], dl
inc eax
dec edi
jne 0x401257
mov byte [ecx + ebp], 0
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x401270
Capabilities:
Create directory

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x108
lea eax, [esp]
lea edx, [esp + 4]
push esi
mov esi, dword [esp + 0x114]
push eax
push 0
push 0
push 0
push esi
push ecx
push 0x104
push edx
call fcn.0041e530
add esp, 0x20
test eax, eax
jne 0x4012be
push 0x10
push str.Form_Folder_Path
push esi
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
add esp, 0x108
ret
lea eax, [esp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4012ec
push 0x10
lea ecx, [esp + 0xc]
push str.Create_Folder
push ecx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
add esp, 0x108
ret
mov eax, 1
pop esi
add esp, 0x108
ret

Function at 0x401960
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
sub esp, 0xf8
lea eax, [esp]
push eax
push 0xf8
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4019dd
cmp eax, 0xf8
jae 0x4019dd
mov cl, byte [esp + eax - 1]
cmp cl, 0x5c
je 0x401999
cmp cl, 0x2f
je 0x401999
mov byte [esp + eax], 0x5c
mov byte [esp + eax + 1], 0
push 0x42cad8
push 0
lea ecx, [esp + 8]
push 0x429144
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x4019dd
push 0x42cad8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4019dd
push 0
push 0x42cad8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
neg eax
sbb eax, eax
neg eax
add esp, 0xf8
ret
xor eax, eax
add esp, 0xf8
ret
Function at 0x4019f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x368
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x60]
push esi
push edi
xor esi, esi
push eax
push esi
push esi
push esi
push 0x42c8a0
push 0x42cad8
push 0x104
push ecx
call fcn.0041e530
add esp, 0x20
test eax, eax
jne 0x401a2b
pop edi
pop esi
add esp, 0x368
ret
lea edx, [esp + 0x68]
push 0x42c9d8
push edx
lea eax, [esp + 0x174]
push str._s__s
push eax
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov word [esp + 0x60], si
mov word [esp + 0x62], si
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], esi
call fcn.0041e880
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
lea eax, [esp + 0x16c]
push ecx
push edx
push esi
push esi
push 0x20
push esi
push esi
push esi
lea ecx, [esp + 0x88]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
cmp edi, esi
jne 0x401ad0
pop edi
xor eax, eax
pop esi
add esp, 0x368
ret
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
push 1
push ecx
push 2
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
mov eax, edi
pop edi
pop esi
add esp, 0x368
ret

Function at 0x41e770
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x248
lea eax, [esp]
lea ecx, [esp + 0x144]
push esi
mov esi, dword [esp + 0x250]
push edi
push eax
push 0
push 0
push 0
push 0x429bbc
push esi
push 0x104
push ecx
call fcn.0041e530
add esp, 0x20
test eax, eax
jne 0x41e7b2
pop edi
pop esi
add esp, 0x248
ret
lea edx, [esp + 0xc]
lea eax, [esp + 0x14c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41e7da
pop edi
mov eax, 1
pop esi
add esp, 0x248
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x3c]
push ecx
push 0
push 0
push 0
push edx
push esi
lea eax, [esp + 0x168]
push 0x104
push eax
call fcn.0041e530
add esp, 0x20
test eax, eax
je 0x41e84d
test byte [esp + 0x10], 0x10
je 0x41e83f
cmp byte [esp + 0x3c], 0x2e
jne 0x41e82d
mov al, byte [esp + 0x3d]
test al, al
je 0x41e84d
cmp al, 0x2e
jne 0x41e82d
mov al, byte [esp + 0x3e]
test al, al
je 0x41e84d
lea ecx, [esp + 0x150]
push ecx
call fcn.0041e770
add esp, 4
jmp 0x41e84d
lea edx, [esp + 0x150]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x10]
push eax
push edi
call ebp
test eax, eax
jne 0x41e7e1
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop ebp
pop edi
mov eax, 1
pop esi
add esp, 0x248
ret
Function at 0x420799
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x429ca0
cmp edx, dword [eax]
je 0x4207bb
add eax, 8
inc ecx
cmp eax, 0x429d30
jl 0x4207ac
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x429ca0]
jne 0x4208e9
mov eax, dword [0x42cc60]
cmp eax, 1
je 0x4208c3
test eax, eax
jne 0x4207ec
cmp dword [0x429bc4], 1
je 0x4208c3
cmp edx, 0xfc
je 0x4208e9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x420823
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004220d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00421860
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x420866
lea eax, [ebp - 0x1a4]
push eax
call fcn.00421860
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x427f8c
push edi
call fcn.00423bf0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004220d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004220e0
lea eax, [ebp - 0xa0]
push 0x427f6c
push eax
call fcn.004220e0
push dword [esi + 0x429ca4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004220e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00423b63
add esp, 0x2c
pop edi
jmp 0x4208e9
lea eax, [ebp + 8]
lea esi, [esi + 0x429ca4]
push 0
push eax
push dword [esi]
call fcn.00421860
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret