joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d610
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.0049bf10
mov eax, dword [esp + 0x11c74]
push ebx
push ebp
mov ebp, dword [esp + 0x11c74]
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x47d634
mov dword [eax], edi
cmp dword [ebp + 8], edi
je 0x47d7d4
mov cl, 1
mov eax, ebp
call fcn.0047d9b0
test eax, eax
je 0x47d7fa
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4c7a54]
push eax
push esi
mov ecx, ebp
call fcn.0047da40
test eax, eax
setne cl
mov byte [esp + 0x17], cl
test cl, cl
jne 0x47d67a
xor eax, eax
mov dword [0x4cc4dc], eax
jmp 0x47d67f
mov eax, dword [0x4cc4dc]
cmp byte [esp + 0x11c80], 0
mov dword [esp + 0x1844], edi
mov dword [esp + 0x1848], edi
mov dword [esp + 0x184c], edi
mov dword [esp + 0x1858], edi
mov dword [esp + 0x1864], edi
mov dword [esp + 0x1868], edi
je 0x47d6bf
mov byte [esp + 0x1841], 0
test cl, cl
je 0x47d6c7
mov byte [esp + 0x1841], 1
mov edx, dword [0x4cc4d8]
mov ecx, 0x4a48a0
mov dword [esp + 0x1024], ecx
mov dword [esp + 0x102c], ecx
mov dword [esp + 0x1030], ecx
mov ecx, dword [0x4c7a54]
cmp eax, edi
mov dword [esp + 0x1028], edi
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x1850], edx
mov dword [esp + 0x1854], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x103c], ebp
mov dword [esp + 0x18], 0x10
setg bl
cmp byte [esp + 0x17], 0
je 0x47d74a
xor ecx, ecx
test eax, eax
jle 0x47d73a
lea ecx, [ecx]
cmp dword [edx + ecx*4], esi
je 0x47d74a
inc ecx
cmp ecx, eax
jl 0x47d730
cmp eax, 0x1f4
jge 0x47d74a
mov dword [edx + eax*4], esi
inc eax
mov dword [0x4cc4dc], eax
lea edx, [esp + 0x18]
push edx
push 0x47bb90
mov dword [esp + 0x185c], eax
call edi
mov eax, dword [esp + 0x1848]
test eax, eax
jne 0x47d77b
test bl, bl
je 0x47d7e6
mov edx, dword [0x4cc4d8]
mov dword [0x4cc4dc], eax
xor bl, bl
jmp 0x47d720
call fcn.0047b3d0
mov ecx, dword [0x4cc4dc]
mov edx, dword [esp + 0x1848]
mov esi, dword [0x4cc4d8]
xor eax, eax
test ecx, ecx
jle 0x47d7aa
lea esp, [esp]
cmp dword [esi + eax*4], edx
je 0x47d7bc
inc eax
cmp eax, ecx
jl 0x47d7a0
cmp ecx, 0x1f4
jge 0x47d7bc
mov dword [esi + ecx*4], edx
inc ecx
mov dword [0x4cc4dc], ecx
mov eax, dword [0x4c7a54]
mov eax, dword [eax + 0x54]
cmp eax, 0xffffffff
jle 0x47d7d4
push 1
push eax
call fcn.00401430
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 0xc
mov ecx, dword [esp + 0x11c84]
test ecx, ecx
je 0x47d7fa
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x47d7fa
mov dword [ecx], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x11c68
ret 0xc
Function at 0x47d810
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.0049bf10
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x47d990
xor cl, cl
mov eax, edi
call fcn.0047d9b0
test eax, eax
jne 0x47d845
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4c7a54]
push eax
push ebp
mov ecx, edi
call fcn.0047da40
test eax, eax
je 0x47d868
xor eax, eax
mov dword [0x4cc4dc], eax
jmp 0x47d86d
mov eax, dword [0x4cc4dc]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1024], 0x4a48a0
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1864], ebx
mov dword [esp + 0x1868], ebx
cmp byte [esp + 0x11c7c], bl
je 0x47d8b3
mov byte [esp + 0x1841], bl
cmp eax, ebx
je 0x47d8bb
mov byte [esp + 0x1841], 1
mov ecx, dword [0x4cc4d8]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x1854], eax
lea eax, [esp + 0x18]
push eax
push 0x47db10
mov dword [esp + 0x1858], ecx
mov dword [esp + 0x1860], edx
call esi
mov eax, dword [esp + 0x1848]
cmp eax, ebx
je 0x47d968
lea ecx, [esp + 0x10]
push ecx
push 0x47c430
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x47d925
mov edx, dword [esp + 0x1848]
call fcn.0047d0b0
mov dword [esp + 0x1848], esi
mov eax, dword [esp + 0x1848]
call fcn.0047b3d0
mov edx, dword [esp + 0x1848]
call fcn.0047d0b0
mov edx, dword [0x4c7a54]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47d990
push 1
push eax
call fcn.00401430
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
mov eax, dword [0x4cc4dc]
cmp eax, ebx
je 0x47d990
cmp eax, 1
setg al
mov dword [0x4cc4dc], ebx
cmp al, bl
je 0x47d990
mov edx, ebp
call fcn.0047d0b0
push ebx
mov ecx, edi
call fcn.0047d810
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x11c68
ret 4
Function at 0x4971b6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c6b10]
jne 0x4971c0
repz ret
jmp fcn.0049bc1d

Function at 0x499f00
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c6b10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00494532
and dword [ebp - 0x14], 0
cmp dword [0x4c9cbc], 0
mov dword [ebp - 0x18], eax
jne 0x499fb3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x49a05b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a4030
push ebx
call edi
test eax, eax
je 0x49a05b
mov esi, dword [fcn.00490bb0]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c9cbc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c9cc0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c9cc4], eax
call edi
push eax
call esi
mov dword [0x4c9ccc], eax
test eax, eax
je 0x499fb3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c9cc8], eax
mov eax, dword [0x4c9cc8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00490bb4]
cmp eax, ecx
je 0x49a00c
cmp dword [0x4c9ccc], ecx
je 0x49a00c
push eax
call esi
push dword [0x4c9ccc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x49a00c
test ebx, ebx
je 0x49a00c
call edi
test eax, eax
je 0x49a003
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x49a003
test byte [ebp - 8], 1
jne 0x49a00c
or dword [ebp + 0x10], 0x200000
jmp 0x49a03f
mov eax, dword [0x4c9cc0]
cmp eax, dword [ebp - 0x18]
je 0x49a03f
push eax
call esi
test eax, eax
je 0x49a03f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x49a03f
mov eax, dword [0x4c9cc4]
cmp eax, dword [ebp - 0x18]
je 0x49a03f
push eax
call esi
test eax, eax
je 0x49a03f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c9cbc]
call esi
test eax, eax
je 0x49a05b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x49a05d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004971b6
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x40491a
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x44e578], 2
push esi
push edi
mov edi, eax
mov esi, ecx
jl 0x40492e
call fcn.004037a7
mov ecx, esi
call fcn.004048f7
xor eax, eax
mov edx, dword [eax + 0x42a498]
mov ecx, dword [esi + 0xf4]
mov dword [eax + ecx], edx
add eax, 4
cmp eax, 0x20
jl 0x404937
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov eax, dword [esi + 0xf4]
mov ecx, dword [esp + 0xc]
xor dword [eax + 8], ecx
mov esi, dword [esi + 0xf4]
or edi, 0x2000
shl edi, 0x10
xor dword [esi + 0xc], edi
pop edi
pop esi
ret 4
Function at 0x405608
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x405635
test cl, 7
je 0x405635
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4305a0]
dec esi
inc ecx
jmp 0x405616
cmp esi, 8
jb 0x4056d8
mov edx, esi
shr edx, 3
mov dword [ebp + 8], edx
push ebx
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx edi, bl
mov edi, dword [edi*4 + 0x4309a0]
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4305a0]
mov ebx, edx
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x430da0]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4315a0]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edi, dword [ebx*4 + 0x4319a0]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x431da0]
movzx edx, dl
xor edi, dword [edx*4 + 0x4311a0]
movzx eax, al
xor edi, dword [eax*4 + 0x4321a0]
sub esi, 8
add ecx, 8
dec dword [ebp + 8]
mov eax, edi
jne 0x405647
pop ebx
jmp 0x4056d8
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4305a0]
dec esi
inc ecx
test esi, esi
ja 0x4056c4
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x405999
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0x40
pop ebx
cmp esi, ebx
jbe 0x4059e3
lea eax, [ebp - 0x1d0]
push eax
call fcn.00410463
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1d0]
push eax
call fcn.00410765
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.004107de
lea eax, [ebp - 0x80]
push 0x20
mov dword [ebp + 8], eax
pop esi
xor ecx, ecx
push edi
test esi, esi
jbe 0x405a03
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x36
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x4059f2
cmp esi, ebx
jae 0x405a1b
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x36
push eax
call fcn.0041a590
add esp, 0xc
lea eax, [ebp - 0xf0]
push eax
call fcn.00410463
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00410765
push dword [ebp + 0x14]
lea eax, [ebp - 0xf0]
push dword [ebp + 0x10]
push eax
call fcn.00410765
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.004107de
lea eax, [ebp - 0x160]
push eax
call fcn.00410463
xor ecx, ecx
test esi, esi
jbe 0x405a85
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x5c
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x405a74
pop edi
cmp esi, ebx
jae 0x405a9e
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x5c
push eax
call fcn.0041a590
add esp, 0xc
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.00410765
push 0x20
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.00410765
push dword [ebp + 0x18]
lea eax, [ebp - 0x160]
push eax
call fcn.004107de
pop esi
pop ebx
leave
ret 0x14
Function at 0x405ad6
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0xbc
push esi
mov esi, dword [ebp + 0x6c]
push edi
push 0x40
pop eax
cmp esi, eax
jae 0x405aef
mov eax, esi
push eax
push dword [ebp + 0x68]
lea eax, [ebp - 0x44]
push eax
call fcn.0041c000
add esp, 0xc
lea eax, [ebp + 0x20]
push eax
mov byte [ebp + esi - 0x44], 0
mov byte [ebp + esi - 0x43], 0
mov byte [ebp + esi - 0x42], 0
mov byte [ebp + esi - 0x41], 1
add esi, 4
push esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.00405999
push 0x20
pop esi
push esi
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp]
push eax
call fcn.0041c000
mov eax, dword [ebp + 0x7c]
add esp, 0xc
dec eax
mov dword [ebp + 0x4c], eax
push 0x10
pop eax
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x70]
mov dword [ebp + 0x40], eax
mov eax, dword [ebp + 0x74]
mov dword [ebp + 0x44], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x48], eax
xor edi, edi
mov eax, dword [ebp + edi + 0x4c]
test eax, eax
jbe 0x405ba6
mov dword [ebp + 0x6c], eax
lea eax, [ebp - 0x64]
push eax
push esi
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.00405999
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0041c000
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax + 0x20]
xor byte [ebp + eax], cl
inc eax
cmp eax, esi
jb 0x405b94
dec dword [ebp + 0x6c]
jne 0x405b6d
push esi
lea eax, [ebp]
push eax
push dword [ebp + edi + 0x40]
call fcn.0041c000
add edi, 4
add esp, 0xc
cmp edi, 0xc
jb 0x405b62
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.0040ce55
push esi
lea eax, [ebp]
push eax
call fcn.0040ce55
push esi
lea eax, [ebp + 0x20]
push eax
call fcn.0040ce55
push esi
lea eax, [ebp - 0x64]
push eax
call fcn.0040ce55
pop edi
pop esi
add ebp, 0x58
leave
ret 0x20
Function at 0x405bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
cmp dword [ebp + 0x1c], 0x18
push edi
mov edi, ecx
mov dword [ebp - 8], edi
ja 0x405dab
and dword [ebp - 4], 0
push ebx
push esi
lea ebx, [edi + 0x4b4]
mov eax, dword [ebp + 0x1c]
lea esi, [ebx + 0x102]
cmp dword [esi + 0x32], eax
jne 0x405c48
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.0040cf30
test al, al
je 0x405c48
push 0x10
push dword [ebp + 0x14]
push esi
call fcn.0041a974
add esp, 0xc
test eax, eax
je 0x405db0
inc dword [ebp - 4]
add ebx, 0x178
cmp dword [ebp - 4], 4
jb 0x405c16
mov esi, 0x200
push esi
lea eax, [ebp - 0x268]
push eax
push dword [ebp + 0x10]
call fcn.00411958
mov ecx, dword [ebp + 0x1c]
xor eax, eax
inc eax
shl eax, cl
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x10
push dword [ebp + 0x14]
lea eax, [ebp - 0x268]
push eax
call fcn.0041a7d0
pop ecx
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00405ad6
push esi
lea eax, [ebp - 0x268]
push eax
call fcn.0040ce55
mov esi, dword [ebp + 0xc]
lea eax, [edi + 0xa94]
mov ecx, dword [eax]
mov edx, ecx
and edx, 3
imul edx, edx, 0x178
lea ebx, [edx + edi + 0x4b4]
inc ecx
mov dword [eax], ecx
mov eax, dword [ebp + 0x1c]
push 0x40
pop ecx
mov dword [ebx + 0x134], eax
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 0x10
push dword [ebp + 0x14]
lea eax, [ebx + 0x102]
push eax
movsw word es:[edi], word [esi]
call fcn.0041c000
push 0x20
pop esi
push esi
lea eax, [ebp - 0x48]
push eax
lea edi, [ebx + 0x112]
push edi
call fcn.0041c000
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebx + 0x138]
push eax
call fcn.0041c000
push esi
lea eax, [ebp - 0x68]
push eax
add ebx, 0x158
push ebx
call fcn.0041c000
add esp, 0x30
push 0
push 1
push esi
push edi
call fcn.0040cda7
mov edi, dword [ebp - 8]
cmp dword [ebp + 0x20], 0
je 0x405d4d
push esi
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 0x20]
call fcn.0041c000
add esp, 0xc
mov ebx, dword [ebp + 0x24]
test ebx, ebx
je 0x405d7f
push 8
push 0
push ebx
call fcn.0041a590
add esp, 0xc
xor ecx, ecx
mov dl, byte [ebp + ecx - 0x28]
mov eax, ecx
and eax, 7
add eax, ebx
xor byte [eax], dl
inc ecx
cmp ecx, esi
jb 0x405d63
push esi
lea eax, [ebp - 0x28]
push eax
call fcn.0040ce55
cmp dword [ebp + 0x18], 0
je 0x405d9f
push dword [ebp + 0x18]
lea eax, [ebp - 0x48]
push 0x100
push eax
push dword [ebp + 8]
lea ecx, [edi + 0xa9c]
call fcn.0040c904
push esi
lea eax, [ebp - 0x48]
push eax
call fcn.0040ce55
pop esi
pop ebx
pop edi
leave
ret 0x20
push 0
push 0
push 0x20
pop esi
lea eax, [ebx + 0x112]
push esi
push eax
call fcn.0040cda7
push esi
lea eax, [ebx + 0x112]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0041c000
add esp, 0xc
push 0
push 1
push esi
lea eax, [ebx + 0x112]
push eax
call fcn.0040cda7
push esi
lea eax, [ebx + 0x138]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041c000
push esi
add ebx, 0x158
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.0041c000
add esp, 0x18
jmp 0x405d37
Function at 0x405ebb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 2
jne 0x405f07
mov eax, dword [esi + 4]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp + 8]
push eax
push 0x20
push dword [ebp + 0xc]
call fcn.00405999
xor edx, edx
mov dword [esi + 4], edx
xor eax, eax
push ebx
movzx ebx, byte [ebp + eax - 0x20]
mov ecx, eax
and ecx, 3
shl ecx, 3
shl ebx, cl
xor edx, ebx
inc eax
cmp eax, 0x20
jb 0x405eec
mov dword [esi + 4], edx
pop ebx
cmp dword [esi], 3
jne 0x405f2f
lea eax, [ebp - 0x20]
push eax
push 0x20
add esi, 4
push esi
push 0x20
push dword [ebp + 0xc]
call fcn.00405999
push 0x20
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0041c000
add esp, 0xc
pop esi
leave
ret 8
Function at 0x40840e
Capabilities:
Move file

Disassembly:
mov eax, 0x4294a3
call fcn.0041a250
mov eax, 0x5028
call fcn.0041a860
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x800
push esi
lea eax, [ebp - 0x5034]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x4085cb
cmp eax, esi
jae 0x4085cb
push esi
lea eax, [ebp - 0x4034]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x4085cb
cmp eax, esi
jae 0x4085cb
lea eax, [ebp - 0x5034]
push eax
call fcn.0040a2a0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4034]
push eax
call fcn.0040a2a0
mov edi, eax
cmp word [edi], 0
je 0x4085cb
push edi
push dword [ebp - 0x10]
call fcn.00411bd1
test eax, eax
je 0x4085cb
push edi
push ebx
call fcn.0040a2a0
push eax
call fcn.00411bd1
test eax, eax
jne 0x4085cb
mov word [ebp - 0x1010], ax
xor edi, edi
cmp word [ebp - 0x1010], 0
jne 0x408527
push esi
push ebx
lea eax, [ebp - 0x1010]
push eax
call fcn.00410951
push edi
push str.rtmp_d
push esi
lea eax, [ebp - 0x1010]
push eax
call fcn.0040a2a0
push eax
call fcn.00401b74
add esp, 0x10
lea eax, [ebp - 0x1010]
push eax
call fcn.004091c5
test al, al
je 0x40850e
xor eax, eax
mov word [ebp - 0x1010], ax
add edi, 0x7b
cmp edi, 0x2710
jl 0x4084c1
cmp word [ebp - 0x1010], 0
je 0x4085cb
push esi
push ebx
lea eax, [ebp - 0x3034]
push eax
call fcn.00410951
push esi
push dword [ebp - 0x10]
lea eax, [ebp - 0x3034]
push eax
call fcn.0040a40a
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x3034]
push eax
call esi
test eax, eax
je 0x4085cb
lea ecx, [ebp - 0x2034]
call fcn.004086a6
push dword [ebp + 8]
and dword [ebp - 4], 0
xor bl, bl
call fcn.004091c5
test al, al
jne 0x40858e
push 0x12
push dword [ebp + 8]
lea ecx, [ebp - 0x2034]
call fcn.00408843
mov bl, al
lea eax, [ebp - 0x3034]
push eax
lea eax, [ebp - 0x1010]
push eax
call esi
test bl, bl
je 0x4085b8
lea ecx, [ebp - 0x2034]
call fcn.00408952
lea ecx, [ebp - 0x2034]
call fcn.004089a0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2034]
call fcn.00408b9d
mov al, 1
jmp 0x4085cd
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x408fad
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041a860
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call esi
test eax, eax
setne bl
test bl, bl
jne 0x408ffc
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.0040a77b
test al, al
je 0x408ffc
push dword [ebp + 0xc]
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
setne bl
pop esi
mov al, bl
pop ebx
leave
ret 8

Function at 0x4091e9
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041a860
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00409faa
movzx eax, word [eax]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp ax, 0x2e
je 0x40921f
cmp ax, 0x20
je 0x40921f
push 0
push edi
call esi
test eax, eax
jne 0x40924e
push edi
call fcn.004091c5
test al, al
jne 0x409261
push 0x800
lea eax, [ebp - 0x1000]
push eax
push edi
call fcn.0040a77b
test al, al
je 0x409261
push 0
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
je 0x409261
cmp byte [ebp + 0xc], 0
je 0x40925d
push dword [ebp + 0x10]
push edi
call fcn.00408fad
xor eax, eax
jmp 0x409279
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x409276
cmp eax, 3
je 0x409276
xor eax, eax
inc eax
jmp 0x409279
push 2
pop eax
pop edi
pop esi
leave
ret 0xc
Function at 0x409396
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1250
call fcn.0041a860
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [ebp - 0x250]
mov edi, 0x800
push eax
jne 0x409425
push dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
call ebx
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x409452
push edi
lea eax, [ebp - 0x1250]
push eax
push dword [ebp + 0xc]
call fcn.0040a77b
test al, al
je 0x4093fe
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x1250]
push eax
call ebx
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x409452
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x409418
cmp eax, 3
je 0x409418
cmp eax, 0x12
je 0x409418
xor eax, eax
inc eax
jmp 0x40941a
xor eax, eax
mov byte [esi + 0x1044], al
jmp 0x40951d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409448
or dword [ebp + 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [esi + 0x1044], al
cmp dword [ebp + 8], 0xffffffff
je 0x40951d
push edi
push dword [ebp + 0xc]
push esi
call fcn.00410951
push edi
lea eax, [ebp - 0x224]
push eax
push esi
call fcn.0040a40a
push 1
push 0
push 0
push dword [ebp - 0x234]
call fcn.0041a940
mov ecx, dword [ebp - 0x230]
xor edi, edi
add eax, ecx
mov dword [esi + 0x1000], eax
mov eax, dword [ebp - 0x250]
mov dword [esi + 0x1008], eax
mov eax, dword [ebp - 0x24c]
mov dword [esi + 0x1028], eax
mov eax, dword [ebp - 0x248]
mov dword [esi + 0x102c], eax
mov eax, dword [ebp - 0x244]
mov dword [esi + 0x1030], eax
mov eax, dword [ebp - 0x240]
mov dword [esi + 0x1034], eax
mov eax, dword [ebp - 0x23c]
mov dword [esi + 0x1038], eax
mov eax, dword [ebp - 0x238]
mov dword [esi + 0x103c], eax
lea eax, [ebp - 0x23c]
adc edx, edi
push eax
lea ecx, [esi + 0x1010]
mov dword [esi + 0x1004], edx
call fcn.004110a4
lea eax, [ebp - 0x24c]
push eax
lea ecx, [esi + 0x1018]
call fcn.004110a4
lea eax, [ebp - 0x244]
push eax
lea ecx, [esi + 0x1020]
call fcn.004110a4
and dword [esi + 0x1040], 0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0xc