joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e40
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x413080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
push 0x4139a0
mov dword [ebp - 0x40c], esi
call sub.libav.dll_Ordinal_44272
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x402e95
push 0x4139a0
push str._checkdbdir:_Cant_open_directory__s_n
call fcn.00409df0
add esp, 8
or eax, 0xffffffff
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
push ebx
call sub.libav.dll_Ordinal_44273
add esp, 4
test eax, eax
je 0x402fe6
push edi
mov edi, dword [sym.imp.MSVCR110.dll__unlink]
lea ecx, [ecx]
cmp word [eax], 0
je 0x402fd4
lea esi, [eax + 3]
push str..cld
push esi
call sub.libav.dll_Ordinal_44258
add esp, 8
test eax, eax
jne 0x402ee5
push str..cvd
push esi
call sub.libav.dll_Ordinal_44258
add esp, 8
test eax, eax
je 0x402fce
push esi
push 0x4139a0
push 0x40e680
lea eax, [ebp - 0x204]
push 0x200
push eax
call sub.libav.dll_Ordinal_44276
lea eax, [ebp - 0x204]
push eax
call sub.libav.dll_Ordinal_5
add esp, 0x18
test eax, eax
je 0x402fce
or esi, 0xffffffff
push eax
mov dword [ebp - 0x40c], esi
call sub.libav.dll_Ordinal_27
push eax
lea eax, [ebp - 0x204]
push eax
push str._Corrupted_database_file__s:__s_n
call fcn.00409e10
lea eax, [ebp - 0x204]
push eax
push str._s.broken
lea eax, [ebp - 0x408]
push 0x201
push eax
call sub.libav.dll_Ordinal_44276
lea eax, [ebp - 0x408]
push 4
push eax
call sub.libav.dll_Ordinal_44340
add esp, 0x28
test eax, eax
jne 0x402f77
lea eax, [ebp - 0x408]
push eax
call edi
add esp, 4
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.MSVCR110.dll_rename]
add esp, 8
test eax, eax
je 0x402fb8
lea eax, [ebp - 0x204]
push eax
call edi
add esp, 4
test eax, eax
je 0x402fd4
lea eax, [ebp - 0x204]
push eax
push str._Cant_remove_broken_database_file__s__please_delete_it_manually_and_restart_PCAccelerateProUpdater_n
call fcn.00409e10
add esp, 8
jmp 0x402fd4
lea eax, [ebp - 0x408]
push eax
push str.Corrupted_database_file_renamed_to__s_n
call fcn.00409e10
add esp, 8
jmp 0x402fd4
mov esi, dword [ebp - 0x40c]
push ebx
call sub.libav.dll_Ordinal_44273
add esp, 4
test eax, eax
jne 0x402eb0
pop edi
push ebx
call sub.libav.dll_Ordinal_44274
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
Function at 0x40a110
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2238
call fcn.0040a7b0
mov eax, dword [0x413080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x8000
push eax
mov dword [ebp - 0x2238], eax
xor esi, esi
call dword [sym.imp.MSVCR110.dll__open]
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
je 0x40a225
lea eax, [ebp - 0x2034]
push eax
push edi
call dword [sym.imp.MSVCR110.dll__fstat64i32]
add esp, 8
cmp eax, 0xffffffff
je 0x40a21b
push 0x200
lea eax, [ebp - 0x2234]
push esi
push eax
call sub.MSVCR110.dll_memset
push 0x64
push dword [ebp - 0x2238]
lea eax, [ebp - 0x2234]
push eax
call dword [sym.imp.MSVCR110.dll_strncpy]
push dword [ebp - 0x2020]
lea eax, [ebp - 0x21b8]
push 0x411500
push 0xc
push eax
mov byte [ebp - 0x21d1], 0
call sub.libav.dll_Ordinal_44276
add esp, 0x28
xor ecx, ecx
xor edx, edx
lea ebx, [ebx]
movzx eax, byte [ebp + ecx - 0x2234]
add esi, eax
movzx eax, byte [ebp + ecx - 0x2233]
add ecx, 2
add edx, eax
cmp ecx, 0x200
jb 0x40a1c0
lea eax, [esi + 0x100]
add eax, edx
push eax
push str._06o
lea eax, [ebp - 0x21a0]
push 8
push eax
call sub.libav.dll_Ordinal_44276
add esp, 0x10
lea eax, [ebp - 0x2234]
push 0x200
push eax
test ebx, ebx
je 0x40a239
push ebx
call sub.libav.dll_Ordinal_44294
add esp, 0xc
test eax, eax
jne 0x40a24c
push edi
call dword [sym.imp.MSVCR110.dll__close]
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.MSVCR110.dll__write]
add esp, 0xc
cmp eax, 0x200
jne 0x40a21b
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push edi
call dword [sym.imp.MSVCR110.dll__read]
mov esi, eax
add esp, 0xc
test esi, esi
jle 0x40a2af
push esi
lea eax, [ebp - 0x2004]
push eax
test ebx, ebx
je 0x40a283
push ebx
call sub.libav.dll_Ordinal_44294
add esp, 0xc
test eax, eax
je 0x40a21b
jmp 0x40a293
push dword [ebp + 8]
call dword [sym.imp.MSVCR110.dll__write]
add esp, 0xc
cmp eax, esi
jne 0x40a21b
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push edi
call dword [sym.imp.MSVCR110.dll__read]
mov esi, eax
add esp, 0xc
test esi, esi
jg 0x40a268
push edi
call dword [sym.imp.MSVCR110.dll__close]
mov esi, dword [ebp - 0x2020]
add esp, 4
and esi, 0x800001ff
jns 0x40a2cf
dec esi
or esi, 0xfffffe00
inc esi
je 0x40a330
push 0x200
lea eax, [ebp - 0x2234]
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
mov eax, 0x200
sub eax, esi
push eax
lea eax, [ebp - 0x2234]
push eax
test ebx, ebx
je 0x40a31b
push ebx
call sub.libav.dll_Ordinal_44294
add esp, 0xc
test eax, eax
jne 0x40a330
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.MSVCR110.dll__write]
add esp, 0xc
cmp eax, 0xffffffff
je 0x40a225
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
Function at 0x402754
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004034e4
test esi, esi
jne 0x40278a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004035d4
jmp 0x4027a8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402668
mov edi, eax
test esi, esi
je 0x4027a8
cmp dword [ebx], 0
je 0x4027a8
dec esi
jmp 0x402791
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402900
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x41b008], 0x8088405
inc edx
mov dword [ebx + 0x41b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402ac4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41b018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402b5c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402b3c
xor eax, eax
push ebp
push 0x402b35
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402b78
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402b3c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x41b018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41b018], ax
mov esp, ebp
pop ebp
ret

Function at 0x403368
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41c034], 0
je 0x4033c9
cmp word [0x41c208], 0xd7b2
jne 0x403391
cmp dword [0x41c210], 0
jbe 0x403391
mov eax, 0x41c204
call dword [0x41c220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41b060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4033f0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41b024], 0
jne 0x4033e5
push 0
push 0x41b058
push 0x41b060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404b4c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404bb2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403748
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402988
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404b9c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404bb9
lea eax, [ebp - 0x10]
call fcn.004034e4
ret
Function at 0x4061e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403980
xor eax, eax
push ebp
push 0x40624a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00403790
test eax, eax
jle 0x406234
mov edx, 1
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx - 1]
xor ecx, 0x6521458a
add ebx, ecx
mov ecx, ebx
shl ecx, 0xd
mov esi, ebx
shr esi, 0x13
or ecx, esi
sub ebx, ecx
inc edx
dec eax
jne 0x406212
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406251
lea eax, [ebp - 4]
call fcn.004034e4
ret

Function at 0x4072a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004040f4
mov eax, dword [ebp - 8]
call fcn.00403980
xor eax, eax
push ebp
push 0x407334
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00403d3c
push eax
mov eax, dword [0x41b620]
mov eax, dword [eax]
call eax
mov ebx, eax
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00403790
push eax
lea eax, [ebp - 8]
call fcn.004039e8
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
mov eax, dword [0x41b57c]
mov eax, dword [eax]
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40733b
lea eax, [ebp - 8]
call fcn.004034e4
lea eax, [ebp - 4]
call fcn.00403b80
ret
Function at 0x40c4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x40c609
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, esi
call fcn.0040c3cc
mov eax, dword [ebx]
call fcn.00403790
cmp eax, 4
jg 0x40c52b
mov eax, ebx
call fcn.004034e4
jmp 0x40c5ee
mov eax, dword [ebx]
call fcn.00403790
mov edi, eax
test edi, edi
jle 0x40c555
mov esi, 1
mov eax, ebx
call fcn.004039e8
mov edx, dword [ebx]
mov dl, byte [edx + esi - 1]
xor dl, 0x5c
mov byte [eax + esi - 1], dl
inc esi
dec edi
jne 0x40c53d
mov eax, dword [ebx]
movzx esi, byte [eax + 2]
mov eax, dword [ebx]
movzx edi, byte [eax + 3]
mov eax, ebx
mov ecx, 4
mov edx, 1
call fcn.00403a30
mov eax, ebx
mov ecx, edi
mov edx, 1
call fcn.00403a30
push ebx
mov eax, dword [ebx]
mov ecx, esi
mov edx, 1
call fcn.004039f0
cmp dword [ebx], 0
je 0x40c5ee
mov eax, dword [ebp - 8]
call fcn.00403790
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403790
add esi, eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
mov ecx, esi
mov edx, 1
call fcn.004039f0
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004037dc
mov edx, dword [ebp - 0x10]
pop eax
call fcn.004038dc
je 0x40c5e0
mov eax, ebx
call fcn.004034e4
jmp 0x40c5ee
mov eax, ebx
mov ecx, esi
mov edx, 1
call fcn.00403a30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c610
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403508
ret

Function at 0x40ddb0
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004040f4
mov eax, dword [ebp - 8]
call fcn.00403980
xor eax, eax
push ebp
push 0x40deaf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00403790
cdq
cmp edx, dword [0x41c82c]
jne 0x40ddfe
cmp eax, dword [0x41c828]
jae 0x40de7f
jmp 0x40de00
jge 0x40de7f
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00407168
mov eax, dword [ebp - 0xc]
call fcn.00403790
test eax, eax
jne 0x40de59
push 0
lea edx, [ebp - 0x10]
mov eax, 0x40dec0
call fcn.004062d8
mov eax, dword [ebp - 0x10]
call fcn.00403d3c
push eax
mov eax, dword [ebp - 4]
call fcn.00403d3c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x40de59
lea edx, [ebp - 0x14]
mov eax, 0x40dec0
call fcn.004062d8
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0xc]
call fcn.00407168
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0040dce8
lea edx, [ebp - 0x18]
mov eax, 0x40dec0
call fcn.004062d8
mov eax, dword [ebp - 0x18]
call fcn.00403d3c
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40deb6
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00403b98
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403508
lea eax, [ebp - 4]
call fcn.00403b80
ret
Function at 0x411590
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x52
push 0
push 0
dec ecx
jne 0x411599
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004040f4
lea eax, [ebp - 8]
call fcn.004040f4
lea eax, [ebp - 0xc]
call fcn.004040f4
xor eax, eax
push ebp
push 0x4117df
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
mov ecx, 0x4117f8
mov edx, dword [ebp - 4]
call fcn.00403db8
mov eax, dword [ebp - 0x268]
call fcn.00403d3c
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
push 0x411808
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00403d10
push dword [ebp - 0x270]
push 0x411808
lea edx, [ebp - 0x274]
mov eax, 0x1f
call fcn.0040813c
push dword [ebp - 0x274]
lea eax, [ebp - 0x26c]
mov edx, 5
call fcn.00403e1c
mov eax, dword [ebp - 0x26c]
call fcn.004076b0
test al, al
je 0x41175d
xor eax, eax
push ebp
push 0x411753
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
push 0x411808
lea eax, [ebp - 0x284]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00403d10
push dword [ebp - 0x284]
push 0x411808
lea edx, [ebp - 0x288]
mov eax, 0x1f
call fcn.0040813c
push dword [ebp - 0x288]
lea eax, [ebp - 0x280]
mov edx, 5
call fcn.00403e1c
mov eax, dword [ebp - 0x280]
lea edx, [ebp - 0x27c]
call fcn.00410900
mov edx, dword [ebp - 0x27c]
lea eax, [ebp - 0x278]
call fcn.0040377c
mov eax, dword [ebp - 0x278]
push eax
push dword [ebp - 0xc]
push 0x411808
push dword [ebp - 8]
push 0x411810
lea eax, [ebp - 0x294]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00403d10
push dword [ebp - 0x294]
push 0x411818
lea eax, [ebp - 0x290]
mov edx, 6
call fcn.00403e1c
mov edx, dword [ebp - 0x290]
lea eax, [ebp - 0x28c]
call fcn.0040377c
mov edx, dword [ebp - 0x28c]
pop eax
call fcn.0040dce8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41175d
lea eax, [ebp - 0x264]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x411603
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4117e6
lea eax, [ebp - 0x294]
mov edx, 2
call fcn.00403b98
lea eax, [ebp - 0x28c]
call fcn.004034e4
lea eax, [ebp - 0x288]
mov edx, 4
call fcn.00403b98
lea eax, [ebp - 0x278]
call fcn.004034e4
lea eax, [ebp - 0x274]
mov edx, 4
call fcn.00403b98
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403b98
ret
Function at 0x412d9c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x51
push 0
push 0
dec ecx
jne 0x412da5
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004040f4
lea eax, [ebp - 8]
call fcn.004040f4
lea eax, [ebp - 0xc]
call fcn.004040f4
xor eax, eax
push ebp
push 0x412fe0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
mov ecx, 0x412ff8
mov edx, dword [ebp - 4]
call fcn.00403db8
mov eax, dword [ebp - 0x268]
call fcn.00403d3c
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
push 0x413008
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00403d10
push dword [ebp - 0x270]
push 0x413008
lea edx, [ebp - 0x274]
mov eax, 0x61
call fcn.0040813c
push dword [ebp - 0x274]
lea eax, [ebp - 0x26c]
mov edx, 5
call fcn.00403e1c
mov eax, dword [ebp - 0x26c]
call fcn.004076b0
test al, al
je 0x412f5e
xor eax, eax
push ebp
push 0x412f54
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
jne 0x412f4a
push dword [ebp - 4]
push 0x413008
lea eax, [ebp - 0x284]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00403d10
push dword [ebp - 0x284]
push 0x413010
lea eax, [ebp - 0x280]
mov edx, 4
call fcn.00403e1c
mov eax, dword [ebp - 0x280]
lea edx, [ebp - 0x27c]
call fcn.004129a4
mov edx, dword [ebp - 0x27c]
lea eax, [ebp - 0x278]
call fcn.0040377c
mov eax, dword [ebp - 0x278]
push eax
push dword [ebp - 0xc]
push 0x413008
push dword [ebp - 8]
push 0x413028
lea eax, [ebp - 0x290]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00403d10
push dword [ebp - 0x290]
push 0x413030
lea eax, [ebp - 0x28c]
mov edx, 6
call fcn.00403e1c
mov edx, dword [ebp - 0x28c]
lea eax, [ebp - 0x288]
call fcn.0040377c
mov edx, dword [ebp - 0x288]
pop eax
call fcn.0040dce8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x412f5e
lea eax, [ebp - 0x264]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x412e10
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412fe7
lea eax, [ebp - 0x290]
mov edx, 2
call fcn.00403b98
lea eax, [ebp - 0x288]
call fcn.004034e4
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.00403b98
lea eax, [ebp - 0x278]
call fcn.004034e4
lea eax, [ebp - 0x274]
mov edx, 4
call fcn.00403b98
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403b98
ret
Function at 0x41303c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x51
push 0
push 0
dec ecx
jne 0x413045
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004040f4
lea eax, [ebp - 8]
call fcn.004040f4
lea eax, [ebp - 0xc]
call fcn.004040f4
xor eax, eax
push ebp
push 0x413276
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
mov ecx, 0x413290
mov edx, dword [ebp - 4]
call fcn.00403db8
mov eax, dword [ebp - 0x268]
call fcn.00403d3c
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
push 0x4132a0
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00403d10
push dword [ebp - 0x270]
push 0x4132a0
lea edx, [ebp - 0x274]
mov eax, 0x1f
call fcn.0040813c
push dword [ebp - 0x274]
lea eax, [ebp - 0x26c]
mov edx, 5
call fcn.00403e1c
mov eax, dword [ebp - 0x26c]
call fcn.004076b0
test al, al
je 0x4131f4
xor eax, eax
push ebp
push 0x4131ea
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
push 0x4132a0
lea eax, [ebp - 0x284]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00403d10
push dword [ebp - 0x284]
push 0x4132a8
lea eax, [ebp - 0x280]
mov edx, 4
call fcn.00403e1c
mov eax, dword [ebp - 0x280]
lea edx, [ebp - 0x27c]
call fcn.0041256c
mov edx, dword [ebp - 0x27c]
lea eax, [ebp - 0x278]
call fcn.0040377c
mov eax, dword [ebp - 0x278]
push eax
push dword [ebp - 0xc]
push 0x4132a0
push dword [ebp - 8]
push 0x4132cc
lea eax, [ebp - 0x290]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00403d10
push dword [ebp - 0x290]
push 0x4132d4
lea eax, [ebp - 0x28c]
mov edx, 6
call fcn.00403e1c
mov edx, dword [ebp - 0x28c]
lea eax, [ebp - 0x288]
call fcn.0040377c
mov edx, dword [ebp - 0x288]
pop eax
call fcn.0040dce8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4131f4
lea eax, [ebp - 0x264]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4130b0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41327d
lea eax, [ebp - 0x290]
mov edx, 2
call fcn.00403b98
lea eax, [ebp - 0x288]
call fcn.004034e4
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.00403b98
lea eax, [ebp - 0x278]
call fcn.004034e4
lea eax, [ebp - 0x274]
mov edx, 4
call fcn.00403b98
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403b98
ret

Function at 0x4140f8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004040f4
xor eax, eax
push ebp
push 0x414140
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403d3c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414147
lea eax, [ebp - 4]
call fcn.00403b80
ret
Function at 0x414150
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004040f4
xor eax, eax
push ebp
push 0x4141a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403d3c
push eax
call sub.kernel32.dll_GetFileAttributesW
and eax, 0x10
cmp eax, 0x10
sete bl
mov eax, dword [ebp - 4]
call fcn.004140f8
test al, al
jne 0x414193
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4141b0
lea eax, [ebp - 4]
call fcn.00403b80
ret
Function at 0x416748
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x416750
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4168d4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
lea eax, [ebp - 0x2c]
mov edx, dword [ebx]
call fcn.00403d2c
push dword [ebp - 0x2c]
push 0x4168e4
push 0
lea eax, [ebp - 0x30]
push eax
lea edx, [ebp - 0x38]
mov eax, 0x416904
call fcn.00406984
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
call fcn.00403d2c
mov eax, dword [ebp - 0x34]
push eax
lea edx, [ebp - 0x40]
mov eax, 0x41692c
call fcn.00406984
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
call fcn.00403d2c
mov edx, dword [ebp - 0x3c]
mov eax, 0x80000002
pop ecx
call fcn.00407500
push dword [ebp - 0x30]
push 0x416974
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00403e1c
mov edx, dword [ebp - 0x28]
mov eax, ebx
call fcn.0040377c
mov edx, dword [ebx]
lea eax, [ebp - 0x4c]
mov ecx, 0x416984
call fcn.004037dc
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x48]
call fcn.00403d2c
push dword [ebp - 0x48]
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0x10]
call fcn.00406fdc
push dword [ebp - 0x50]
push 0x416974
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.00403e1c
mov edx, dword [ebp - 0x44]
mov eax, ebx
call fcn.0040377c
push dword [ebx]
push 0x416998
lea eax, [ebp - 0x54]
call fcn.00416584
push dword [ebp - 0x54]
push 0x4169ac
mov eax, ebx
mov edx, 4
call fcn.00403850
push dword [ebx]
push 0x4169b8
lea eax, [ebp - 0x58]
call fcn.00416644
push dword [ebp - 0x58]
push 0x4169ac
mov eax, ebx
mov edx, 4
call fcn.00403850
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4168db
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.00403508
lea eax, [ebp - 0x50]
call fcn.00403b80
lea eax, [ebp - 0x4c]
call fcn.004034e4
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403b98
lea eax, [ebp - 0x40]
call fcn.004034e4
lea eax, [ebp - 0x3c]
call fcn.00403b80
lea eax, [ebp - 0x38]
call fcn.004034e4
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00403b98
ret