joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42cc40
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x459ffb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
mov eax, dword [0x471df4]
push esi
push edi
xor esi, esi
mov dword [esp + 8], eax
push esi
lea ecx, [esp + 0x14]
push str.DeleteAFile_ENTRY_n
push ecx
mov dword [esp + 0x124], esi
call fcn.0043a4a0
add esp, 0xc
mov ecx, 0x475b68
call fcn.0042f5e0
lea edx, [esp + 0x10]
mov ecx, 0x475b68
push edx
call fcn.0042f820
mov edi, dword [esp + 0x120]
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push edi
call fcn.0044a442
call fcn.0042cb20
add esp, 4
test eax, eax
push edi
je 0x42cd44
lea ecx, [esp + 0xc]
call fcn.0044a511
lea ecx, [esp + 8]
call fcn.0044a88a
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x42cd37
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
lea eax, [esp + 0x14]
push str.FAILURE_:_FileName___s_n
push eax
call fcn.0043a4a0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x475b68
call fcn.0042f820
push esi
lea edx, [esp + 0x14]
push str.GetLastError_____d_n
push edx
call fcn.0043a4a0
add esp, 0xc
lea eax, [esp + 0x10]
mov ecx, 0x475b68
push eax
call fcn.0042f820
jmp 0x42cd6a
push edi
mov ecx, 0x475b48
call fcn.00449c01
jmp 0x42cd6a
lea ecx, [esp + 0x14]
push str.FAILURE__FILE_NOT_FOUND__:_FileName___s_n
push ecx
call fcn.0043a4a0
add esp, 0xc
lea edx, [esp + 0x10]
mov ecx, 0x475b68
push edx
call fcn.0042f820
mov esi, 2
push 0
lea eax, [esp + 0x14]
push str.DeleteAFile_EXIT_n
push eax
call fcn.0043a4a0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x475b68
call fcn.0042f820
mov ecx, 0x475b68
call fcn.0042f5f0
lea ecx, [esp + 8]
mov dword [esp + 0x118], 0xffffffff
call fcn.0044a3d4
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x114
ret
Function at 0x42cdd0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x45a028
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
push edi
lea eax, [esp + 0x24]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x20], 0
xor edi, edi
call fcn.0044a149
mov ebp, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push ebp
push 0x5c
mov byte [esp + 0x24], 1
call fcn.0044a85d
mov esi, eax
cmp esi, 0xffffffff
je 0x42cefd
test ebp, ebp
jne 0x42ce71
lea ecx, [esi + 1]
push ecx
push 0x5c
lea ecx, [esp + 0x14]
call fcn.0044a85d
cmp eax, 0xffffffff
jne 0x42ce71
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call fcn.0044a3d4
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0044a3d4
mov eax, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
lea edx, [esp + 0x28]
push esi
push edx
lea ecx, [esp + 0x14]
call fcn.004493ca
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call fcn.0044a4c1
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 1
call fcn.0044a3d4
lea ecx, [esp + 0xc]
call fcn.00449849
lea ecx, [esp + 0xc]
call fcn.004497fd
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x42cecf
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 1
jmp 0x42ced5
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc esi
lea edx, [esp + 0x24]
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0044a149
call fcn.0042cdd0
add esp, 8
test eax, eax
jne 0x42cef8
test edi, edi
je 0x42cefd
mov edi, 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call fcn.0044a3d4
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0044a3d4
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x14
ret
Function at 0x42cf30
Capabilities:
Copy file
Set file attributes

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
push ebp
push esi
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
xor esi, esi
call fcn.0044a442
call fcn.0042cb20
add esp, 4
test eax, eax
je 0x42d085
mov esi, dword [esp + 0x11c]
push esi
call fcn.0042cc40
add esp, 4
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.0044a442
call fcn.0042cdd0
add esp, 8
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
mov ebp, eax
je 0x42cfb8
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
push 0
lea eax, [esp + 0x18]
push str.CopyAFile_ENTRY_:_FAILURE_n
push eax
call fcn.0043a4a0
add esp, 0xc
mov ecx, 0x475b68
call fcn.0042f5e0
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x475b68
call fcn.0042f820
push ebx
lea edx, [esp + 0x18]
push str.Src_FileName___s_n
push edx
call fcn.0043a4a0
add esp, 0xc
lea eax, [esp + 0x14]
mov ecx, 0x475b68
push eax
call fcn.0042f820
push esi
lea ecx, [esp + 0x18]
push str.Dst_FileName___s_n
push ecx
call fcn.0043a4a0
add esp, 0xc
lea edx, [esp + 0x14]
mov ecx, 0x475b68
push edx
call fcn.0042f820
push ebp
lea eax, [esp + 0x18]
push str.GetLastError_____d_n
push eax
call fcn.0043a4a0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x475b68
call fcn.0042f820
push 0
lea edx, [esp + 0x18]
push str.CopyAFile_EXIT_n
push edx
call fcn.0043a4a0
add esp, 0xc
lea eax, [esp + 0x14]
mov ecx, 0x475b68
push eax
call fcn.0042f820
mov ecx, 0x475b68
call fcn.0042f5f0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x42d0a0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x45a053
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push edi
xor ebx, ebx
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x13c], ebx
rep stosd dword es:[edi], eax
mov eax, dword [0x471df4]
mov dword [esp + 8], eax
push ebx
push 2
mov byte [esp + 0x144], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x42d133
lea ecx, [esp + 8]
mov byte [esp + 0x13c], bl
call fcn.0044a3d4
lea ecx, [esp + 0x144]
mov dword [esp + 0x13c], edi
call fcn.0044a3d4
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
add esp, 0x138
ret
lea ecx, [esp + 0xc]
push esi
push ecx
push edi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x42d1b4
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea edx, [esp + 0x34]
lea ecx, [esp + 0xc]
push edx
call fcn.0044a511
lea ecx, [esp + 0xc]
call fcn.0044a88a
mov eax, dword [esp + 0x148]
cmp dword [eax - 8], ebx
je 0x42d194
push eax
lea ecx, [esp + 0x10]
call fcn.00449464
cmp eax, 0xffffffff
je 0x42d194
mov eax, dword [esp + 0x18]
push eax
push ebx
push 0x1f0fff
call esi
cmp eax, ebx
jne 0x42d1a5
lea ecx, [esp + 0x10]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x42d1ad
jmp 0x42d151
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, 1
jmp 0x42d1b6
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xc]
mov byte [esp + 0x140], bl
call fcn.0044a3d4
lea ecx, [esp + 0x148]
mov dword [esp + 0x140], 0xffffffff
call fcn.0044a3d4
mov ecx, dword [esp + 0x138]
mov eax, esi
pop esi
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x138
ret
Function at 0x42d200
Capabilities:
Delete file
Get common file path
Move file
Read .ini file

Disassembly:
sub esp, 0x600
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x42d22c
mov eax, dword [esp + 0x604]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0x600
ret
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.wininit.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x100
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x110]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x618]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 0xc]
lea eax, [esp + 0x20c]
push edx
push 0x400
push eax
push str.Rename
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
lea ecx, [esp + 0x10c]
push 0
push ecx
lea edx, [esp + eax + 0x214]
push str.NUL_s_c
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esp + 0x20c]
push eax
push ecx
push str.Rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
pop edi
pop esi
pop ebx
add esp, 0x600
ret

Function at 0x42d2f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45a078
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
lea ecx, [esp + 0xc]
xor esi, esi
call fcn.00439333
push str..
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], esi
call fcn.0044a442
push eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 8]
push eax
push ecx
mov byte [esp + 0x3c], 1
call fcn.0044a5b7
lea ecx, [esp + 8]
mov byte [esp + 0x30], 3
call fcn.0044a3d4
mov edx, dword [esp + 4]
push esi
push edx
lea ecx, [esp + 0x14]
call fcn.004393f6
test eax, eax
je 0x42d36a
lea ecx, [esp + 0xc]
mov esi, 1
call fcn.004393ac
lea ecx, [esp + 4]
mov byte [esp + 0x30], 0
call fcn.0044a3d4
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00439370
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x42dd30
Capabilities:
Delete file

Disassembly:
sub esp, 0x7c
lea eax, [esp + 4]
push ebx
mov dword [esp + 4], ecx
push eax
mov ecx, dword [esp + 0x88]
push 2
push 0
push ecx
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42de2a
mov eax, dword [esp + 0x88]
push edi
lea edx, [esp + 0x10]
xor edi, edi
push edx
push edi
push eax
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineA]
test eax, eax
je 0x42de22
push ebp
mov ebp, dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldA]
push esi
push 0
lea ecx, [esp + 0x2c]
push 0x64
push ecx
lea edx, [esp + 0x24]
push 0
push edx
call ebp
test eax, eax
je 0x42de08
mov esi, str.DelReg
lea eax, [esp + 0x28]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x42ddc5
test cl, cl
je 0x42ddc1
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x42ddc5
add eax, 2
add esi, 2
test cl, cl
jne 0x42dda1
xor eax, eax
jmp 0x42ddca
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42de08
push eax
lea eax, [esp + 0x2c]
inc edi
push 0x64
push eax
lea ecx, [esp + 0x24]
push edi
push ecx
call ebp
test eax, eax
je 0x42de08
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
push ebx
call fcn.0042dc70
push 0
lea eax, [esp + 0x2c]
inc edi
push 0x64
push eax
lea ecx, [esp + 0x24]
push edi
push ecx
call ebp
test eax, eax
jne 0x42dde3
lea edx, [esp + 0x18]
lea eax, [esp + 0x18]
push edx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupFindNextLine]
test eax, eax
jne 0x42dd82
pop esi
pop ebp
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
pop edi
mov ecx, dword [esp + 0x84]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ebx
add esp, 0x7c
ret 8
Function at 0x42e080
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x45a1f1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x408
push ebx
mov ebx, dword [esp + 0x420]
push ebp
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x428]
mov dword [esp + 0x1c], 0
not ecx
dec ecx
push eax
mov ebp, ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], 0x3e8
call fcn.0044a442
mov esi, eax
push str.SYSTEMCurrentControlSetServices_
lea ecx, [esp + 0x2c]
mov dword [esp + 0x424], 0
call fcn.0044a442
push esi
lea ecx, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x42c], 1
call fcn.0044a5b7
lea ecx, [esp + 0x28]
mov byte [esp + 0x420], 4
call fcn.0044a3d4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x420], 3
call fcn.0044a3d4
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push 0x20019
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e204
lea ecx, [esp + 0x14]
lea edx, [esp + 0x30]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x28]
push str.ImagePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42e1f9
mov eax, dword [esp + 0x14]
xor esi, esi
test eax, eax
mov dword [esp + 0x24], esi
jbe 0x42e1f9
mov cl, byte [esp + esi + 0x30]
mov dl, byte [ebx]
lea edi, [esp + esi + 0x30]
mov byte [esp + 0x12], cl
lea eax, [esp + 0x13]
push 1
lea ecx, [esp + 0x16]
push eax
push ecx
mov byte [esp + 0x1f], dl
call fcn.004476d0
add esp, 0xc
test eax, eax
jne 0x42e1e2
mov esi, 1
cmp ebp, esi
jbe 0x42e1da
mov dl, byte [edi + esi]
lea ecx, [esp + 0x13]
mov byte [esp + 0x12], dl
mov al, byte [esi + ebx]
push 1
lea edx, [esp + 0x16]
push ecx
push edx
mov byte [esp + 0x1f], al
call fcn.004476d0
add esp, 0xc
test eax, eax
jne 0x42e1da
inc esi
cmp esi, ebp
jb 0x42e1af
cmp esi, ebp
je 0x42e1f1
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
inc esi
cmp esi, eax
mov dword [esp + 0x24], esi
jb 0x42e17c
jmp 0x42e1f9
mov dword [esp + 0x1c], 1
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x20]
mov dword [esp + 0x420], 0xffffffff
call fcn.0044a3d4
mov ecx, dword [esp + 0x418]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x414
ret 8
Function at 0x42e3b0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x45a237
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
mov eax, dword [0x471df4]
mov dword [esp + 0x10], ecx
xor ecx, ecx
push esi
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp + 0x168], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x170]
mov byte [esp + 0x168], 1
mov esi, dword [eax + 4]
cmp esi, ecx
je 0x42e545
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push edi
mov bl, 2
mov eax, esi
mov esi, dword [esi]
add eax, 8
lea ecx, [esp + 0x14]
push eax
call fcn.0044a4c1
push str..EXE
lea ecx, [esp + 0x2c]
call fcn.0044a442
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov byte [esp + 0x180], bl
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x178], 3
call fcn.0044a4c1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], bl
call fcn.0044a3d4
lea ecx, [esp + 0x28]
mov byte [esp + 0x174], 1
call fcn.0044a3d4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x2c]
push eax
push ecx
call ebp
mov edi, eax
cmp edi, 0xffffffff
je 0x42e53a
lea edx, [esp + 0x58]
lea ecx, [esp + 0x10]
push edx
call fcn.0044a511
lea ecx, [esp + 0x10]
call fcn.0044a88a
push 0x46d7d8
lea ecx, [esp + 0x14]
call fcn.00449464
test eax, eax
je 0x42e4f1
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x42e533
lea ecx, [esp + 0x58]
push ecx
lea ecx, [esp + 0x14]
call fcn.0044a511
lea ecx, [esp + 0x10]
call fcn.0044a88a
push 0x46d7d8
lea ecx, [esp + 0x14]
call fcn.00449464
test eax, eax
jne 0x42e4b8
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.0044a5b7
mov edx, dword [esp + 0x20]
push eax
mov byte [esp + 0x178], 4
lea ecx, [edx + 8]
call fcn.0044a4c1
lea ecx, [esp + 0x24]
mov byte [esp + 0x174], 1
call fcn.0044a3d4
mov dword [esp + 0x18], 1
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
jne 0x42e40f
pop edi
pop ebp
pop ebx
lea ecx, [esp + 8]
mov byte [esp + 0x168], 0
call fcn.0044a3d4
lea ecx, [esp + 4]
mov dword [esp + 0x168], 0xffffffff
call fcn.0044a3d4
mov ecx, dword [esp + 0x160]
mov eax, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x168
ret 4
Function at 0x42e8a0
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x45a27b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x208
push esi
push 0
lea eax, [esp + 0x10]
push str.DeleteAllFileAndDirectory_entry__n
push eax
call fcn.0043a4a0
add esp, 0xc
mov ecx, 0x475b68
call fcn.0042f5e0
lea ecx, [esp + 0xc]
push ecx
mov ecx, 0x475b68
call fcn.0042f820
mov edx, dword [0x471df4]
mov dword [esp + 4], edx
mov esi, dword [esp + 0x21c]
push 0x80
push esi
mov dword [esp + 0x21c], 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x42e937
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x42e937
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push esi
call fcn.0044a442
call fcn.0042cb60
add esp, 8
push 0
lea eax, [esp + 0x110]
push str.DeleteAllFileAndDirectory_exit__n
push eax
call fcn.0043a4a0
add esp, 0xc
lea ecx, [esp + 0x10c]
push ecx
mov ecx, 0x475b68
call fcn.0042f820
mov ecx, 0x475b68
call fcn.0042f5f0
lea ecx, [esp + 4]
mov dword [esp + 0x214], 0xffffffff
call fcn.0044a3d4
mov ecx, dword [esp + 0x20c]
pop esi
mov dword fs:[0], ecx
add esp, 0x214
ret
Function at 0x42e9a0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x78
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0x28]
push str.push_me_x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
test esi, esi
mov dword [esp + 4], esi
je 0x42eb3b
push ebp
mov ebp, dword [esp + 0x84]
push edi
push 0
mov eax, dword [ebp]
push 0x4000000
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x42eb30
mov edx, dword [ebp]
mov ecx, dword [esp + 0x8c]
push ebx
mov eax, dword [edx - 8]
mov edx, dword [ecx]
mov ecx, dword [edx - 8]
lea eax, [ecx + eax + 0x1c]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x42eb14
mov eax, dword [esp + 0x94]
lea edx, [esp + 0x18]
test eax, eax
mov edi, 0x46d810
jne 0x42ea52
mov edi, 0x46d890
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x90]
mov edx, dword [ecx]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp]
push eax
push ecx
push str._s_0x_X__s__s
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x5c]
add esp, 0x18
rep stosd dword es:[edi], eax
lea edx, [esp + 0x20]
lea eax, [esp + 0x44]
push edx
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push ebx
push 0
mov dword [esp + 0x6c], 0x44
mov dword [esp + 0x98], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov esi, eax
call edi
mov edx, dword [esp + 0x20]
push edx
call edi
test esi, esi
je 0x42eb1a
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov esi, dword [esp + 0x10]
pop ebx
push esi
call edi
pop edi
pop ebp
pop esi
add esp, 0x78
ret
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov esi, dword [esp + 0x10]
pop ebx
push esi
call edi
pop edi
pop ebp
pop esi
add esp, 0x78
ret
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
pop edi
pop ebp
pop esi
add esp, 0x78
ret
Function at 0x42eb40
Capabilities:
Copy file
Delete file
Get common file path
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x45a2bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
mov eax, dword [0x471df4]
push esi
mov dword [esp + 8], eax
lea ecx, [esp + 0x14]
push 0x104
push ecx
push 0
mov dword [esp + 0x230], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x14]
lea ecx, [esp + 8]
push edx
call fcn.0044a511
lea eax, [esp + 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.KUIU.EXE
lea ecx, [esp + 0x14]
call fcn.0044a442
mov esi, eax
lea ecx, [esp + 0x118]
mov byte [esp + 0x224], 1
push ecx
lea ecx, [esp + 0x10]
call fcn.0044a442
push esi
lea edx, [esp + 8]
push eax
push edx
mov byte [esp + 0x230], 2
call fcn.0044a5b7
lea ecx, [esp + 0xc]
mov byte [esp + 0x224], 5
call fcn.0044a3d4
lea ecx, [esp + 0x10]
mov byte [esp + 0x224], 4
call fcn.0044a3d4
mov eax, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push eax
call esi
test eax, eax
je 0x42ec23
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [esp + 4]
push 0x80
push ecx
call esi
mov edx, dword [esp + 0x22c]
lea eax, [esp + 8]
push edx
lea ecx, [esp + 8]
push eax
push ecx
call fcn.0042e9a0
add esp, 0xc
lea ecx, [esp + 4]
mov byte [esp + 0x224], 0
call fcn.0044a3d4
lea ecx, [esp + 8]
mov dword [esp + 0x224], 0xffffffff
call fcn.0044a3d4
mov ecx, dword [esp + 0x21c]
pop esi
mov dword fs:[0], ecx
add esp, 0x224
ret
Function at 0x42eca0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x45a325
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebp
mov eax, dword [0x471df4]
mov dword [esp + 0x164], 0
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp + 0x16c]
push str..
lea ecx, [esp + 0x10]
push eax
push ecx
mov byte [esp + 0x170], 2
call fcn.0044a61d
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x168], 3
call fcn.0044a4c1
lea ecx, [esp + 0xc]
mov byte [esp + 0x164], 2
call fcn.0044a3d4
mov eax, dword [esp + 8]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x42ee1e
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov bl, 6
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x24]
call fcn.0044a442
mov esi, eax
push 0x46a404
lea ecx, [esp + 0x28]
mov byte [esp + 0x174], 4
call fcn.0044a442
push eax
lea edx, [esp + 0x17c]
lea eax, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x17c], 5
call fcn.0044a5b7
push esi
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x17c], bl
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 7
call fcn.0044a4c1
lea ecx, [esp + 0x18]
mov byte [esp + 0x170], bl
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x170], 5
call fcn.0044a3d4
lea ecx, [esp + 0x24]
mov byte [esp + 0x170], 4
call fcn.0044a3d4
lea ecx, [esp + 0x20]
mov byte [esp + 0x170], 2
call fcn.0044a3d4
mov edx, dword [esp + 0x10]
push 0x80
push edx
call edi
test eax, eax
je 0x42ee00
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x28]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42ed3c
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov edx, dword [esp + 0x16c]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 8]
mov byte [esp + 0x164], 1
call fcn.0044a3d4
lea ecx, [esp + 4]
mov byte [esp + 0x164], 0
call fcn.0044a3d4
lea ecx, [esp + 0x16c]
mov dword [esp + 0x164], 0xffffffff
call fcn.0044a3d4
mov ecx, dword [esp + 0x15c]
pop ebp
mov dword fs:[0], ecx
add esp, 0x164
ret