joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bec6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
add edi, 0x865d
xor edi, 0x8fea
or edi, 0xdc99
call fcn.0043be38
add byte [ebp + 0x37], cl
inc edx
cmp al, 0x43
inc ebp
add esp, 4
pop edi
push edx
jmp 0x43be46
pop edx
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push edx
xor edx, 0x423b
pop edx
push edx
call 0x43beb7
add byte [ebp + 0x38], cl
inc eax
dec esp
push eax
dec esp
dec ecx
xor eax, 0xc4833447
add al, 0xe8
pop es
add byte [eax], al
add byte [eax], al
xor al, byte [edi + esi + 0x47]
inc edx
inc esi
add esp, 4
sub edx, 0x16c57
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x43beed
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x43bf47
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x43be15
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x43be15
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x43bf31
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x43bf3b
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x43bf90
push edx
push ecx
add esp, 4
jmp 0x43bf5e
xor edx, 0x794c
jmp 0x43bf69
pop edx
push ebx
push eax
add esp, 4
and ebx, 0xdb65
xor ebx, 0xa24e
or ebx, 0x2e3e
pop ebx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x43bff8
push esi
jmp 0x43bf97
sub esi, 0x13fd2
add esi, 0x64e2
pop esi
push ecx
push ecx
add esp, 4
jmp 0x43bfaf
add ecx, 0x4cd1
add ecx, 0x4b8c
add ecx, 0x17b9a
pop ecx
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
je 0x43bfee
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x43bdb9
mov dword [ebp - 0x31c], 0
Function at 0x43cbed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push eax
add esp, 4
add ecx, 0x7d6a
add ecx, 0x1206
pop ecx
push ebx
push edx
add esp, 4
and ebx, 0xb8d3
jmp 0x43cb6f
xor ebx, 0x28e7
or ebx, 0x3de9
pop ebx
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push ebx
push ecx
add esp, 4
and ebx, 0x15a5c
call fcn.0043cbed
add byte [0x43483934], bh
cmp edi, dword [edx]
inc esp
xor al, byte [ebx + 0x565b04c4]
add esp, 4
pop ebx
push esi
add esp, 4
pop ebx
push esi
xor esi, 0x3529
add esi, 0xb0f2
add esi, 0x835a
pop esi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x43cc22
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1668], edx
jmp 0x43cc7c
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x43cb4a
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x43cb4a
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x43cc66
mov dword [ebp - 0x1624], 0xffffffff
jmp 0x43cc70
mov dword [ebp - 0x1624], 1
mov ecx, dword [ebp - 0x1624]
mov dword [ebp - 0x1668], ecx
cmp dword [ebp - 0x1668], 0
jne 0x43ccc5
push edx
add edx, 0x19c7
sub edx, 0x5483
pop edx
push ebx
push ecx
add esp, 4
jmp 0x43cc9f
call 0x43ccad
add byte [ecx + 0x36], al
cmp cl, byte [edx + 0x34]
aas
cmp dh, byte [ebx]
add esp, 4
or ebx, 0x12521
pop ebx
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x43cd2d
push esi
push ebx
add esp, 4
and esi, 0x7810
pop esi
push esi
or esi, 0xfee2
or esi, 0xae06
or esi, 0x3fac
pop esi
push edi
push ebx
add esp, 4
sub edi, 0x12ede
add edi, 0xd09b
pop edi
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
je 0x43cd23
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x43caee
mov dword [ebp - 0x774], 0
Function at 0x43ccad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push eax
add esp, 4
add ecx, 0x7d6a
add ecx, 0x1206
pop ecx
push ebx
push edx
add esp, 4
and ebx, 0xb8d3
jmp 0x43cb6f
xor ebx, 0x28e7
or ebx, 0x3de9
pop ebx
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push ebx
push ecx
add esp, 4
and ebx, 0x15a5c
call fcn.0043cbed
add byte [0x43483934], bh
cmp edi, dword [edx]
inc esp
xor al, byte [ebx + 0x565b04c4]
add esp, 4
pop ebx
push esi
add esp, 4
pop ebx
push esi
xor esi, 0x3529
add esi, 0xb0f2
add esi, 0x835a
pop esi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x43cc22
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1668], edx
jmp 0x43cc7c
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x43cb4a
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x43cb4a
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x43cc66
mov dword [ebp - 0x1624], 0xffffffff
jmp 0x43cc70
mov dword [ebp - 0x1624], 1
mov ecx, dword [ebp - 0x1624]
mov dword [ebp - 0x1668], ecx
cmp dword [ebp - 0x1668], 0
jne 0x43ccc5
push edx
add edx, 0x19c7
sub edx, 0x5483
pop edx
push ebx
push ecx
add esp, 4
jmp 0x43cc9f
call 0x43ccad
add byte [ecx + 0x36], al
cmp cl, byte [edx + 0x34]
aas
cmp dh, byte [ebx]
add esp, 4
or ebx, 0x12521
pop ebx
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x43cd2d
push esi
push ebx
add esp, 4
and esi, 0x7810
pop esi
push esi
or esi, 0xfee2
or esi, 0xae06
or esi, 0x3fac
pop esi
push edi
push ebx
add esp, 4
sub edi, 0x12ede
add edi, 0xd09b
pop edi
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
je 0x43cd23
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x43caee
mov dword [ebp - 0x774], 0
Function at 0x457607
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x45e58f
Capabilities:
Allocate thread local storage

Disassembly:
call fcn.00456112
call fcn.0045798f
mov dword [0x490fc8], eax
jmp fcn.00468bdd
Function at 0x405c83
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x4345c0
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x405caf
push edi
call esi
cmp eax, 0xffffffff
jne 0x405cf1
test ebx, ebx
je 0x405cee
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
push dword [ebp - 0x18]
je 0x405ce8
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
pop ecx
mov eax, esi
jmp 0x405cf1
call fcn.00401abd
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x406306
Capabilities:
Get disk information

Disassembly:
mov eax, 0x434664
call fcn.004339e0
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.0041c900
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x4063d4
mov eax, SysReAllocString
cmp ebx, eax
ja 0x406342
mov eax, ebx
add eax, eax
push eax
call fcn.0040b97d
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], ebx
je 0x4063cd
cmp ebx, dword [ebp - 0x14]
ja 0x4063cd
lea ecx, [ebp - 0x2c]
call fcn.004028e9
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
jbe 0x4063b5
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4063aa
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.0040b97d
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0040150c
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x10]
jb 0x406380
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00401abd
push esi
call fcn.00401abd
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
sete al
jmp 0x4063d6
push esi
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40b97d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40b98c
pop dword [ebp - 0x24]
mov eax, 0x40b98c
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3797a
push 0
mov eax, 0xb976e8c9
add eax, 0x46cc9767
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x301acf86
add ecx, 0xcfe56b13
xor esi, esi
add esi, eax
mov edi, 0x44c600
add edi, dword [ebp - 0x24]
mov edx, 0x79174c3a
add edx, 0xe55ee69c
sub dword [ebp - 4], 0x896a3765
mov ebx, dword [edi]
sub dword [ebp - 0x10], esi
add ebx, edx
sub dword [ebp - 4], 0x2bd4a0f8
mov dword [esi], ebx
xor dword [ebp - 4], 0x1ee3dffa
add esi, 4
add edi, 4
loop 0x40b9e2
add eax, 0xbf28ed9e
sub eax, 0xbf281067
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x81c7567
sub ecx, 0x7dc7567
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x1000a0a9
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x10244460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
lea eax, [ebx + ebx]
push eax
push 0
push esi
mov dword [ebp - 0xd0], esi
call fcn.10096e70
add esp, 0xc
call fcn.100f29a0
test eax, eax
je 0x1000a16a
push 0x41
push 0
push 1
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov esi, eax
xor eax, eax
test esi, esi
je 0x1000a1e8
push 0xc6
push eax
mov word [ebp - 0xcc], ax
lea eax, [ebp - 0xca]
push eax
call fcn.10096e70
add esp, 0xc
lea eax, [ebp - 0xcc]
push eax
push 0x10009feb
push esi
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
push esi
call dword [sym.imp.USER32.dll_CloseDesktop]
lea eax, [ebp - 0xcc]
push eax
call fcn.10097456
pop ecx
cmp eax, ebx
jb 0x1000a151
xor eax, eax
jmp 0x1000a1e8
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd0]
call fcn.100973c1
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x1000a1e8
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0xcc], ax
lea eax, [ebp - 0xca]
push eax
call fcn.10096e70
add esp, 0xc
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xcc]
push eax
mov dword [ebp - 0xd4], 0x64
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [ebp - 0xd0], eax
test eax, eax
je 0x1000a1cb
lea eax, [ebp - 0xcc]
push eax
call fcn.10097456
pop ecx
cmp eax, ebx
jae 0x1000a14a
lea eax, [ebp - 0xcc]
push eax
push esi
jmp 0x1000a15e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4dd
jne 0x1000a1e2
mov dword [ebp - 0xd0], 1
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10096d51
leave
ret

Function at 0x1000a4a7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10244460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
je 0x1000a565
cmp ebx, esi
je 0x1000a565
cmp dword [ebp + 0x10], esi
je 0x1000a565
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.10096e70
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0xffffffffffffffff
push edi
call fcn.1001c16f
lea eax, [ebp - 0x20c]
push eax
call fcn.10097456
add esp, 0x20
test eax, eax
je 0x1000a565
push esi
push esi
push 2
push esi
push esi
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000a561
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x210], esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1000a567
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10096d51
leave
ret
Function at 0x1000a576
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.100979f0
mov edi, dword [ebp + 0xc]
pop ecx
mov ebx, eax
mov eax, 0x1f3
push edi
sub eax, ebx
push esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x1000a5b0
xor eax, eax
inc eax
jmp 0x1000a64e
mov dword [ebp - 4], 1
test byte [edi], 0x10
je 0x1000a612
lea ecx, [edi + 0x2c]
cmp byte [ecx], 0x2e
jne 0x1000a5d5
mov al, byte [edi + 0x2d]
cmp al, 0x2e
jne 0x1000a5d1
cmp byte [edi + 0x2e], 0
je 0x1000a62a
test al, al
je 0x1000a62a
push ecx
call fcn.100979f0
inc eax
pop ecx
cmp dword [ebp - 0xc], eax
jb 0x1000a62a
lea eax, [edi + 0x2c]
push eax
push esi
mov byte [ebx + esi - 1], 0
call fcn.10097900
push 0x101e40c8
push esi
call fcn.10097900
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push esi
call fcn.1000a576
add esp, 0x20
mov byte [ebx + esi], 0
jmp 0x1000a622
push dword [ebp + 0x14]
lea eax, [edi + 0x2c]
push eax
push esi
mov byte [ebx + esi - 1], 0
call dword [ebp + 0x10]
mov byte [ebx + esi - 1], 0x2a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000a642
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000a5b7
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000a653
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.10097456
mov edi, dword [ebp + 0xc]
pop ecx
mov ebx, eax
mov eax, 0x1f3
push edi
sub eax, ebx
push esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x1000a68d
xor eax, eax
inc eax
jmp 0x1000a745
mov dword [ebp - 4], 1
test byte [edi], 0x10
je 0x1000a704
lea ecx, [edi + 0x2c]
cmp word [ecx], 0x2e
jne 0x1000a6b8
movzx eax, word [edi + 0x2e]
cmp ax, 0x2e
jne 0x1000a6b3
cmp word [edi + 0x30], 0
je 0x1000a721
test ax, ax
je 0x1000a721
push ecx
call fcn.10097456
inc eax
pop ecx
cmp dword [ebp - 0xc], eax
jb 0x1000a721
xor eax, eax
mov word [esi + ebx*2 - 2], ax
lea eax, [edi + 0x2c]
push eax
push esi
call fcn.10097393
push 0x101e40cc
push esi
call fcn.10097393
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push esi
call fcn.1000a653
add esp, 0x20
mov dword [ebp - 4], eax
push 0x2a
pop eax
mov word [esi + ebx*2 - 2], ax
xor eax, eax
mov word [esi + ebx*2], ax
jmp 0x1000a721
push dword [ebp + 0x14]
xor eax, eax
mov word [esi + ebx*2 - 2], ax
lea eax, [edi + 0x2c]
push eax
push esi
call dword [ebp + 0x10]
push 0x2a
mov dword [ebp - 4], eax
pop eax
mov word [esi + ebx*2 - 2], ax
cmp dword [ebp - 4], 0
je 0x1000a739
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000a694
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000ae3b
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x10244460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
je 0x1000afee
push edi
call fcn.10097456
pop ecx
test eax, eax
je 0x1000afee
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x668], eax
cmp eax, 0xffffffff
je 0x1000afee
test al, 1
je 0x1000ae97
and eax, 0xfffffffe
push eax
push edi
mov dword [ebp - 0x668], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [ebp - 0x668], 0x10
je 0x1000afd2
push esi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call fcn.10096e70
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.100973c1
lea eax, [ebp - 0x414]
push 0x101e40cc
push eax
call fcn.10097393
push 0x24c
lea eax, [ebp - 0x660]
push ebx
push eax
mov dword [ebp - 0x664], ebx
call fcn.10096e70
add esp, 0x28
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp eax, 0xffffffff
je 0x1000afc8
push 0x101e4550
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1000afa1
push 0x101e454c
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1000afa1
xor eax, eax
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.10096e70
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.100973c1
lea eax, [ebp - 0x20c]
push 0x101e3fdc
push eax
call fcn.10097393
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.10097393
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.1000ae3b
add esp, 0x2c
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000af1d
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop esi
jmp 0x1000afd9
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, ebx
jne 0x1000aff0
cmp dword [ebp + 0xc], ebx
je 0x1000aff0
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x1000aff0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10096d51
leave
ret
Function at 0x1000affe
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x10244460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, esi
je 0x1000b1d3
push ebx
call fcn.10097456
pop ecx
test eax, eax
je 0x1000b1d3
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x668]
push eax
push ebx
mov dword [ebp - 0x668], esi
call fcn.10008ba0
add esp, 0x1c
test eax, eax
je 0x1000b1d3
cmp dword [ebp - 0x668], 0xffffffff
je 0x1000b1d3
test byte [ebp - 0x668], 1
je 0x1000b07c
and dword [ebp - 0x668], 0xfffffffe
push dword [ebp - 0x668]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [ebp - 0x668], 0x10
je 0x1000b1b7
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push esi
push eax
call fcn.10096e70
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.100973c1
lea eax, [ebp - 0x414]
push 0x101e40cc
push eax
call fcn.10097393
push 0x24c
lea eax, [ebp - 0x660]
push esi
push eax
mov dword [ebp - 0x664], esi
call fcn.10096e70
add esp, 0x28
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp eax, 0xffffffff
je 0x1000b1ad
push 0x101e4550
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1000b186
push 0x101e454c
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1000b186
xor eax, eax
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.10096e70
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.100973c1
lea eax, [ebp - 0x20c]
push 0x101e3fdc
push eax
call fcn.10097393
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.10097393
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.1000affe
add esp, 0x2c
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000b102
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
jmp 0x1000b1be
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, esi
jne 0x1000b1d5
cmp dword [ebp + 0xc], esi
je 0x1000b1d5
push 4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x1000b1d5
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10096d51
leave
ret
Function at 0x1000b228
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
call fcn.100f29f0
test eax, eax
je 0x1000b245
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
pop ebp
ret
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x1000b2b0
push esi
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x1000b2af
push edi
lea eax, [esi + esi]
push eax
push ebx
push dword [ebp + 0xc]
call fcn.10096e70
push esi
call fcn.100637ec
mov edi, eax
add esp, 0x10
test edi, edi
je 0x1000b2ae
push esi
push ebx
push edi
call fcn.10096e70
add esp, 0xc
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, eax
test ebx, ebx
je 0x1000b2ae
push esi
push dword [ebp + 0xc]
xor ebx, ebx
push 0xffffffffffffffff
push edi
call fcn.1001c10d
add esp, 0x10
test eax, eax
je 0x1000b2ae
push dword [ebp + 0xc]
call fcn.10097456
pop ecx
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x1000c313
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x10244460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
mov edi, dword [ebp + 8]
push ebx
mov dword [ebp - 0x410], edi
mov dword [ebp - 0x40c], ebx
call esi
mov dword [ebp - 0x408], eax
cmp eax, 0xffffffff
jne 0x1000c359
push dword [ebp + 0x10]
push ebx
push edi
jmp 0x1000c42b
test al, 1
je 0x1000c36e
and eax, 0xfffffffe
push eax
push ebx
mov dword [ebp - 0x408], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [ebp - 0x408], 0x10
je 0x1000c421
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x404], ax
lea eax, [ebp - 0x402]
push eax
call fcn.10096e70
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
call edi
push eax
push ebx
mov ebx, str._s.bak_08X
lea eax, [ebp - 0x404]
push ebx
push eax
call fcn.10098623
and dword [ebp - 0x408], 0
add esp, 0x10
lea eax, [ebp - 0x404]
push eax
call esi
jmp 0x1000c403
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push eax
push dword [ebp - 0x40c]
lea eax, [ebp - 0x404]
push ebx
push eax
call fcn.10098623
add esp, 0x10
lea eax, [ebp - 0x404]
push eax
call esi
inc dword [ebp - 0x408]
cmp dword [ebp - 0x408], 0xa
jge 0x1000c44b
cmp eax, 0xffffffff
jne 0x1000c3ca
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ebx, dword [ebp - 0x40c]
push dword [ebp + 0x10]
push ebx
push dword [ebp - 0x410]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
mov esi, eax
call fcn.1000ba9b
mov eax, esi
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10096d51
leave
ret
xor eax, eax
jmp 0x1000c43c