joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e56e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.0050df50
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4e5730
push ebx
call fcn.0050c77a
add esp, 4
pop eax
mov dword [ebp - 4], eax
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4e5747
mov eax, 0x1873969
push eax
push 1
mov ebx, 0x130
call fcn.0050d2d0
add esp, 0x10
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop
nop
nop
nop
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4e5788
mov eax, 0x1873969
push eax
push 2
mov ebx, 0x134
call fcn.0050d9a0
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4e57b2
push ebx
call fcn.0050c77a
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4e57d2
push eax
mov ebx, eax
call fcn.004d7152
inc eax
push eax
call fcn.0050c774
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4e57d7
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4e57e8
push ebx
call fcn.0050c77a
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x4e747e
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
jmp 0x4e74a0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.0050df50
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4e74d5
push ebx
call fcn.0050c77a
add esp, 4
pop eax
mov dword [ebp - 4], eax
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4e74ec
mov eax, 0x1873969
push eax
push 1
mov ebx, 0x130
call fcn.0050d2d0
add esp, 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
nop
nop
nop
nop
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4e7541
mov eax, dword [ebp - 4]
test eax, eax
je 0x4e753c
push eax
mov ebx, eax
call fcn.004d7152
inc eax
push eax
call fcn.0050c774
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4e757a
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0050cc60
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4e757a
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4e758b
push ebx
call fcn.0050c77a
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x4e8e76
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
setne al
jmp 0x4e8ea5
mov esp, ebp
pop ebp
ret 4
Function at 0x4e8f0b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x4e8f5e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
jmp 0x4e8f66
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x4e8f77
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4ef146
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 0xc
call fcn.0050c774
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
jmp 0x4ef18e
mov ebx, dword [ebp + 8]
push dword [ebx]
push 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
nop
nop
nop
nop
mov dword [ebp - 4], eax
push 0x64
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
nop
nop
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x102
jne 0x4ef1ee
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
nop
nop
nop
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
push 0
call fcn.0050c79e
add esp, 4
jmp 0x4ef1fe
mov ebx, dword [ebp - 8]
push ebx
call fcn.0050c77a
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x50e9e0
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x50ea50
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x50eab9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.0050c9a0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x50eac0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x50eb52
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x50eb44
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x50eb3c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x50eb05
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x50ebd0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x50ebee
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x50ebe3
pop esi
ret
Function at 0x50f0d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x50f0f1
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x50f14b
inc edi
cmp edi, esi
jl 0x50f0e5
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x50f180
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x50f13a
cmp byte [eax], bl
je 0x50f155
cmp byte [eax + 1], bl
je 0x50f15e
cmp byte [eax + 2], bl
je 0x50f168
cmp byte [eax + 3], bl
je 0x50f174
add eax, 4
cmp eax, edi
jb 0x50f111
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x51d4c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x18b1424]
xor edx, edx
cmp eax, edx
jne 0x51d4e6
xor eax, eax
mov byte [eax + 0x18b1324], al
inc eax
cmp eax, 0x100
jl 0x51d4ce
mov dword [0x18b1424], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x18b1324
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x51d577
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x51d54a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x51d518
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x51d580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x51d5d3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x51d5ba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x523f90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5535fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.005248b0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x1855dac
call fcn.00543510
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x524023
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00543510
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x52401c
push 0
mov ecx, eax
call fcn.0051b100
mov dword [esi + 0xc], eax
jmp 0x524025
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x524025
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x545b9d
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x545bd5
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00543c2a
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00543c02
jmp 0x545be1
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x54728b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5472cd
call fcn.0054ce85
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5472cd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5472c4
xor eax, eax
jmp 0x5472d5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005472db
pop edi
pop esi
pop ebx
ret 4

Function at 0x54d3b5
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x54d3e3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x54d401
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0054d31b
jmp 0x54d401
mov eax, dword [esi + 0x14]
test eax, eax
je 0x54d401
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0054d31b
test edi, edi
mov eax, edi
jne 0x54d3eb
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x405f16
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c59c], 0
push esi
jne 0x405f4d
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f27
mov dword [ecx*4 + 0x42c598], eax
inc ecx
cmp ecx, 0x100
jl 0x405f22
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f7e
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c598]
xor eax, esi
inc ecx
dec edx
jne 0x405f60
pop edi
not eax
pop esi
ret 0xc

Function at 0x408937
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop eax
call fcn.0040894f
xor dword [ebx], eax
add ebx, 1
cmp ebx, edx
jne fcn.00408937
ret
Function at 0x40415c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404314
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4041bd
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404330
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40422a
xor eax, eax
push ebp
push 0x404223
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40420c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404350
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40422a
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40430b
cmp byte [ebp - 0xd], 0
jne 0x40426c
cmp byte [ebp - 0x12], 0
je 0x40430b
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404285
dec ebx
cmp byte [ebx], 0x2e
je 0x404294
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404284
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40430b
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4042c1
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40430b
cmp byte [ebp - 0xd], 0
je 0x40430b
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40430b
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406a7c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406b86
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x406acf
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403380
jmp 0x406b6d
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.00406a30
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00406a50
mov ebx, eax
test esi, esi
je 0x406af7
dec esi
test esi, esi
jl 0x406af7
cmp edi, ebx
jne 0x406ad6
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.004033c0
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.00403618
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403414
cmp eax, 2
jl 0x406b6d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x406b6d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403414
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x406b6d
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403414
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00403618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b8d
lea eax, [ebp - 0x110]
call fcn.0040329c
ret

Function at 0x406c00
Capabilities:
Get file attributes

Disassembly:
call fcn.00405568
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x406c14
dec eax
and al, 0x10
sete al
ret

Function at 0x406d10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406d7a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004033c0
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00406cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406d81
lea eax, [ebp - 0x10c]
call fcn.0040329c
ret

Function at 0x406d88
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406df2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004033c0
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00406cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406df9
lea eax, [ebp - 0x10c]
call fcn.0040329c
ret
Function at 0x406e00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406e6a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004033c0
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00406cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e71
lea eax, [ebp - 0x10c]
call fcn.0040329c
ret

Function at 0x406e78
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035c8
mov eax, dword [ebp - 8]
call fcn.004035c8
xor eax, eax
push ebp
push 0x406fc8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040329c
cmp dword [ebp - 4], 0
je 0x406ee0
mov eax, dword [ebp - 4]
call fcn.00403414
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x406ee0
lea eax, [ebp - 4]
mov edx, 0x406fe0
call fcn.0040341c
cmp dword [ebp - 8], 0
je 0x406f0f
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x406f0f
lea ecx, [ebp - 0x150]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00406934
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 8]
call fcn.00403334
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403460
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004035d8
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
test esi, esi
setne al
jmp 0x406f98
test dword [ebp - 0x14c], 0x10
ja 0x406f85
cmp dword [ebx], 0
je 0x406f58
mov eax, ebx
mov edx, 0x406fec
call fcn.0040341c
push dword [ebx]
push dword [ebp - 4]
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004033fc
push dword [ebp - 0x150]
mov eax, ebx
mov edx, 3
call fcn.004034d4
lea eax, [ebp - 0x14c]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x406f3b
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406fcf
lea eax, [ebp - 0x150]
call fcn.0040329c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004032c0
ret
Function at 0x406ff0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4070e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403414
mov ebx, eax
lea eax, [ebx + 2]
call fcn.004024f4
mov esi, eax
mov eax, edi
call fcn.004035d8
mov edx, eax
mov eax, esi
call fcn.00406868
mov byte [esi + ebx + 1], 0
cmp ebx, 0
jl 0x40704b
cmp byte [esi + ebx], 0x3b
jne 0x407045
mov byte [esi + ebx], 0
dec ebx
cmp ebx, 0xffffffff
jne 0x40703b
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.004026e4
cmp dword [0x4274fc], 0
je 0x40706e
mov eax, dword [0x4274fc]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
mov dword [ebp - 0x16], esi
mov word [ebp - 0xe], 0x50
mov dword [ebp - 0xc], 0xffffffff
push 0x4070fc
push edi
push 0x40710c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004034d4
mov eax, dword [ebp - 0x24]
call fcn.004035d8
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
test bl, bl
je 0x4070c4
mov ebx, dword [ebp - 0xc]
cmp ebx, 1
sbb ebx, ebx
neg ebx
mov eax, esi
call fcn.0040250c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4070e8
lea eax, [ebp - 0x24]
call fcn.0040329c
ret

Function at 0x407160
Capabilities:
Create thread

Disassembly:
push ebx
mov eax, dword [0x426630]
mov byte [eax], 1
mov edx, dword [0x4053f4]
xor eax, eax
call fcn.00405704
mov ebx, eax
mov byte [ebx + 0x18], 1
lea eax, [ebx + 0x1e]
push eax
push 4
push ebx
push 0x407150
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebx + 0x1a], eax
mov eax, ebx
pop ebx
ret

Function at 0x4071f0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x18], 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jbe 0x40720b
mov byte [ebx + 0x18], 1
pop ebx
ret
cmp word [ebx + 0x2c], 0
je 0x40721a
mov edx, ebx
mov eax, dword [ebx + 0x2e]
call dword [ebx + 0x2a]
pop ebx
ret

Function at 0x407278
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [ebx + 0x19], 1
pop ebx
ret