joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101113d3
Capabilities:
Enumerate processes

Disassembly:
push 0x280
mov eax, 0x10164e38
call fcn.1010ab8d
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x28c], ebx
test eax, eax
je 0x101115c0
push eax
lea ecx, [ebp - 0x40]
call fcn.10041a60
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.101101fd
mov edi, 0x22c
lea eax, [ebp - 0x284]
push edi
push 0
push eax
call fcn.1012b3b0
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x28c], esi
cmp esi, 0xffffffff
je 0x101115b0
call fcn.100eb560
test al, al
je 0x10111455
pop eax
pop ecx
push ebp
push edi
pop ecx
push esp
pop edx
pop ebp
pop edx
pop esp
push eax
push ebx
push ebx
push edx
push esp
push edx
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1011152d
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
je 0x10111494
lea eax, [ebp - 0x260]
push eax
call fcn.101434c4
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.10041f70
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.101101fd
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.1004b0b0
test eax, eax
je 0x101114e8
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1010ffd4
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
or ebx, 1
call fcn.1004b0b0
mov byte [ebp - 0x285], 0
test eax, eax
jne 0x101114ef
mov byte [ebp - 0x285], 1
test bl, 1
je 0x10111503
push 0
push 1
lea ecx, [ebp - 0x58]
and ebx, 0xfffffffe
call fcn.100421a0
cmp byte [ebp - 0x285], 0
jne 0x101115c6
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.100421a0
lea eax, [ebp - 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1011146d
call fcn.100eaca0
test al, al
je 0x1011155d
push esp
push edi
pop ebx
pop ecx
pop esp
pop ebx
pop ebx
push ecx
pop ebp
pop eax
pop ebp
push ebx
pop ebx
pop edx
push ebp
push ebx
pop edi
pop eax
push ebx
push edx
pop edx
pop eax
pop edi
push ebp
pop edx
push ebp
push ebx
pop ebp
push ebx
pop edx
pop esi
call fcn.100eaf40
test al, al
je 0x1011157f
pop edx
push ecx
push ebp
pop edx
push esp
push esp
push edx
push esi
pop eax
push esi
pop ebx
pop ecx
pop esi
pop ebx
push edi
pop edi
push ecx
push esi
pop edi
pop edi
push ecx
push esp
pop ebp
push ebp
push edi
call fcn.100eb330
test al, al
je 0x101115a4
pop edx
push ecx
pop ebp
pop ebx
pop ebp
pop eax
pop ebx
push edi
push edx
push esi
pop edi
push eax
push edx
push edi
push esi
push esp
pop ebp
push ecx
push edx
pop eax
pop ebp
pop esi
push ecx
pop ecx
push ebx
pop edi
push edi
pop ebp
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.100421a0
mov eax, esi
call fcn.1010ab48
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.100421a0
jmp 0x101115b2
Function at 0x10112b5a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x101b90ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, 0x101bc448
cmp dword [esi], eax
je 0x10112b93
add esi, 0x50
cmp esi, 0x101bccb8
jl 0x10112b7d
xor al, al
jmp 0x10112c5d
push 0x190
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.1012b3b0
add edi, 4
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x10112bb4
mov edi, dword [edi]
lea eax, [esi + 0x38]
cmp dword [eax + 0x14], 8
jb 0x10112bbf
mov eax, dword [eax]
lea ecx, [esi + 0x20]
cmp dword [ecx + 0x14], 8
jb 0x10112bca
mov ecx, dword [ecx]
lea edx, [esi + 8]
cmp dword [edx + 0x14], 8
jb 0x10112bd5
mov edx, dword [edx]
push edi
push 0xc8
lea edi, [ebp - 0x194]
push edi
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x194], 0
jne 0x10112bf9
xor eax, eax
jmp 0x10112c06
lea eax, [ebp - 0x194]
push eax
call fcn.101434c4
pop ecx
push eax
lea eax, [ebp - 0x194]
lea edi, [ebx + 8]
push eax
mov ecx, edi
call fcn.10041f70
mov eax, dword [esi + 4]
mov dword [ebx], eax
cmp dword [esi + 4], 1
jne 0x10112c39
cmp dword [edi + 0x14], 8
jb 0x10112c2d
mov eax, dword [edi]
jmp 0x10112c2f
mov eax, edi
push eax
call fcn.10132c54
pop ecx
mov dword [ebx + 4], eax
cmp dword [esi + 4], 3
jne 0x10112c5b
cmp dword [edi + 0x14], 8
jb 0x10112c47
mov edi, dword [edi]
push edi
call fcn.10132c54
pop ecx
xor ecx, ecx
mov dword [ebx + 4], eax
test eax, eax
setg cl
mov dword [ebx + 0x20], ecx
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10109ec2
mov esp, ebp
pop ebp
ret 8

Function at 0x10113d47
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x1014e2ff
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1014e17e

Function at 0x10150bc1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10150881
Function at 0x403252
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x456178]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov edi, edx
push 0x40e
push eax
mov word [ebp - 0x414], ax
mov esi, ecx
lea eax, [ebp - 0x412]
push eax
call fcn.004344f0
and dword [ebp - 0x418], 0
lea eax, [ebp - 0x418]
add esp, 0xc
push eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x4032a8
xor al, al
jmp 0x4032fa
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x4032d5
cmp dword [ebp - 0x418], eax
je 0x4032a4
push dword [ebp - 0x418]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x4032a4
lea eax, [ebp - 0x414]
mov ecx, edi
push eax
call fcn.00401628
cmp dword [ebp - 0x418], 0
je 0x4032f8
push dword [ebp - 0x418]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004332ea
mov esp, ebp
pop ebp
ret

Function at 0x40330a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x456178]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
xor ebx, ebx
mov dword [ebp - 0x20], 0x25
mov esi, edx
lea eax, [ebp - 0x20]
push ebx
mov edi, ecx
mov ecx, esi
push eax
call fcn.004016ae
push esi
cmp eax, 0xffffffff
jne 0x40334a
mov ecx, edi
call fcn.00401e5c
jmp 0x4033de
lea ecx, [ebp - 0x1c]
call fcn.00401e5c
cmp dword [esi + 0x14], 8
jb 0x40335c
mov eax, dword [esi]
jmp 0x40335e
mov eax, esi
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x403379
push esi
mov ecx, edi
call fcn.00401e5c
push ebx
jmp 0x4033d4
xor ecx, ecx
add eax, 2
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004332e1
cmp dword [esi + 0x14], 8
mov ebx, eax
pop ecx
jb 0x40339b
mov esi, dword [esi]
mov eax, dword [ebp - 0x20]
inc eax
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4033c0
cmp eax, dword [ebp - 0x20]
ja 0x4033c0
xor ecx, ecx
mov word [ebx + eax*2], cx
lea ecx, [ebp - 0x1c]
push ebx
call fcn.00401628
push ebx
call fcn.00434184
pop ecx
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.00401432
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00401751
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004332ea
mov esp, ebp
pop ebp
ret
Function at 0x405316
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x456178]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
push 0xc35
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x40537d
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004344f0
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x40537d
lea eax, [ebp - 0x804]
push eax
lea ecx, [esi + 0x10]
call fcn.00401628
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004332ea
mov esp, ebp
pop ebp
ret 4

Function at 0x40538f
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
mov edi, ecx
xor ebx, ebx
push str.advapi32.dll
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov byte [edi + 0x18], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x1c], eax
test eax, eax
je 0x40542e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegCreateKeyExW
push eax
call esi
push str.RegQueryValueW
push dword [edi + 0x1c]
mov dword [edi], eax
call esi
push str.RegSetValueW
push dword [edi + 0x1c]
mov dword [edi + 4], eax
call esi
push str.RegQueryValueExW
push dword [edi + 0x1c]
mov dword [edi + 8], eax
call esi
push str.RegSetValueExW
push dword [edi + 0x1c]
mov dword [edi + 0xc], eax
call esi
push str.RegCloseKey
push dword [edi + 0x1c]
mov dword [edi + 0x10], eax
call esi
mov dword [edi + 0x14], eax
pop esi
cmp dword [edi], ebx
je 0x40542e
cmp dword [edi + 4], ebx
je 0x40542e
cmp dword [edi + 8], ebx
je 0x40542e
cmp dword [edi + 0xc], ebx
je 0x40542e
cmp dword [edi + 0x10], ebx
je 0x40542e
test eax, eax
je 0x40542e
mov byte [edi + 0x18], 1
mov eax, edi
pop edi
pop ebx
ret

Function at 0x40611e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push edi
push 0x44
xor edi, edi
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.004344f0
push 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 0x58], 0x44
push edi
push eax
call fcn.004344f0
mov ecx, dword [ebp + 0xc]
add esp, 0x18
mov dword [ebp - 0x2c], 1
cmp dword [ecx + 0x14], 8
push 5
pop eax
mov word [ebp - 0x28], ax
jb 0x406162
mov ecx, dword [ecx]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x40616d
mov eax, dword [eax]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x58]
push edx
push ecx
push edi
push edi
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x406199
cmp dword [ebp - 0x10], edi
je 0x406195
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x40619b
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x4069ea
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x456178]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov esi, dword [edi]
jmp 0x406b8e
push esi
lea ecx, [ebp - 0x4c]
call fcn.00401e5c
lea ecx, [ebp - 0x4c]
call fcn.0040e960
test al, al
je 0x406b7f
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x64]
call fcn.00401e5c
lea ecx, [ebp - 0x64]
call fcn.004137df
test al, al
je 0x406b73
cmp dword [ebp - 0x50], 8
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x4c]
cmovae ecx, dword [ebp - 0x64]
cmp dword [ebp - 0x38], 8
push ecx
cmovae eax, dword [ebp - 0x4c]
push eax
call fcn.00434c2f
pop ecx
pop ecx
test eax, eax
jne 0x406b73
lea ecx, [ebp - 0xb4]
call fcn.0040538f
and dword [ebp - 0x24], 0
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x20], 7
push str.delete
mov word [ebp - 0x34], ax
call fcn.00401628
and dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x68], 7
mov edx, ebx
mov word [ebp - 0x7c], ax
call fcn.0040c9d0
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x34]
call fcn.00402149
push 0
push 1
lea ecx, [ebp - 0x1c]
inc ebx
call fcn.00401751
lea eax, [ebp - 0x64]
mov edx, str.cmd.exe__c_del__
push 0x449818
push eax
lea ecx, [ebp - 0x94]
call fcn.00404c52
pop ecx
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00404ca4
pop ecx
push eax
lea ecx, [ebp - 0x7c]
call fcn.00401e84
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00401751
push 0
push 1
lea ecx, [ebp - 0x94]
call fcn.00401751
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 8], 7
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov word [ebp - 0x1c], ax
call fcn.00401628
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
push ecx
lea ecx, [ebp - 0xb4]
call fcn.0040558a
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00401751
push 0
push 1
lea ecx, [ebp - 0x7c]
call fcn.00401751
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00401751
lea ecx, [ebp - 0xb4]
call fcn.00405433
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.00401751
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.00401751
add esi, 0x18
cmp esi, dword [edi + 4]
jne 0x406a0b
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004332ea
mov esp, ebp
pop ebp
ret
Function at 0x406faf
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x456178]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x20], 0
push ebx
push esi
cmp dword [eax + 0x14], 8
push edi
mov edi, dword [ebp + 0xc]
jb 0x406fd4
mov eax, dword [eax]
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
jne 0x406fe9
xor al, al
jmp 0x40702d
xor esi, esi
cmp dword [ebp - 0x20], esi
jle 0x40701e
push dword [ebx + esi*4]
lea ecx, [ebp - 0x1c]
call fcn.0040140d
cmp dword [ebp - 0xc], 0
je 0x40700c
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.004049fc
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00401751
inc esi
cmp esi, dword [ebp - 0x20]
jl 0x406ff0
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
cmp eax, dword [edi + 4]
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004332ea
mov esp, ebp
pop ebp
ret 8

Function at 0x408d97
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x456178]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [eax + 0x14], 8
jb 0x408db8
mov eax, dword [eax]
push 0x100
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x408ddf
mov eax, dword [ebp - 0x2b8]
mov dword [esi + 0x18], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004332ea
mov esp, ebp
pop ebp
ret 4
Function at 0x409861
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x456178]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x260]
mov esi, ecx
push 0x27f4
push eax
call fcn.004033f1
mov ecx, eax
call fcn.004133d6
cmp dword [ebp - 0x24c], 8
lea eax, [ebp - 0x260]
cmovae eax, dword [ebp - 0x260]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x20a
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004344f0
add esp, 0xc
push 0x3ec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov edi, eax
test edi, edi
je 0x409917
push edi
call ebx
test eax, eax
je 0x409917
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x409917
xor eax, eax
lea ecx, [esi + 0x240]
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x218]
push eax
call fcn.00401628
jmp 0x409934
push edi
call ebx
test eax, eax
je 0x409934
lea eax, [esi + 0x240]
cmp dword [eax + 0x14], 8
jb 0x40992c
mov eax, dword [eax]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea edi, [esi + 0x240]
mov edx, edi
lea ecx, [ebp - 0x248]
call fcn.0040330a
push eax
mov ecx, edi
call fcn.00401e84
xor ebx, ebx
lea ecx, [ebp - 0x248]
push ebx
push 1
call fcn.00401751
mov edx, str.__r_n
mov ecx, edi
call fcn.0040c730
cmp byte [esi + 0x80], bl
je 0x409a96
cmp dword [esi + 0x78], ebx
je 0x409a96
lea ecx, [esi + 0x68]
mov edx, edi
call fcn.0040c500
test al, al
jne 0x409a96
lea ecx, [ebp - 0x280]
call fcn.0040538f
lea eax, [esi + 0x2c4]
push eax
lea ecx, [ebp - 0x248]
call fcn.00401e5c
lea ecx, [ebp - 0x248]
call fcn.0040c820
push 0x25
push 0x3a
pop edx
lea ecx, [ebp - 0x248]
call fcn.0040c670
add esp, 4
push 0x25
push 0x5c
pop edx
call fcn.0040c670
push 7
pop esi
xor eax, eax
mov dword [ebp - 0x21c], esi
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
mov dword [esp], 0x449d80
call fcn.00401628
lea eax, [ebp - 0x230]
push eax
push ecx
lea ecx, [ebp - 0x280]
call fcn.00405443
push 0
push 1
lea ecx, [ebp - 0x230]
mov bl, al
call fcn.00401751
test bl, bl
je 0x409a7b
xor eax, eax
mov dword [ebp - 0x21c], esi
xor ebx, ebx
mov word [ebp - 0x230], ax
push 0x449d80
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], ebx
call fcn.00401628
push edi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x230]
push eax
push ecx
lea ecx, [ebp - 0x280]
call fcn.0040558a
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.00401751
jmp 0x409a7d
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x248]
call fcn.00401751
lea ecx, [ebp - 0x280]
call fcn.00405433
push ebx
push 1
lea ecx, [ebp - 0x260]
call fcn.00401751
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004332ea
mov esp, ebp
pop ebp
ret
Function at 0x40d440
Capabilities:
Access peb ldr_data
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x442528
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x456178]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov eax, dword [0x456178]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x1c], 0
push 0xffffffffffffffff
push eax
push ecx
mov dword [esp + 0x2c], 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
call fcn.004019ce
mov dword [esp + 0x30], 0
mov edx, 0x24
lea ecx, [esp + 0xc]
call fcn.0040cc10
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x40d4ef
push dword [esp + 0xc]
call fcn.004341ab
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
mov al, bl
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004332ea
add esp, 0x2c
ret

Function at 0x40d530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x442558
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x456178]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov eax, dword [0x456178]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x18], 0
push 0xffffffffffffffff
push eax
push ecx
mov dword [esp + 0x28], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
call fcn.004019ce
mov dword [esp + 0x30], 0
mov edx, 0x24
lea ecx, [esp + 8]
call fcn.0040cc10
cmp dword [esp + 0x1c], 8
lea eax, [esp + 8]
cmovae eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40d5d1
test al, 0x10
jne 0x40d5d1
mov bl, 1
jmp 0x40d5d3
xor bl, bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x1c], 8
jb 0x40d5ee
push dword [esp + 8]
call fcn.004341ab
add esp, 4
xor eax, eax
mov dword [esp + 0x1c], 7
mov word [esp + 8], ax
mov al, bl
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004332ea
mov esp, ebp
pop ebp
ret
Function at 0x40d630
Capabilities:
Access peb ldr_data
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x442528
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x456178]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov eax, dword [0x456178]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x1c], 0
push 0xffffffffffffffff
push eax
push ecx
mov dword [esp + 0x2c], 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
call fcn.004019ce
mov dword [esp + 0x30], 0
mov edx, 0x24
lea ecx, [esp + 0xc]
call fcn.0040cc10
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40d6cb
test al, 0x10
je 0x40d6cb
mov bl, 1
jmp 0x40d6cd
xor bl, bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x40d6e8
push dword [esp + 0xc]
call fcn.004341ab
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
mov al, bl
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004332ea
add esp, 0x2c
ret
Function at 0x40e5e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4426c8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x456178]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov eax, dword [edx]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0
mov eax, dword [edx + 4]
mov ecx, dword [edx + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x10]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [esi + 0x18], eax
xor eax, eax
mov dword [esi + 0x1c], ecx
add eax, dword [edx + 0x20]
mov ecx, dword [edx + 0x1c]
adc ecx, 0
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], ecx
mov word [esp + 8], ax
lea ecx, [esp + 8]
lea eax, [edx + 0x2c]
mov dword [esp + 0x1c], 7
push eax
mov dword [esp + 0x1c], 0
call fcn.00401628
mov dword [esp + 0x28], 0
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.0040d320
mov dword [esp + 0x28], 0xffffffff
cmp dword [esp + 0x1c], 8
jb 0x40e6af
push dword [esp + 8]
call fcn.004341ab
add esp, 4
xor eax, eax
mov dword [esp + 0x1c], 7
mov dword [esp + 0x18], 0
mov word [esp + 8], ax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 8

Function at 0x40e8f0
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0xffffffff
jne 0x40e8fc
xor al, al
ret
and eax, 0xffffb1af
cmp dword [ecx + 0x14], 8
jb 0x40e909
mov ecx, dword [ecx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x40e960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x442740
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x456178]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
mov eax, dword [0x456178]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
push 0x44a744
call fcn.0043402b
add esp, 4
mov ecx, esi
push eax
sub esp, 8
call fcn.0040f0b0
cmp eax, 0xffffffff
jne 0x40e9ca
cmp dword [esi + 0x14], 8
jb 0x40e9b7
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x40ea1c
lea ecx, [esp + 0xc]
call fcn.0040d210
mov dword [esp + 0x58], 0
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.0040e720
mov bl, al
mov dword [esp + 0x58], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x40ea03
push dword [esp + 0x34]
call fcn.004341ab
add esp, 4
xor eax, eax
mov dword [esp + 0x48], 7
mov word [esp + 0x34], ax
mov al, bl
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004332ea
add esp, 0x50
ret