joyce8/EMBER2024-capa huggingface dataset:
Function at 0x568f54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0x78], ebp
je 0x56910d
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x90]
cmp eax, ebp
je 0x569086
mov ecx, dword [esi + 0x94]
sub ecx, eax
mov eax, dword [esp + 0x14]
sar ecx, 4
cmp eax, ecx
jae 0x569086
xor ebx, ebx
mov edx, dword [esi + 0x90]
mov eax, dword [esp + 0x10]
add eax, edx
mov ecx, dword [eax + 4]
cmp ecx, ebp
je 0x56906d
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
cmp ebx, edx
jae 0x56906d
mov eax, ecx
mov ecx, esi
mov edi, dword [eax + ebx*4]
push edi
call fcn.0056a1c0
mov ebp, eax
test ebp, ebp
je 0x569065
push ebp
mov ecx, esi
call fcn.0056b650
test eax, eax
je 0x569065
mov edx, dword [esi + 0x74]
cmp edi, edx
je 0x569065
mov eax, dword [esp + 0x10]
xor ecx, ecx
test ebx, ebx
sete cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x90]
add eax, ecx
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x569026
xor eax, eax
jmp 0x56902e
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
dec eax
xor ecx, ecx
cmp ebx, eax
lea eax, [edi + 1]
sete cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp eax, edx
sete cl
dec edi
mov dword [esp + 0x30], ecx
xor eax, eax
cmp edi, edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x18]
sete al
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x3c], eax
call fcn.0056c020
inc ebx
xor ebp, ebp
jmp 0x568fb7
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc ecx
add eax, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x568f90
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
call fcn.0056a4d0
test eax, eax
pop ebx
je 0x56910d
mov ecx, dword [esi + 0x74]
push ecx
mov ecx, esi
call fcn.0056a1c0
mov edi, eax
cmp edi, ebp
je 0x56910d
push edi
mov ecx, esi
call fcn.0056b650
test eax, eax
je 0x56910d
mov eax, 1
lea edx, [esi + 0x1f8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
call fcn.0056a710
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x20], eax
push ecx
mov ecx, esi
call fcn.0056a780
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push eax
call fcn.0056c020
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
Function at 0x5736b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5c6657
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], method.CMenu.virtual_0
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.005b2029
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.005b2029
mov edi, dword [0x5c86ac]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], method.CMenu.virtual_0
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [0x5c85f8]
lea ecx, [esp + 0xb0]
push ecx
call dword [0x5c81b4]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.005741d0
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x575510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c69a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.005750c0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00575140
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00575140
lea ecx, [esi + 0xc]
call fcn.005b3e42
lea ecx, [esi + 0x10]
call fcn.005b3e42
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.005766d0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.005766d0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.005766d0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.005b3eb7
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.005b3eb7
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x57a050
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x8a3d34]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x57a063
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x57a0a4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x8a3ddc]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x57a0d6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x57a0da
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x57a0cb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x57a0f8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x57a0fc
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x57a0ed
xor ecx, ecx
mov eax, 0x8a3d44
xor ebx, ebx
mov bl, byte [ecx + 0x8a3dec]
cmp byte [esp + ebx + 0x14], 0
je 0x57a127
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x8a3e04]
cmp byte [esp + ebx + 0x14], 0
je 0x57a13e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x57a10e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x57a097
lea edx, [esp + 0x84]
push edx
call fcn.0057a180
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x580d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x580d63
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x580d4a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5876f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c6e8e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00588010
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x7b39cc
call fcn.005b3bf8
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x587783
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005b3bf8
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x58777c
push 0
mov ecx, eax
call fcn.0057e890
mov dword [esi + 0xc], eax
jmp 0x587785
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x587785
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x92f8b0
Capabilities:
Encode data using base64

Disassembly:
jmp 0xdcbce0
lea eax, [esp + 0x60]
cmc
cmp edi, eax
jmp 0xdc75d5
jmp ebp
mov esp, edx
push edi
movzx edi, si
push esi
pushfd
mov esi, eax
mov edi, edx
cld
jmp 0xc7a4cd
rep movsb byte es:[edi], byte [esi]
test ecx, 0x3a9730c0
shld edi, ebx, 0x77
popfd
bswap edi
movzx esi, bx
movsx edi, sp
pop esi
not di
pop edi
jmp 0xad1872
jmp 0x993624
ja 0xad1872
mov eax, esp
ror dh, cl
stc
mov ecx, 0x40
bsf edx, esp
cwd
xor dl, 0xf5
lea edx, [edi - 0x80]
and edx, 0xfffffffc
test esi, 0x2b2e5738
sub edx, ecx
jmp 0xbf368c
cmp eax, 0x3f114db9
mov dword [edi + 8], ebx
mov dword [edi + 4], ecx
xor cx, bx
mov ecx, 0x63d50d84
mov dword [edi], edx
pop ebx
sub esi, 4
sal cx, 0xa
sar cx, 0x51
mov ecx, dword [esi]
clc
test esp, 0x439427b3
xor ecx, ebx
jmp 0xe09259
add byte [eax], al
add byte [ebx], dh
ret
push 0xe62edcff
call fcn.00acf72b
jge 0xdcbc73
push 0x3f
and dword [eax - 0x6d400dc8], esp
enter 0xffffffffffffb2ed, 0x29
cmp al, 0x78
shr byte [eax], 1
xchg esi, eax
xlatb
jnp 0xdcbcc4
lodsb al, byte [esi]
int1
mov cl, 0xc2
aam 0x19
pop esp
pop ebp
mov cl, 0x1b
mov edx, esp
mov byte [eax + 0xc096abc], 0x52
insd dword es:[edi], dx
pop ecx
xlatb
jne 0xdcbd08
jecxz 0xdcbcac
cli
pop edi
push ebp
cld
nop
mov al, byte [0x46d72b49]
ret 0x9043
dec ecx
clc
jmp 0x1023417
rol ecx, 2
dec ecx
rol ecx, 1
xor ebx, ecx
cmc
cmp al, dh
add ebp, ecx
jmp 0xcfa17a
Function at 0x931c10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x931d1c
test eax, eax
je 0x931d1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x94cfe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x931d03
lea edi, [eax + 4]
jmp 0x931c67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x931c7c
mov dword [ebp - 4], 2
jmp 0x931c9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x931c93
mov dword [ebp - 4], 1
jmp 0x931c9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x931d13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x931cd6
mov byte [ecx], 0x3d
jmp 0x931ce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x931ced
mov byte [ecx], 0x3d
jmp 0x931cf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x931c64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403d44
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
movsx eax, byte [esi]
push eax
call fcn.004032a7
test eax, eax
pop ecx
je 0x403da0
cmp byte [esi + 1], 0x3a
jne 0x403da0
cmp byte [esi + 2], 0x5c
jne 0x403da0
push 4
lea eax, [ebp - 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x403d88
cmp eax, 4
jne 0x403da0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403da0
and eax, 0x10
cmp al, 0x10
je 0x403da0
push 1
pop eax
jmp 0x403da2
xor eax, eax
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402000
Capabilities:
Terminate process

Disassembly:
push 0
push str.Info
push str.Message_Box_1
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
push 0
push str.Info
push str.Message_Box_2
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
push 0
push str.Info
push str.Message_Box_3
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
push 0
push str.Info
push str.Message_Box_4
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
push 0
push str.Info
push str.Message_Box_5
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
push 0
push str.Info
push str.Message_Box_6
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
push 0
push str.Info
push str.Message_Box_7
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4017b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
test eax, eax
jne 0x4017c0
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x4017e0
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
test eax, eax
jne 0x4017f0
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0x10
sete cl
mov eax, ecx
ret
Function at 0x407040
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx + 0xac]
test eax, eax
jne 0x40704f
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, 1
ret
Function at 0x40c410
Capabilities:
Check mutex on windows
Create or open mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x41c830
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x68]
call fcn.0040a000
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [0x425c98]
lea ecx, [esp + 0xc]
push eax
push 0x424528
push ecx
mov dword [esp + 0x28], 0
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
add esp, 0xc
push edx
push 1
push 0
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
push 0x424520
cmp eax, 0xb7
push 1
push 0
jne 0x40c4d7
call edi
mov edi, eax
call ebp
xor ecx, ecx
cmp eax, 0xb7
sete cl
push edi
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x40c4b2
push 2
mov ecx, esi
call sub.MFC42.DLL_CDialog::EndDialog
jmp 0x40c5b7
mov eax, dword [esi + 0x60]
test eax, eax
jne 0x40c4c9
mov ecx, dword [esi + 0x68]
call fcn.00406660
mov ecx, dword [esi + 0x68]
call fcn.00407040
push 2
mov ecx, esi
call sub.MFC42.DLL_CDialog::EndDialog
jmp 0x40c5b7
call edi
mov edi, eax
call ebp
xor edx, edx
cmp eax, 0xb7
sete dl
push edi
mov ebp, edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x60]
test eax, eax
jne 0x40c525
mov ecx, dword [esi + 0x68]
call fcn.00409d50
test al, al
jne 0x40c525
test ebp, ebp
jne 0x40c517
mov ecx, dword [esi + 0x68]
call fcn.00406660
mov ecx, dword [esi + 0x68]
call fcn.00407040
push 2
mov ecx, esi
call sub.MFC42.DLL_CDialog::EndDialog
jmp 0x40c5b7
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [0x425c98]
lea ecx, [esp + 0x10]
push eax
push 0x4244fc
push ecx
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov ecx, esi
push edx
call sub.MFC42.DLL_CWnd::SetWindowTextA
test ebp, ebp
jne 0x40c572
mov eax, dword [esi + 0x60]
test eax, eax
jne 0x40c572
mov ecx, dword [esi + 0x68]
call fcn.00406660
mov ecx, dword [esi + 0x68]
call fcn.00407040
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi + 0x20]
push 0
push 0x2710
push 0x415
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esi + 0x68]
mov edx, dword [ecx]
call dword [edx + 4]
test al, al
je 0x40c5b7
push 0
push 0x3e9
mov ecx, esi
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4131c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x41cd34
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 8]
call fcn.00415090
lea edi, [esi + 0x60]
mov dword [esp + 0x18], 0
mov ecx, edi
call fcn.004142d0
mov bl, 1
push 0xa
lea ecx, [esi + 0xac]
mov byte [esp + 0x1c], bl
call sub.MFC42.DLL_CPtrList::CPtrList
lea ecx, [esi + 0xcc]
mov byte [esp + 0x18], 2
call fcn.004150f0
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xf0], edi
mov dword [esi], 0x41f398
mov byte [esi + 5], bl
mov byte [esi + 6], bl
mov byte [esi + 4], bl
mov dword [esi + 0x30], 0x4136b0
mov dword [esi + 0x34], 0x4136e0
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x413940
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41cde0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
cmp byte [esi + 0xc8], 0xff
je 0x413984
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x4139a5
mov ecx, esi
call fcn.00413730
mov ecx, dword [esi + 0x50]
mov edx, dword [eax + 0x14]
cmp ecx, edx
je 0x4139a5
push 0xffffffffffffff9a
mov ecx, esi
call fcn.004133b0
mov ecx, esi
call fcn.00413730
cmp word [eax + 0xe], 8
jne 0x4139bc
lea edx, [esi + 0x10]
push edx
call fcn.004161c0
mov edi, dword [ebp + 8]
mov bl, 1
test edi, edi
je 0x413a2f
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call sub.MFC42.DLL_CTime::GetTickCount
mov eax, dword [eax]
lea ecx, [ebp + 8]
push ecx
mov ecx, esi
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x11c], 0
call fcn.00413730
mov ecx, eax
call fcn.00416040
mov edx, dword [eax]
lea eax, [ebp - 0x12c]
push eax
push edi
mov dword [ebp - 0x128], edx
call sub.MFC42.DLL_CFile::SetStatus
mov ecx, esi
call fcn.00413730
mov ecx, dword [eax + 0x2c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xcc]
call fcn.004157c0
lea ecx, [esi + 0x54]
mov byte [esi + 0xc8], 0
call fcn.00415c00
mov ecx, dword [ebp - 0xc]
pop edi
mov al, bl
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x413c90
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x41ce88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString_1
push 0x424110
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::TrimRight
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 8]
push ecx
push edx
call fcn.00413a80
mov ecx, dword [esp + 0x24]
mov eax, dword [eax]
push ecx
push eax
mov byte [esp + 0x24], 1
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 0x10
or esi, 0xffffffff
test eax, eax
je 0x413d12
mov edx, dword [esp + 0x1c]
push edx
call fcn.00413db0
add esp, 4
cmp eax, esi
sete al
test al, al
jne 0x413d12
xor bl, bl
jmp 0x413d14
mov bl, 1
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
test bl, bl
jne 0x413d8d
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.00413a80
mov eax, dword [eax]
mov byte [esp + 0x1c], 2
push eax
call fcn.00413c90
add esp, 0xc
lea ecx, [esp + 8]
test al, al
sete bl
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
test bl, bl
jne 0x413d6d
mov edx, dword [esp + 0x1c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x413d8d
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esi
call sub.MFC42.DLL_CString::CString
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esi
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x413db0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41cea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
lea ecx, [esp + 4]
call fcn.0041b29e
mov esi, dword [esp + 0x30]
push 0
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x413e36
push esi
call fcn.00413e80
add esp, 4
mov dword [esp + 0x28], 0xffffffff
test al, al
lea ecx, [esp + 4]
je 0x413e1f
call sub.MFC42.DLL_CFileFind::CFileFind
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
call sub.MFC42.DLL_CFileFind::CFileFind
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
lea ecx, [esp + 4]
call sub.MFC42.DLL_CFileFind::FindNextFileA
mov eax, dword [esp + 4]
push 0x10
lea ecx, [esp + 8]
call dword [eax + 0x40]
neg eax
sbb eax, eax
lea ecx, [esp + 4]
and al, 0xfe
mov dword [esp + 0x28], 0xffffffff
inc eax
mov esi, eax
call sub.MFC42.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret