joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4028f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00402441
cmp eax, dword [eax + ebx]
and dword [ebp - 0x837b], ecx
call dword [eax - 0x18]
sbb al, 0xfb
invalid

Function at 0x40299c
Capabilities:
Inspect section memory permissions

Disassembly:
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.004023b2
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x40297e
call fcn.00402441
mov ah, 0x23
and al, 0x8b
jle 0x4029f9
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x402c30
add eax, esi
mov dword [ebp - 0x44], eax
inc dword [edi]

Function at 0x402c98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [edx - 0x3a]
test dword [esi + 0x46fffffc], esi
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00402451
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00402406
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
invalid
call dword [edx]
Function at 0x4046d0
Capabilities:
Inspect section memory permissions

Disassembly:
test ecx, ecx
je 0x404762
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x404710
cmp al, 0xb
je 0x404710
cmp al, 0xc
je 0x40471a
cmp al, 0xd
je 0x40472d
cmp al, 0xe
je 0x40474b
cmp al, 0xf
je 0x404710
cmp al, 0x11
je 0x404710
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.0040299c
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x404710
jmp 0x40475f
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x40471a
jmp 0x40475f
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004046d0
dec edi
jg 0x404730
pop ebp
jmp 0x40475f
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004046a0
dec edi
jg 0x40474e
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4047b0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp ecx, 0
je 0x404899
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x4047f3
cmp al, 0xb
je 0x404810
cmp al, 0xc
je 0x404827
cmp al, 0xd
je 0x404836
cmp al, 0xe
je 0x404854
cmp al, 0xf
je 0x40486a
cmp al, 0x11
je 0x404879
jmp 0x40488a
cmp ecx, 1
mov eax, ebx
jg 0x404804
call fcn.00403e10
jmp 0x404895
mov edx, ecx
call fcn.00403e34
jmp 0x404895
cmp ecx, 1
mov eax, ebx
jg 0x40481e
call fcn.00404414
jmp 0x404895
mov edx, ecx
call fcn.0040442c
jmp 0x404895
mov eax, ebx
add ebx, 0x10
call fcn.00404798
dec edi
jg 0x404827
jmp 0x404895
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004047b0
dec edi
jg 0x404839
pop ebp
jmp 0x404895
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404764
dec edi
jg 0x404857
pop ebp
jmp 0x404895
mov eax, ebx
add ebx, 4
call fcn.00405334
dec edi
jg 0x40486a
jmp 0x404895
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00404cc8
dec edi
jg 0x404879
jmp 0x404895
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.0040299c
pop edi
pop esi
pop ebx
pop eax
ret
Function at 0x4048b4
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [eax + ecx + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x4048e0
mov edx, eax
add eax, esi
add edx, ebx
call fcn.00402a30
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x40491f
cmp cl, 0xb
je 0x404930
cmp cl, 0xc
je 0x404941
cmp cl, 0xd
je 0x404952
cmp cl, 0xe
je 0x404972
cmp cl, 0xf
je 0x40498b
cmp cl, 0x11
je 0x40499c
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.0040299c
mov edx, dword [eax + esi]
add eax, ebx
call fcn.00403e64
mov eax, 4
jmp 0x4049ad
mov edx, dword [eax + esi]
add eax, ebx
call fcn.00404450
mov eax, 4
jmp 0x4049ad
lea edx, [eax + esi]
add eax, ebx
call fcn.0040489c
mov eax, 0x10
jmp 0x4049ad
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [ecx + edx + 2]
push dword [ecx + edx + 6]
mov ecx, dword [ecx + edx + 0xa]
mov ecx, dword [ecx]
lea edx, [eax + esi]
add eax, ebx
call fcn.004049d0
pop eax
jmp 0x4049ad
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [ecx + edx + 2]
push ecx
mov ecx, edx
lea edx, [eax + esi]
add eax, ebx
call fcn.004048b4
pop eax
jmp 0x4049ad
mov edx, dword [eax + esi]
add eax, ebx
call fcn.0040534c
mov eax, 4
jmp 0x4049ad
mov ecx, edx
mov edx, dword [eax + esi]
add eax, ebx
call fcn.00404d04
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x4048ce
pop ecx
sub ecx, eax
jle 0x4049c9
lea edx, [eax + ebx]
add eax, esi
call fcn.00402a30
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4049d0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x404a16
cmp cl, 0xb
je 0x404a2d
cmp cl, 0xc
je 0x404a41
cmp cl, 0xd
je 0x404a55
cmp cl, 0xe
je 0x404a76
cmp cl, 0xf
je 0x404a93
cmp cl, 0x11
je 0x404aa7
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.0040299c
mov eax, ebx
mov edx, dword [esi]
call fcn.00403e64
add ebx, 4
add esi, 4
dec ebp
jne 0x404a16
jmp 0x404abb
mov eax, ebx
mov edx, dword [esi]
call fcn.00404450
add ebx, 4
add esi, 4
dec ebp
jne 0x404a2d
jmp 0x404abb
mov eax, ebx
mov edx, esi
call fcn.0040489c
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x404a41
jmp 0x404abb
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [ecx + edi + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.004049d0
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x404a5e
jmp 0x404abb
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.004048b4
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [eax + edi + 2]
add esi, dword [eax + edi + 2]
dec ebp
jne 0x404a76
jmp 0x404abb
mov eax, ebx
mov edx, dword [esi]
call fcn.0040534c
add ebx, 4
add esi, 4
dec ebp
jne 0x404a93
jmp 0x404abb
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00404d04
add ebx, 4
add esi, 4
dec ebp
jne 0x404aa7
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x4053d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405436
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404074
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402d80
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405420
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40543d
lea eax, [ebp - 0x10]
call fcn.00403e10
ret

Function at 0x4089f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408a29
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f00
jmp 0x408a32
mov eax, ebx
mov edx, esi
call fcn.00403e64
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409dbc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x409e20
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404074
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00406818
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409e27
lea eax, [ebp - 0xc]
call fcn.00403e10
ret
Function at 0x40ad78
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe8c
mov ebx, eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
push 1
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov ebp, eax
push 0
lea eax, [esp + 0x14]
push eax
push 0x40
lea eax, [esp + 0x20]
push eax
push ebx
call sub.kernel32.dll_ReadFile
cmp word [esp + 0x14], 0x5a4d
je 0x40adde
push 0
push 0
push ebp
push ebx
call sub.kernel32.dll_SetFilePointer
mov dword [esp], 0
mov dword [esp + 4], 0
jmp 0x40ae8f
mov eax, dword [esp + 0x50]
push 0
push 0
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [esp + 0x14]
push eax
push 0xf8
lea eax, [esp + 0x60]
push eax
push ebx
call sub.kernel32.dll_ReadFile
cmp dword [esp + 0x54], 0x4550
je 0x40ae2a
push 0
push 0
push ebp
push ebx
call sub.kernel32.dll_SetFilePointer
mov dword [esp], 0
mov dword [esp + 4], 0
jmp 0x40ae8f
mov ax, word [esp + 0x5a]
xor edi, edi
movzx esi, ax
dec esi
test esi, esi
jl 0x40ae75
inc esi
push 0
lea eax, [esp + 0x14]
push eax
push 0x28
lea eax, [esp + 0x158]
push eax
push ebx
call sub.kernel32.dll_ReadFile
mov ecx, dword [esp + 0x15c]
mov eax, dword [esp + 0x160]
cmp edi, eax
jae 0x40ae72
mov edi, eax
lea eax, [ecx + edi]
xor edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
dec esi
jne 0x40ae3a
push 0
push 0
push ebp
push ebx
call sub.kernel32.dll_SetFilePointer
mov eax, dword [esp + 8]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0x174
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40b0bc
Capabilities:
Set current directory

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, 0x4117ac
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], 0x4117cc
mov eax, 0x40b118
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 1
xor eax, eax
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [esi + 0x18], eax
push esi
call sub.shell32.dll_SHBrowseForFolderA
mov dword [0x4118d4], eax
cmp dword [0x4118d4], 0
je 0x40b112
push ebx
mov eax, dword [0x4118d4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
push ebx
call sub.kernel32.dll_SetCurrentDirectoryA
pop esi
pop ebx
ret

Function at 0x40bab8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebx], eax
mov dword [ebp - 8], 0xffffffff
mov dx, 1
xor eax, eax
call fcn.0040ba64
mov eax, dword [0x4104a8]
mov eax, dword [eax]
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.0040ba64
mov eax, dword [ebp + 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadFile
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40bbdc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov eax, dword [0x4104c8]
cmp byte [eax], 0
je 0x40bbfe
mov eax, dword [0x410634]
xor edx, edx
mov dword [eax], edx
xor eax, eax
mov dword [0x411920], eax
or eax, 0xffffffff
pop esi
pop ebx
ret
mov eax, dword [0x410634]
cmp dword [eax], 0
jg 0x40bc17
xor eax, eax
mov dword [0x411920], eax
or eax, 0xffffffff
jmp 0x40bcd0
movzx eax, word [0x41191c]
cmp eax, dword [0x411920]
jb 0x40bc99
push 0x411920
push 0
mov eax, dword [0x410634]
mov eax, dword [eax]
mov edx, 0x8000
call fcn.0040ead4
mov ecx, eax
mov edx, dword [0x411914]
mov eax, dword [0x410458]
call fcn.0040bab8
mov eax, dword [0x410624]
mov ax, word [eax + 6]
and ax, 1
cmp ax, 1
jne 0x40bc90
mov esi, dword [0x411920]
dec esi
test esi, esi
jl 0x40bc90
inc esi
xor ebx, ebx
call fcn.0040d8ec
mov edx, dword [0x411914]
xor byte [edx + ebx], al
mov eax, dword [0x411914]
mov al, byte [eax + ebx]
call fcn.0040d818
inc ebx
dec esi
jne 0x40bc71
mov word [0x41191c], 0
cmp dword [0x411920], 0
jne 0x40bcb0
mov word [0x41191c], 0
or eax, 0xffffffff
jmp 0x40bcd0
movzx eax, word [0x41191c]
mov edx, dword [0x411914]
movzx eax, byte [edx + eax]
inc word [0x41191c]
mov edx, dword [0x410634]
dec dword [edx]
pop esi
pop ebx
ret
Function at 0x40d0f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40d15a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404074
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402d80
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40d144
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d161
lea eax, [ebp - 0x10]
call fcn.00403e10
ret

Function at 0x40d818
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, 0x411950
mov edx, dword [esi]
mov eax, ebx
call fcn.0040d7fc
mov edi, eax
mov dword [esi], edi
and edi, 0xff
add dword [esi + 4], edi
imul ebx, dword [esi + 4], 0x8088405
inc ebx
mov dword [esi + 4], ebx
mov eax, ebx
call fcn.00405904
call fcn.00405908
mov edx, dword [esi + 8]
call fcn.0040d7fc
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret
Function at 0x40143b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 0xc]
call fcn.00408f80
push dword [ebp + 0xc]
lea ecx, [esi + 0x10]
call fcn.00411391
push 0x5c
lea ecx, [esi + 0x10]
call fcn.004011ee
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x401333
push edi
push edi
mov dword [0x41e6c4], esi
mov dword [0x41e6cc], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x41e6c8], eax
cmp eax, edi
je 0x4014ae
cmp dword [0x41e730], 2
je 0x4014a0
call fcn.00408c7f
mov eax, dword [0x41e6c8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x41e6c8]
mov ecx, dword [0x41e6cc]
mov dword [0x41e7d0], edi
cmp ecx, edi
je 0x4014f4
cmp ecx, 1
je 0x4014e8
cmp ecx, 2
je 0x4014e4
cmp ecx, 3
je 0x4014e0
cmp ecx, 0x67
jle 0x4014db
cmp ecx, 0x6b
jle 0x40155d
push ecx
push 0x14
jmp 0x40152e
push 0x12
jmp 0x4014ea
push 0x13
jmp 0x4014ea
push 0x11
push edi
call fcn.00408e03
pop ecx
pop ecx
jmp 0x40155d
mov dword [ebp + 8], edi
cmp dword [0x41e7d8], edi
jne 0x40155d
cmp eax, edi
je 0x40151b
lea ecx, [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x40151b
cmp dword [ebp + 8], edi
jne 0x40151b
xor eax, eax
jmp 0x401562
mov ecx, dword [ebp + 8]
mov eax, 0x80070000
and ecx, eax
cmp ecx, eax
je 0x401531
push dword [ebp + 8]
push 0x21
push edi
jmp 0x401555
mov eax, dword [ebp + 8]
and eax, 0xffff
cmp eax, 0xe
jne 0x401547
cmp dword [0x41e734], 0xffffffff
je 0x40155d
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
push 0x22
push 1
call fcn.00408e03
add esp, 0xc
mov eax, 0x80004005
pop edi
pop esi
leave
ret 8

Function at 0x401d66
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401da7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xb7
cmp eax, esi
je 0x401d91
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401da7
test al, 0x10
jne 0x401da7
push esi
jmp 0x401d87
xor eax, eax
inc eax
pop esi
ret
Function at 0x402a0b
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.00411362
push 0x41a764
lea ecx, [ebp - 0xc]
call fcn.004113e9
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402ae7
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.00411391
push 0x5c
lea ecx, [ebp - 0xc]
call fcn.004011ee
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0xc]
call fcn.004113e9
test byte [ebp - 0x25c], 0x10
je 0x402ab2
push 0x41a760
lea eax, [ebp - 0x230]
push eax
call edi
test eax, eax
je 0x402aca
push 0x41a758
lea eax, [ebp - 0x230]
push eax
call edi
test eax, eax
je 0x402aca
push dword [ebp - 0xc]
call fcn.00402a0b
pop ecx
jmp 0x402ac6
push 0
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x402b18
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x402b18
lea eax, [ebp - 0x25c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402a56
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [0x41e760]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0
push dword [ebp + 8]
call esi
test eax, eax
je 0x402b18
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x402b18
push dword [ebp - 0xc]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
xor eax, eax
inc eax
jmp 0x402b22
push dword [ebp - 0xc]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402b28
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
cmp dword [0x41e7e4], 0
je 0x402b3f
xor eax, eax
inc eax
leave
ret
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x402b5b
xor eax, eax
inc eax
jmp 0x402b8c
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x250], 0x10
jne 0x402b85
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x402b81
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x402b8c
xor eax, eax
jmp 0x402b8c
push esi
call fcn.00402a0b
pop ecx
pop esi
leave
ret
Function at 0x40341e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea ecx, [ebp - 0x18]
mov esi, eax
mov dword [ebp - 4], eax
call fcn.00411362
push 0
lea ecx, [ebp - 0x18]
call fcn.00403001
mov edi, eax
movzx eax, word [ebx + esi*2 - 2]
cmp eax, 0x5c
je 0x40345a
cmp eax, 0x2f
jne 0x403488
xor eax, eax
mov word [edi + esi*2 - 2], ax
dec esi
mov dword [ebp - 4], esi
jmp 0x403488
movzx eax, word [edi + esi*2]
cmp eax, 0x2f
je 0x40347a
cmp eax, 0x5c
je 0x40347a
dec esi
test esi, esi
jg 0x403467
test esi, esi
je 0x40352c
xor eax, eax
mov word [edi + esi*2], ax
push edi
call fcn.00401d66
pop ecx
test eax, eax
je 0x403476
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x4034bf
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.00403117
pop ecx
pop ecx
test eax, eax
je 0x4034bf
xor esi, esi
jmp 0x40354f
push edi
call fcn.00401d66
pop ecx
test eax, eax
jne 0x403519
push edi
push 0xc
push 1
call fcn.00408e03
add esp, 0xc
jmp 0x4034b8
mov eax, dword [ebp - 4]
sub eax, esi
inc eax
push eax
mov eax, dword [ebp + 8]
lea eax, [eax + esi*2]
push eax
lea ebx, [edi + esi*2]
push ebx
call sub.MSVCRT.dll_memcpy
xor ecx, ecx
add esp, 0xc
cmp word [ebx], cx
je 0x40350b
jmp 0x40350a
movzx eax, word [edi + esi*2]
cmp eax, 0x5c
je 0x403511
cmp eax, 0x2f
je 0x403511
inc esi
cmp word [edi + esi*2], cx
jne 0x4034fc
xor eax, eax
mov word [edi + esi*2], ax
jmp 0x4034bf
cmp esi, dword [ebp - 4]
jl 0x4034d9
push dword [ebp - 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
xor eax, eax
pop ecx
inc eax
jmp 0x403573
cmp dword [ebp - 4], 2
jne 0x40355c
mov ax, word [ebx]
or ax, 0x20
cmp ax, 0x61
jb 0x40355c
cmp ax, 0x7a
ja 0x40355c
cmp word [ebx + 2], 0x3a
jne 0x40355c
xor esi, esi
inc esi
push dword [ebp - 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
jmp 0x403573
push ebx
push 0xc
push 1
call fcn.00408e03
push dword [ebp - 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403891
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.00410f2d
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
test esi, esi
jle 0x4038d0
lea eax, [esi + 1]
push eax
push eax
mov ecx, edi
call fcn.00403001
push eax
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [edi]
xor ecx, ecx
mov dword [edi + 4], esi
mov word [eax + esi*2], cx
mov eax, edi
pop edi
pop esi
ret