joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409b3b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push ecx
mov dword [ebp - 0xc], esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
cmp byte [0x449050], 0
pop ecx
mov dword [ebp - 4], eax
jne 0x41c0b4
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov ecx, 0x2000
cmp esi, ecx
ja 0x41c0c7
test esi, esi
je 0x409bb1
push eax
push eax
push ecx
push 0x43a7f0
push 0xffffffffffffffff
push ebx
push eax
push dword [0x4325a0]
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
push 0
push edi
lea esi, [eax - 1]
push esi
push 0x43a7f0
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x409bc0
cmp dword [edi], esi
jne 0x409bc0
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x409bb9
push 0
push dword [ebp + 0xc]
push esi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
jmp 0x409bba
push eax
push eax
push ecx
push 0x43a7f0
push 0x1000
push ebx
push eax
push dword [0x4325a0]
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
push 0
push edi
push eax
push 0x43a7f0
push dword [ebp - 4]
mov ecx, 0x2000
mov dword [ebp - 8], eax
add ebx, ecx
sub esi, ecx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x409bc0
mov eax, dword [ebp - 8]
cmp dword [edi], eax
jne 0x409bc0
push 0
pop eax
jmp 0x409b6b
Function at 0x40a976
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
mov byte [0x4365c6], bl
push esi
test edx, edx
je 0x40a9a2
mov esi, edx
push edi
lea edi, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x40a98c
sub esi, edi
sar esi, 1
neg esi
pop edi
sbb esi, esi
and edx, esi
push edx
push ecx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
push dword [0x432594]
mov esi, eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
call fcn.0040a9d4
mov dword [0x432594], eax
xor eax, eax
test esi, esi
pop esi
sete al
pop ebx
ret

Function at 0x40a9d4
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentStringsW]
mov esi, eax
xor edi, edi
test esi, esi
je 0x40aa19
push ebx
mov ecx, esi
call fcn.0040aa20
mov ebx, eax
push ebx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40aa11
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x40ad26
Capabilities:
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
je 0x40ad40
cmp dword [0x436748], 0
je 0x40ad45
pop edi
pop esi
pop ebx
leave
ret
cmp dword [0x436758], 0
jne 0x40ad40
jmp 0x41cb71
mov ecx, 0x20c
call fcn.0040dcd0
mov edi, eax
test edi, edi
je 0x40ad40
push 0x104
push edi
call dword [sym.imp.api_ms_win_core_console_l2_2_0.dll_GetConsoleTitleW]
mov edx, eax
test edx, edx
je 0x40ad40
and dword [ebp - 8], 0
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x41cba4
mov eax, dword [0x436718]
sub ecx, esi
sar ecx, 1
add edx, 0xa
add eax, ecx
mov ecx, edi
add eax, edx
mov dword [ebp - 4], eax
lea edx, [eax + eax]
call fcn.0040dd20
mov esi, eax
test esi, esi
je 0x41cc33
cmp byte [0x43675c], 0
mov edi, esi
mov edx, dword [ebp - 4]
je 0x41cbf3
mov eax, dword [0x436718]
sub edx, eax
push ebx
lea ecx, [esi + eax*2]
call fcn.0040f3a0
jmp 0x41cc2c
push 0x403f8c
mov ecx, esi
call fcn.0040fc40
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x41cc04
sub ecx, edx
mov edx, dword [ebp - 4]
sar ecx, 1
mov dword [0x436718], ecx
mov ecx, esi
push ebx
call fcn.0040fc40
mov byte [0x43675c], 1
push esi
call dword [sym.imp.api_ms_win_core_console_l2_2_0.dll_SetConsoleTitleW]
mov ecx, edi
call fcn.0040dc60
jmp 0x40ad40
Function at 0x40ec2e
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov ebx, 0x2000
mov edi, 0x42e590
push ebx
mov esi, ecx
xor eax, eax
push edi
push esi
mov word [0x42e590], ax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40ec64
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x436755], 0
je 0x40ed1d
push 0x402394
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ed61
push 0x40239c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ed47
push 0x4023d8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ed7f
push 0x4023c0
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41ddef
push 0x4023b4
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ed71
push 0x4023f4
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ed24
push 0x4024ac
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41ddfa
push 0x402480
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41de06
xor eax, eax
jmp 0x40ec5d
push ebx
xor edx, edx
xor ecx, ecx
push edi
inc edx
call fcn.00409310
add eax, eax
cmp eax, 0x4000
jae 0x40ed83
xor ecx, ecx
mov word [eax + 0x42e590], cx
jmp 0x40ec5b
push dword [0x4365dc]
push 0x402050
push ebx
push edi
call fcn.00409abf
add esp, 0x10
jmp 0x40ec5b
push 0
mov edx, ebx
mov ecx, edi
call fcn.00408e9e
jmp 0x40ec5b
push ebx
xor edx, edx
xor ecx, ecx
push edi
inc edx
call fcn.00406854
jmp 0x40ed30
push 2
jmp 0x40ed4d
call fcn.00416c78
int3
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
jmp 0x40ec5d
call dword [sym.imp.msvcrt.dll_rand]
push eax
jmp 0x40ed4d
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaHighestNodeNumber]
push dword [esp + 0xc]
jmp 0x40ed4d
Function at 0x4100e9
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x42e0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x104
mov byte [ebp - 0xc], 1
xor ebx, ebx
mov dword [ebp - 8], esi
push esi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x10], ebx
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x218]
add esp, 0xc
cmp byte [ebp - 0xc], al
sete al
dec eax
and eax, 0x7ee3
add eax, esi
push eax
call fcn.0040e3f0
test eax, eax
js 0x41e615
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41e627
push dword [ebp - 8]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
mov esi, 0x402500
mov ecx, esi
call fcn.0040ec2e
test eax, eax
je 0x41e632
mov esi, 0x4024f0
mov ecx, esi
call fcn.0040ec2e
test eax, eax
je 0x41e643
mov esi, 0x4024e0
mov ecx, esi
call fcn.0040ec2e
test eax, eax
je 0x41e654
mov ecx, 0x4024d0
call fcn.0040ec2e
test eax, eax
je 0x41e665
mov ecx, 0x4024c4
call fcn.0040ec2e
test eax, eax
jne 0x41e714
mov ecx, dword [0x448df8]
test ecx, ecx
je 0x4101ee
xor edx, edx
inc edx
call fcn.00408bc7
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], ebx
pop esi
pop ebx
test eax, eax
je 0x4101e2
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416b30
leave
ret
mov ecx, 0x448bf0
jmp 0x4101c6
push ebx
call fcn.00411e70
test eax, eax
je 0x41e615
push 1
call dword [sym.imp.msvcrt.dll_exit]
lea eax, [ebp - 0x218]
jmp 0x410151
mov edx, 0x4020b8
mov ecx, esi
call fcn.0040a976
jmp 0x410170
mov edx, 0x403ad0
mov ecx, esi
call fcn.0040a976
jmp 0x410184
mov edx, 0x403ce4
mov ecx, esi
call fcn.0040a976
jmp 0x410198
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x41e672
lea ecx, [ebp - 0x218]
push 0x2e
pop edx
call fcn.0040a62f
test eax, eax
jne 0x41e6f8
push 0x403b1e
call dword [sym.imp.msvcrt.dll__wcsupr]
pop ecx
mov ecx, dword [ebp - 0x10]
mov esi, ecx
test ecx, ecx
jne 0x41e699
lea esi, [ebp - 0x218]
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x41e69c
sub esi, edx
sar esi, 1
push edi
mov edi, ecx
test ecx, ecx
jne 0x41e6ba
lea edi, [ebp - 0x218]
mov ecx, edi
push 0x5c
pop edx
call fcn.004101f5
lea ecx, [edi - 2]
lea ecx, [ecx + esi*2]
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
pop edi
je 0x41e6e1
test ecx, ecx
jne 0x41e6da
lea ecx, [ebp - 0x218]
push 0x403b1c
jmp 0x41e6f0
test ecx, ecx
jne 0x41e6eb
lea ecx, [ebp - 0x218]
push 0x403b1e
mov edx, dword [ebp - 8]
call fcn.0040fc40
mov edx, dword [ebp - 0x10]
test edx, edx
jne 0x41e705
lea edx, [ebp - 0x218]
mov ecx, 0x4024d0
call fcn.0040a976
jmp 0x4101aa
push 0x403cf0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4101bc
mov dword [0x449518], 1
jmp 0x4101bc
Function at 0x410b12
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x42e0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3a
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], cx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.00416b30
leave
ret
Function at 0x4123f0
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x42e0b4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x230], 0
mov eax, 0x104
push ebx
push esi
push edi
push eax
mov dword [ebp - 0x228], eax
xor ebx, ebx
lea eax, [ebp - 0x438]
inc ebx
push 0
push eax
mov esi, edx
mov byte [ebp - 0x22c], bl
mov edi, ecx
call sub.msvcrt.dll_memset
and dword [ebp - 0x18], 0
add esp, 0xc
mov eax, 0x104
mov byte [ebp - 0x14], bl
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0x220]
push 0
push eax
call sub.msvcrt.dll_memset
and dword [ebp - 0x448], 0
add esp, 0xc
mov eax, 0x104
mov byte [ebp - 0x444], bl
mov dword [ebp - 0x440], eax
push eax
lea eax, [ebp - 0x650]
push 0
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x438]
add esp, 0xc
cmp byte [ebp - 0x22c], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.0040e3f0
test eax, eax
js 0x41f316
xor eax, eax
lea ecx, [ebp - 0x220]
cmp byte [ebp - 0x14], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.0040e3f0
test eax, eax
js 0x41f316
xor eax, eax
lea ecx, [ebp - 0x220]
cmp byte [ebp - 0x14], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.0040e3f0
test eax, eax
js 0x41f316
and dword [0x4367a8], 0
mov eax, dword [ebp - 0x448]
test eax, eax
jne 0x412513
lea eax, [ebp - 0x650]
push dword [ebp - 0x440]
mov edx, esi
mov ecx, edi
push eax
call fcn.00407d65
test al, al
je 0x4125af
mov eax, dword [ebp - 0x448]
test eax, eax
jne 0x41253b
lea eax, [ebp - 0x650]
push eax
lea ecx, [ebp - 0x220]
call fcn.0040a641
push 0x40250c
lea ecx, [ebp - 0x220]
call fcn.0041232c
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x41f2e3
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41f2ee
push dword [ebp - 0x228]
xor edx, edx
push ecx
push edx
lea ecx, [ebp - 0x654]
push ecx
push edx
push edx
push edx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
test eax, eax
je 0x41f2f9
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x4125fb
push 0x4025c8
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x412603
xor bl, bl
cmp dword [ebp - 0x448], 0
jne 0x41f325
mov eax, dword [ebp - 0x18]
and dword [ebp - 0x18], 0
test eax, eax
je 0x4125d1
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [ebp - 0x230]
and dword [ebp - 0x230], 0
test eax, eax
je 0x4125ea
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416b30
leave
ret
lea eax, [ebp - 0x438]
jmp 0x41259d
cmp dword [ebp - 0x654], 0xc
je 0x4125b1
jmp 0x4125af
lea ecx, [ebp - 0x438]
jmp 0x412565
lea eax, [ebp - 0x220]
jmp 0x412570
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea ecx, [eax - 0x90]
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [0x4367a8], ecx
jmp 0x4125af
mov dword [0x4367a8], 8
jmp 0x4125af
push dword [ebp - 0x448]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
jmp 0x4125be
Function at 0x414759
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
test edx, 0x400
jne 0x42096e
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U_WithStatus]
test eax, eax
js 0x42096e
cmp word [ebp - 0x24], di
ja 0x420954
mov eax, edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x1c], eax
push 0x5040
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x14]
push 4
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x18
push eax
push 0x10000
lea eax, [ebp - 4]
mov dword [ebp - 0x30], 0x40
push eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test esi, esi
js 0x42096e
mov ecx, dword [ebp - 4]
call fcn.00414823
test eax, eax
jne 0x42095f
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test esi, esi
je 0x42096e
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x24]
jmp 0x4147a2
mov ecx, dword [ebp - 4]
call fcn.0042a135
mov esi, eax
jmp 0x41480b
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x41481c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x41481c
Function at 0x414c40
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0x1a
mov edi, ecx
mov ecx, dword [edx + 0x20]
pop eax
mov word [ebp - 4], ax
test ecx, ecx
je 0x414c71
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
jne 0x420b5d
inc dword [0x436714]
pop edi
pop esi
leave
ret 8
mov ecx, edx
jmp 0x414c59
call fcn.00428b41
test eax, eax
je 0x420b8b
mov ecx, esi
call fcn.0040dd98
test eax, eax
jne 0x420b8b
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test edi, edi
je 0x420bcb
test byte [edi + 0x1c], 0x80
jne 0x420bcb
mov ecx, esi
call fcn.0040dd98
test eax, eax
jne 0x420bcb
mov eax, dword [0x436704]
cmp eax, 3
je 0x420bcb
cmp dword [ebp + 0xc], 0
je 0x420bcb
cmp eax, 2
je 0x420bcb
push dword [ebp + 0xc]
push 0
push 0
push esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileTime]
mov ecx, esi
call fcn.0040a16c
jmp 0x414c65

Function at 0x414ca0
Capabilities:
Delete file
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push eax
push edi
push dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, ecx
mov dword [0x4367a0], eax
push ebx
push esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
je 0x420c48
mov ecx, dword [edi]
test ecx, ecx
je 0x420bfc
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 0x1c]
test eax, 0xc000
je 0x414d08
mov ecx, 0x8002
and eax, ecx
cmp eax, ecx
je 0x420c20
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x14
cmp ecx, 2
jb 0x414d17
mov ecx, 0xfeff
cmp word [ebx], cx
je 0x414d21
or eax, 0x8000
mov dword [edx + 0x1c], eax
jmp 0x414cef
or eax, 0x4000
jmp 0x414d1c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x3e3
je 0x420c48
mov ecx, dword [edi]
test ecx, ecx
jne 0x414ce2
and dword [0x4367a8], ecx
xor eax, eax
jmp 0x414d01
mov esi, dword [edi]
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov edx, ebx
push edi
inc ecx
call fcn.004273dd
cmp esi, dword [edi]
je 0x414cfe
mov dword [0x4367a0], 1
jmp 0x414cfe
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, esi
mov dword [0x4367a8], eax
call fcn.0040a16c
mov ecx, dword [ebp + 0x14]
call fcn.0040dd98
mov ecx, dword [ebp + 0x14]
test eax, eax
jne 0x420c79
call fcn.0040a16c
push dword [ebp + 0x18]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
jmp 0x420c7e
call fcn.0040a16c
mov ecx, dword [0x4367a8]
xor edx, edx
inc edx
call fcn.00428c50
int3
Function at 0x415271
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x42e0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x10]
mov edi, ecx
push eax
lea eax, [ebp - 0xc]
xor esi, esi
push eax
push 4
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
cmp eax, 3
je 0x421019
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_RemoveDirectoryW]
test eax, eax
je 0x421036
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00416b30
leave
ret
cmp word [ebp - 0xa], 0x3a
jne 0x4152a3
cmp word [ebp - 8], 0x5c
jne 0x4152a3
xor eax, eax
jmp 0x4152b4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
cmp esi, 5
jne 0x4152b2
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4152b2
test al, 1
je 0x4152b2
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
test eax, eax
je 0x4152b2
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_RemoveDirectoryW]
test eax, eax
je 0x421084
xor esi, esi
jmp 0x4152b2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
jmp 0x4152b2
Function at 0x41589a
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 2
push 0
xor eax, eax
mov dword [ebp - 4], ecx
push 0
push dword [ebp + 0x10]
xor bl, bl
cmp dword [ebp + 0xc], eax
sete al
push eax
push edx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileExW]
mov esi, dword [ebp + 0x14]
mov edi, eax
mov dword [esi], edi
cmp edi, 0xffffffff
jne 0x4158e1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x4367a8], eax
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x10
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
cmp eax, fcn.004159d0
jne 0x4159a0
call fcn.004159d0
test eax, eax
je 0x41598b
and dword [0x4367a8], 0
mov bl, 1
cmp edi, 0xffffffff
je 0x41593a
mov ecx, dword [0x4367b8]
test ecx, ecx
je 0x415940
mov edx, dword [0x4367bc]
cmp edx, dword [0x4367c0]
jge 0x415961
test ecx, ecx
je 0x415938
mov eax, dword [esi]
mov dword [ecx + edx*4], eax
inc edx
mov dword [0x4367bc], edx
mov bl, 1
test bl, bl
jne 0x4158d8
jmp 0x4158cd
push 0x14
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov edx, dword [0x4367bc]
mov dword [0x4367b8], ecx
jmp 0x415928
lea eax, [edx*4 + 4]
push eax
push ecx
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
mov ecx, eax
test ecx, ecx
je 0x42160b
inc dword [0x4367c0]
jmp 0x415953
push dword [ebp + 0x10]
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
je 0x4159b4
mov edi, dword [esi]
jmp 0x4158c8
mov ecx, eax
call dword [0x44a4c4]
mov ecx, dword [ebp - 4]
call ecx
mov edi, dword [esi]
jmp 0x4158fa
push dword [esi]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
or dword [esi], 0xffffffff
or edi, 0xffffffff
jmp 0x41590b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push dword [esi]
mov dword [0x4367a8], eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
or dword [esi], 0xffffffff
xor al, al
jmp 0x4158da
Function at 0x4162c0
Capabilities:
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x42e0b4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x21c]
push esi
xor eax, eax
mov dword [ebp - 0x224], ebx
push edi
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x218], eax
call fcn.0041643a
test eax, eax
js 0x421ef3
mov eax, dword [ebp - 0x21c]
cmp eax, 3
jae 0x421f51
test eax, eax
jne 0x421f01
inc eax
mov edi, eax
mov dword [ebp - 0x220], eax
push 0x40002748
mov dword [ebp - 0x22c], edi
call fcn.0041640a
mov dword [ebp - 0x218], eax
pop ecx
test eax, eax
je 0x421f40
mov ebx, eax
xor edx, edx
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x416348
sub ebx, ecx
sar ebx, 1
cmp ebx, 0x104
jae 0x4163d8
mov ecx, 0x208
call fcn.0040dcd0
mov esi, eax
mov dword [ebp - 0x228], esi
test esi, esi
je 0x4163d8
push dword [ebp - 0x218]
mov edx, 0x104
mov ecx, esi
call fcn.0040f3a0
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x421f59
cmp dword [eax + 0x3c], 0
je 0x416404
push dword [eax + 0x3c]
mov edx, 0x104
mov ecx, esi
call fcn.0040fc40
test eax, eax
jne 0x4163cd
xor ebx, ebx
test esi, esi
je 0x4163c1
push esi
call dword [sym.imp.api_ms_win_core_console_l2_2_0.dll_SetConsoleTitleW]
mov byte [0x43675c], bl
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x220], eax
je 0x4163d8
test esi, esi
je 0x4163d8
mov ecx, esi
call fcn.0040dc60
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x4163e9
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
test edi, edi
jne 0x421f40
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416b30
leave
ret 4
xor ecx, ecx
mov edi, ecx
jmp 0x4163cd
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test ebx, ebx
je 0x421fe1
mov ecx, dword [ebx + 0x3c]
call fcn.0040ab7f
mov esi, eax
test esi, esi
je 0x4163c1
mov ecx, esi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x421f22
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jb 0x4163b0
xor edi, edi
inc edi
xor eax, eax
push eax
push 8
call fcn.004078e4
pop ecx
pop ecx
jmp 0x4163f1
add eax, 0xfffffff0
jmp 0x416311
lea eax, [ebp - 0x214]
push 0x104
push eax
mov dword [ebp - 0x21c], eax
call dword [sym.imp.api_ms_win_core_console_l2_2_0.dll_GetConsoleTitleW]
test eax, eax
je 0x4163cd
push dword [ebp - 0x218]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x421fc2
mov edi, dword [ebp - 0x218]
lea esi, [ebp - 0x214]
add ebx, ebx
add esi, ebx
push edi
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x421fa0
mov edi, dword [ebp - 0x22c]
mov dword [ebp - 0x21c], esi
mov esi, dword [ebp - 0x228]
push dword [ebp - 0x21c]
mov edx, 0x104
mov ecx, esi
call fcn.0040fc40
test eax, eax
jne 0x4163cd
jmp 0x4163ae
xor ebx, ebx
mov esi, ebx
jmp 0x4163b0