joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447fdc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x447ffe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004480c1
jmp 0x4480bc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x448024
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x448029
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov eax, ecx
cdq
mov dword [ebp - 4], eax
mov ecx, edx
mov dword [ebp - 8], ecx
test edi, edi
jl 0x448089
jg 0x44803e
test esi, esi
je 0x448089
test ecx, ecx
jl 0x448084
jg 0x448048
test eax, eax
je 0x448084
cmp edi, ecx
jg 0x44805a
jl 0x448052
cmp esi, eax
jae 0x44805a
mov eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.004485d0
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [ebp - 8]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x44808c
mov ecx, dword [ebp + 8]
jmp 0x448096
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x4480b0
jg 0x448096
test esi, esi
je 0x4480b0
cmp dword [ebx + 0x4c], 0
je 0x4480b0
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00450916
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x459e6b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00459ce1

Function at 0x4633d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4633fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4633fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x464590
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x4645c6
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 8], edx
jge 0x4646d4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
jne 0x4645e9
jmp 0x4645b4
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x20000000
je 0x4645ff
mov dword [ebp - 0x10], 1
jmp 0x464606
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x40000000
je 0x464622
mov dword [ebp - 0x14], 1
jmp 0x464629
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x80000000
je 0x464645
mov dword [ebp - 0x18], 1
jmp 0x46464c
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x20
je 0x46466b
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], 1
mov ecx, dword [ebp - 0x1c]
shl ecx, 4
mov edx, dword [ebp - 0x20]
lea eax, [ecx + edx*8 + 0x4c3af8]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x4000000
je 0x46469e
mov edx, dword [ebp - 0xc]
or edx, 0x200
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0xc]
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4646cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4646d6
jmp 0x4645b4
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4646e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x464716
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 8], edx
jge 0x46478e
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call fcn.004647d0
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x10]
cmp dword [ebp + 0xc], edx
jb 0x464756
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
cmp edx, dword [ebp - 0xc]
jbe 0x46475d
mov eax, 0xc1
jmp 0x464790
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0xc]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004485d0
add esp, 0xc
jmp 0x464704
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4647f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x464808
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x46485a
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x464829
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jae 0x46484b
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp - 8]
and ecx, 1
xor edx, edx
sub edx, ecx
and edx, 0xedb88320
xor eax, edx
mov dword [ebp - 8], eax
jmp 0x464820
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax*4 + 0x4c8260], ecx
jmp 0x4647ff
mov dword [ebp - 4], pe_nt_image_headers32
jmp 0x46486c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x800
jae 0x4648a4
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x4c7e60]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
and edx, 0xff
mov eax, dword [ebp - 0x10]
shr eax, 8
xor eax, dword [edx*4 + 0x4c8260]
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x4c8260], eax
jmp 0x464863
mov dword [0x4c8244], 0x464920
mov dword [0x4c8240], 0x464920
mov esp, ebp
pop ebp
ret
Function at 0x465820
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
shr eax, 2
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 8]
shr ecx, 1
add ecx, 3
mov edx, 4
imul eax, edx, 0
mov edx, dword [ebp - 8]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x465876
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x18]
add edx, 4
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jae 0x46588e
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [edx + ecx*4], eax
jmp 0x465864
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 4]
mov dword [ebp - 4], eax
imul ecx, dword [ebp + 8], 3
mov edx, dword [ebp - 8]
lea eax, [edx + ecx*4 + 0x70]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0
jne 0x46592d
mov ecx, dword [ebp - 4]
shr ecx, 8
and ecx, 0xff
movzx edx, byte [ecx + str.cw]
xor edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xff
movzx ecx, byte [eax + str.cw]
shl ecx, 8
or edx, ecx
mov eax, dword [ebp - 4]
shr eax, 0x18
movzx ecx, byte [eax + str.cw]
shl ecx, 0x10
or edx, ecx
mov eax, dword [ebp - 4]
and eax, 0xff
movzx ecx, byte [eax + str.cw]
shl ecx, 0x18
or edx, ecx
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0xc]
shl edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
and eax, 0x100
je 0x465925
mov dword [ebp - 0xc], 0x1b
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
jmp 0x46598e
cmp dword [ebp - 0x10], 4
jne 0x46598e
cmp dword [ebp + 8], 6
jbe 0x46598e
mov edx, dword [ebp - 4]
and edx, 0xff
movzx eax, byte [edx + str.cw]
mov ecx, dword [ebp - 4]
shr ecx, 8
and ecx, 0xff
movzx edx, byte [ecx + str.cw]
shl edx, 8
or eax, edx
mov ecx, dword [ebp - 4]
shr ecx, 0x10
and ecx, 0xff
movzx edx, byte [ecx + str.cw]
shl edx, 0x10
or eax, edx
mov ecx, dword [ebp - 4]
shr ecx, 0x18
movzx edx, byte [ecx + str.cw]
shl edx, 0x18
or eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, dword [eax + edx]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax + edx*4], ecx
mov edx, dword [ebp - 8]
add edx, 4
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x1c]
jne 0x4658b0
mov esp, ebp
pop ebp
ret 4
Function at 0x467560
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x268]
sub esp, 0x2e8
mov eax, dword [0x4c3008]
xor eax, ebp
mov dword [ebp + 0x264], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, ax
cmp eax, 6
je 0x4675ba
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x4675ba
push 0xc00
call dword [ebp - 0x80]
test eax, eax
je 0x4675ba
jmp 0x4676c8
push 0x106
lea ecx, [ebp - 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
je 0x4675db
cmp dword [ebp - 0x78], 0x104
jbe 0x4675e0
jmp 0x4676c8
mov edx, dword [ebp - 0x78]
movzx eax, word [ebp + edx*2 - 0x6e]
cmp eax, 0x5c
je 0x467603
mov ecx, 0x5c
mov edx, dword [ebp - 0x78]
mov word [ebp + edx*2 - 0x6c], cx
mov eax, dword [ebp - 0x78]
add eax, 1
mov dword [ebp - 0x78], eax
mov ecx, dword [str.userenv]
mov dword [ebp - 0x7c], ecx
mov edx, dword [ebp - 0x7c]
movsx eax, byte [edx]
test eax, eax
je 0x4676c8
mov ecx, dword [ebp - 0x78]
lea edx, [ebp + ecx*2 - 0x6c]
mov dword [ebp - 0x74], edx
mov eax, dword [ebp - 0x7c]
mov cl, byte [eax]
mov byte [ebp - 0x6d], cl
mov edx, dword [ebp - 0x7c]
add edx, 1
mov dword [ebp - 0x7c], edx
movsx eax, byte [ebp - 0x6d]
test eax, eax
jne 0x46763f
jmp 0x467655
movzx cx, byte [ebp - 0x6d]
mov edx, dword [ebp - 0x74]
mov word [edx], cx
mov eax, dword [ebp - 0x74]
add eax, 2
mov dword [ebp - 0x74], eax
jmp 0x467624
mov ecx, 2
imul edx, ecx, 0
mov eax, 0x2e
mov ecx, dword [ebp - 0x74]
mov word [ecx + edx], ax
mov edx, 2
shl edx, 0
mov eax, 0x64
mov ecx, dword [ebp - 0x74]
mov word [ecx + edx], ax
mov edx, 2
shl edx, 1
mov eax, 0x6c
mov ecx, dword [ebp - 0x74]
mov word [ecx + edx], ax
mov edx, 2
imul eax, edx, 3
mov ecx, 0x6c
mov edx, dword [ebp - 0x74]
mov word [edx + eax], cx
mov eax, 2
shl eax, 2
xor ecx, ecx
mov edx, dword [ebp - 0x74]
mov word [edx + eax], cx
push 8
push 0
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x46760c
mov ecx, dword [ebp + 0x264]
xor ecx, ebp
call fcn.004456ce
add ebp, 0x268
mov esp, ebp
pop ebp
ret
Function at 0x4715d0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
xor edx, edx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0x6a09e667
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x20], 0xbb67ae85
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x20], 0x3c6ef372
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x20], 0xa54ff53a
mov ecx, 4
shl ecx, 2
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0x510e527f
mov eax, 4
imul ecx, eax, 5
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0x9b05688c
mov eax, 4
imul ecx, eax, 6
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0x1f83d9ab
mov eax, 4
imul ecx, eax, 7
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0x5be0cd19
pop ebp
ret 4

Function at 0x472360
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
call fcn.0044de58
add esp, 0x18
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.00472260
mov esp, ebp
pop ebp
ret 0xc

Function at 0x475680
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea ecx, [ebp - 8]
call fcn.004026d0
mov eax, dword [ebp + 0x10]
push eax
push 0x2002
lea ecx, [ebp - 8]
call fcn.0047a160
movzx ecx, al
test ecx, ecx
jne 0x4756ba
mov byte [ebp - 1], 0
lea ecx, [ebp - 8]
call fcn.004026f0
mov al, byte [ebp - 1]
jmp 0x475750
lea ecx, [ebp - 8]
call fcn.00401380
push eax
lea ecx, [ebp - 0x14]
call fcn.00402740
lea ecx, [ebp - 0x14]
call fcn.00401300
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4756f5
mov byte [ebp - 2], 0
lea ecx, [ebp - 0x14]
call fcn.00402770
lea ecx, [ebp - 8]
call fcn.004026f0
mov al, byte [ebp - 2]
jmp 0x475750
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004485d0
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.00402770
lea ecx, [ebp - 8]
call fcn.00401380
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x475739
mov byte [ebp - 3], 0
lea ecx, [ebp - 8]
call fcn.004026f0
mov al, byte [ebp - 3]
jmp 0x475750
lea ecx, [ebp - 8]
call fcn.00402710
mov byte [ebp - 4], 1
lea ecx, [ebp - 8]
call fcn.004026f0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x476c60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2be6
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4c3008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00478720
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x476cc2
mov ecx, dword [ebp - 0x10]
and ecx, 0x10
jne 0x476cc2
mov edx, dword [ebp - 0x10]
and edx, 1
je 0x476cc2
mov eax, dword [ebp - 0x10]
and eax, 0xfffffffe
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004773a0
movzx edx, al
test edx, edx
jne 0x476cc2
xor al, al
jmp 0x476d2b
movzx eax, byte [0x4c5e81]
test eax, eax
jne 0x476d17
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00472c00
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.00401380
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004012a0
cmp dword [ebp - 0x1c], 0
je 0x476d15
mov al, 1
jmp 0x476d2b
jmp 0x476d29
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x476d29
mov al, 1
jmp 0x476d2b
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x477030
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2c4a
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4c3008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x4c5e81]
test eax, eax
jne 0x4770af
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00472c00
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 0x18]
call fcn.00401380
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004012a0
cmp dword [ebp - 0x1c], 0
je 0x4770ad
mov al, 1
jmp 0x47712d
jmp 0x4770c3
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4770c3
mov al, 1
jmp 0x47712d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4770d4
xor al, al
jmp 0x47712d
lea ecx, [ebp - 0x60]
call fcn.00402ec0
mov dword [ebp - 4], 1
push 0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x60]
call fcn.00478040
movzx eax, al
test eax, eax
jne 0x477110
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.00402ef0
mov al, byte [ebp - 0xd]
jmp 0x47712d
lea ecx, [ebp - 0x60]
call fcn.00402e40
mov byte [ebp - 0xe], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.00402ef0
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4773a0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2cfa
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4c3008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x4c5e81]
test eax, eax
jne 0x47741e
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.00472c00
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00401380
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004012a0
cmp dword [ebp - 0x18], 0
je 0x47741c
mov al, 1
jmp 0x477436
jmp 0x477434
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x477434
mov al, 1
jmp 0x477436
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x478720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2e54
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4c3008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x4c5e81]
test eax, eax
jne 0x478795
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00472c00
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.00401380
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004012a0
mov eax, dword [ebp - 0x1c]
jmp 0x4787b0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4787ad
mov eax, dword [ebp - 0x10]
jmp 0x4787b0
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x478ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0xc], 0x400000
jbe 0x478af9
mov dword [ebp + 0xc], 0x400000
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
call fcn.004026a0
mov byte [ebp - 1], al
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [edx], eax
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x478ee0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x478f17
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x478f17
xor al, al
jmp 0x478f34
xor edx, edx
mov eax, dword [ebp - 4]
mov cl, 0x20
call fcn.004634b0
xor ecx, ecx
add eax, dword [ebp - 8]
adc edx, ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x47b4e0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4c3008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], SysReAllocStringLen
mov dword [eax + 4], ecx
mov dword [ebp - 0x64], 0x40
push str.GlobalMemoryStatusEx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x47b551
lea edx, [ebp - 0x64]
push edx
call dword [ebp - 0x68]
test eax, eax
je 0x47b551
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x3c]
push eax
call fcn.00403580
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
jmp 0x47b57b
mov dword [ebp - 0x24], 0x20
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004035c0
xor edx, edx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004456ce
mov esp, ebp
pop ebp
ret 4
Function at 0x47b650
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a310d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4c3008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
movzx eax, byte [0x4c5e81]
test eax, eax
je 0x47b732
mov ecx, dword [ebp + 8]
call fcn.00401350
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x47b6c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x47b6b7
mov dword [ebp - 0x1c], 1
jmp 0x47b6be
mov dword [ebp - 0x1c], 0
mov al, byte [ebp - 0x1c]
jmp 0x47b777
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401c50
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x20]
jbe 0x47b6fd
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004027c0
cmp dword [ebp - 0x14], 0
jne 0x47b72e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x47b722
mov dword [ebp - 0x24], 1
jmp 0x47b729
mov dword [ebp - 0x24], 0
mov al, byte [ebp - 0x24]
jmp 0x47b777
mov al, 1
jmp 0x47b777
lea ecx, [ebp - 0x34]
call fcn.004740e0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.0047b790
mov byte [ebp - 0xd], al
push 0
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00474750
mov dl, byte [ebp - 0xd]
mov byte [ebp - 0xe], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004012a0
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4