joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4031c0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4ce4f1
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x4f87d8]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f87d8]
xor eax, esp
push eax
lea eax, [esp + 0xc4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xd4]
xor ebx, ebx
mov esi, 7
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov dword [esp + 0xcc], ebx
mov edi, dword [ebp + 4]
lea ecx, [esp + 0x14]
call fcn.0041f510
test al, al
lea edi, [esi + 1]
je 0x40338a
cmp dword [esp + 0x28], ebx
je 0x40338a
push 0x73
lea eax, [ebp + 0x24]
call fcn.0044e120
cmp eax, ebx
je 0x40325d
mov edx, dword [eax]
mov edx, dword [edx + 0x170]
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call edx
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], ebx
mov word [esp + 0x50], bx
mov dword [esp + 0x80], esi
mov dword [esp + 0x7c], ebx
mov word [esp + 0x6c], bx
mov dword [esp + 0x9c], esi
mov dword [esp + 0x98], ebx
mov word [esp + 0x88], bx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xb4], bl
push 3
xor ecx, ecx
lea esi, [esp + 0x34]
lea edx, [esp + 0x18]
mov byte [esp + 0xd0], 1
call fcn.00405050
mov byte [esp + 0xcc], 2
cmp dword [esp + 0x48], edi
mov eax, dword [esp + 0x34]
jae 0x4032e9
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x40332f
cmp dword [esp + 0x48], edi
jb 0x403308
mov eax, dword [esp + 0x34]
push eax
call fcn.004a85e6
add esp, 4
lea esi, [esp + 0x4c]
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], bx
call fcn.00421ed0
cmp dword [esp + 0x2c], edi
jb 0x40339d
mov ecx, dword [esp + 0x18]
push ecx
jmp 0x403395
lea edx, [esp + 0x4c]
push edx
lea ecx, [esp + 0x34]
call fcn.004199b0
add esp, 4
test al, al
jne 0x403361
lea esi, [esp + 0x30]
call fcn.004159c0
lea esi, [esp + 0x4c]
call fcn.00421ed0
lea esi, [esp + 0x14]
call fcn.004159c0
jmp 0x40339d
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xac]
push eax
push ecx
mov ecx, ebp
call fcn.004033d0
lea esi, [esp + 0x30]
call fcn.004159c0
lea esi, [esp + 0x4c]
call fcn.00421ed0
cmp dword [esp + 0x2c], edi
jb 0x40339d
mov edx, dword [esp + 0x18]
push edx
call fcn.004a85e6
add esp, 4
mov ecx, dword [esp + 0xc4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.004a85d7
add esp, 0xbc
ret 4
Function at 0x404040
Capabilities:
Check http status code
Get http content length

Disassembly:
sub esp, 8
mov eax, dword [esi]
test eax, eax
push ebx
mov dword [esp + 8], 4
mov dword [esp + 4], 0
je 0x40407e
mov ebx, dword [sym.imp.WININET.dll_HttpQueryInfoW]
push 0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push 0x20000013
push eax
call ebx
cmp dword [esp + 4], 0xc8
je 0x404085
xor al, al
pop ebx
add esp, 8
ret
mov dword [edi], 0
mov eax, dword [esi]
test eax, eax
mov dword [esp + 8], 4
je 0x40407e
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push 0x20000005
push eax
call ebx
test eax, eax
setne al
test al, al
je 0x40407e
mov al, 1
pop ebx
add esp, 8
ret
Function at 0x405e20
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4cb9c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push edi
mov eax, dword [0x4f87d8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
xor edi, edi
push 0xffffffffffffffff
push edi
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
call fcn.00405240
mov eax, ebx
mov dword [esp + 0x34], edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x405e80
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x18]
call fcn.00406190
push 0xffffffffffffffff
push edi
push eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov eax, esi
mov word [esi + 4], di
call fcn.00405240
cmp dword [esp + 0x28], 8
jb 0x405ec7
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004a85e6
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x2c
ret
Function at 0x4099b0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4cd148
mov eax, dword fs:[0]
push eax
sub esp, 0x874
mov eax, dword [0x4f87d8]
xor eax, esp
mov dword [esp + 0x870], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f87d8]
xor eax, esp
push eax
lea eax, [esp + 0x888]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x898]
xor ebx, ebx
push ebx
push eax
lea ecx, [esp + 0x274]
push ecx
push ebx
mov dword [esp + 0x8a0], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x409a33
cmp dword [esp + 0x8b4], 8
jb 0x409a2c
mov edx, dword [esp + 0x8a0]
push edx
call fcn.004a85e6
add esp, 4
xor eax, eax
jmp 0x409b90
cmp esi, ebx
je 0x409a7c
mov eax, esi
mov edx, esi
jmp 0x409a40
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x409a40
lea edi, [esp + 0x26c]
sub eax, edx
add edi, 0xfffffffe
jmp 0x409a60
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x409a60
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x26c]
push eax
lea ecx, [esp + 0x478]
push str._s.
push ecx
call fcn.004a9481
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x409ad8
cmp dword [esp + 0x8b4], 8
jb 0x409a2c
mov ecx, dword [esp + 0x8a0]
push ecx
call fcn.004a85e6
add esp, 4
xor eax, eax
jmp 0x409b90
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, 7
cmp dword [esp + 0x1c], 0x10
je 0x409b61
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x270]
push eax
lea ecx, [esp + 0x684]
push 0x4d48ec
push ecx
call fcn.004a9481
lea edx, [esp + 0x58]
push 0x2e
push edx
call fcn.004a9451
add esp, 0x18
cmp eax, ebx
je 0x409b61
push str..lnk
push eax
call fcn.004a93c0
add esp, 8
test eax, eax
jne 0x409b61
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x8c0]
mov dword [eax + 0x18], esi
mov dword [eax + 0x14], ebx
push ecx
mov word [eax + 4], bx
call fcn.00405240
lea edx, [esp + 0x698]
push edx
call fcn.00409630
add esp, 0x20
lea eax, [esp + 0x1c]
push eax
push edi
call ebp
test eax, eax
jne 0x409ae3
cmp dword [esp + 0x8b4], 8
jb 0x409b8b
mov ecx, dword [esp + 0x8a0]
push ecx
call fcn.004a85e6
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x888]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x870]
xor ecx, esp
call fcn.004a85d7
add esp, 0x880
ret
Function at 0x40e650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d014a
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4f87d8]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
push edi
mov eax, dword [0x4f87d8]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
mov esi, ecx
call fcn.00424820
mov dword [esp + 0x40], 0
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push 0
push 0
push esi
call eax
mov ecx, dword [esp + 0x30]
cmp byte [ecx + 0x2c], 0
jne 0x40e6fc
mov byte [esp + 0x2c], 1
call fcn.00410810
call fcn.00410cf0
lea edi, [esp + 0xc]
call fcn.0040f2a0
mov ecx, edi
call fcn.00425430
mov eax, edi
push eax
mov dword [esp + 0x44], 0xffffffff
call fcn.00424920
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004a85d7
add esp, 0x38
ret
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x44], 0xffffffff
call fcn.00424920
xor al, al
jmp 0x40e6df
Function at 0x410380
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4ce168
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f87d8]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x60], ebx
push 0x40
mov edi, 7
push str.EK6K3S8yHuy_wOtV7hAOX_x6INzU1eEX4hb0E3BOt0udwIX5MZTzLD7qrj3h0o_A
lea esi, [esp + 0x28]
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], bx
call fcn.00405810
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
mov byte [esp + 0x64], 1
call fcn.0040db60
mov ebp, 8
add esp, 4
cmp dword [eax + 0x18], ebp
jb 0x4103fa
mov esi, dword [eax + 4]
jmp 0x4103fd
lea esi, [eax + 4]
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x410410
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x18]
push ecx
push 0xf003f
push ebx
push esi
push closesocket
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x41044a
cmp eax, 2
mov dword [esp + 0x1c], eax
jne 0x41044e
push ebx
push esi
push closesocket
lea esi, [esp + 0x24]
call fcn.00419250
jmp 0x410454
mov al, 1
jmp 0x410454
mov dword [esp + 0x18], ebx
xor al, al
cmp al, bl
sete byte [esp + 0x17]
cmp dword [esp + 0x54], ebp
jb 0x41046e
mov edx, dword [esp + 0x40]
push edx
call fcn.004a85e6
add esp, 4
mov byte [esp + 0x60], bl
cmp dword [esp + 0x38], ebp
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], bx
jb 0x410492
mov eax, dword [esp + 0x24]
push eax
call fcn.004a85e6
add esp, 4
cmp byte [esp + 0x17], bl
jne 0x410554
push 0x18
push str.q2ODobV0_kHIYM84fAmrtA
lea esi, [esp + 0x28]
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], bx
call fcn.00405810
lea ecx, [esp + 0x3c]
push ecx
mov ecx, esi
mov byte [esp + 0x64], 2
call fcn.0040db60
mov edi, dword [0x4fe818]
add esp, 4
cmp dword [0x4fe82c], ebp
jae 0x4104e0
mov edi, 0x4fe818
cmp dword [eax + 0x18], ebp
jb 0x4104ea
mov esi, dword [eax + 4]
jmp 0x4104ed
lea esi, [eax + 4]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4104f2
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [esp + 0x18]
push edx
push edi
push 1
push ebx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
je 0x41051d
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x54], ebp
jb 0x410530
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004a85e6
add esp, 4
cmp dword [esp + 0x38], ebp
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], bx
jb 0x410554
mov edx, dword [esp + 0x24]
push edx
call fcn.004a85e6
add esp, 4
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x410563
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x410cf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cef5a
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4f87d8]
xor eax, esp
mov dword [esp + 0x2c], eax
push edi
mov eax, dword [0x4f87d8]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
call fcn.00424820
mov dword [esp + 0x40], 0
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push 0
push 0
push esi
call eax
mov ecx, dword [esp + 0x30]
cmp byte [ecx + 0x2c], 0
jne 0x410d8e
lea edi, [esp + 0xc]
mov byte [esp + 0x2c], 1
call fcn.00410db0
mov ecx, edi
call fcn.00425430
mov eax, edi
push eax
mov dword [esp + 0x44], 0xffffffff
call fcn.00424920
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004a85d7
add esp, 0x3c
ret
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x44], 0xffffffff
call fcn.00424920
xor al, al
jmp 0x410d72
Function at 0x415d50
Capabilities:
Create thread
Resume thread

Disassembly:
push edi
mov edi, eax
mov eax, dword [edi]
test eax, eax
jne 0x415d5d
xor al, al
pop edi
ret
cmp dword [eax + 4], 0
je 0x415d59
push esi
lea ecx, [eax + 0xc]
push ecx
push 4
push eax
push 0x415c50
push 0
push 0
call fcn.004aab68
mov edx, dword [edi]
mov dword [edx + 0x10], eax
mov eax, dword [edi]
add esp, 0x18
cmp dword [eax + 0x10], 0
jne 0x415db2
or esi, 0xffffffff
mov dword [eax + 0x10], esi
mov edi, dword [edi]
mov eax, dword [edi + 0x10]
cmp eax, esi
je 0x415da2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], esi
pop esi
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
xor al, al
pop edi
ret
mov byte [eax + 8], 1
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x415dd4
mov esi, dword [edi]
call fcn.00415ce0
mov edx, dword [edi]
mov byte [edx + 8], 0
pop esi
mov al, 1
pop edi
ret

Function at 0x415e60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4ccf08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4f87d8]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4f87d8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor esi, esi
push 0xffffffffffffffff
push esi
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00405240
push 0x24
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], esi
call fcn.0041b5e0
mov eax, dword [esp + 0x10]
mov esi, 8
add esp, 4
cmp dword [esp + 0x20], esi
jae 0x415ed8
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x415efb
cmp dword [esp + 0x20], esi
jb 0x415ef7
mov eax, dword [esp + 0xc]
push eax
call fcn.004a85e6
add esp, 4
mov al, 1
jmp 0x415f10
cmp dword [esp + 0x20], esi
jb 0x415f0e
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004a85e6
add esp, 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004a85d7
add esp, 0x2c
ret
Function at 0x415f30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4ccf08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4f87d8]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4f87d8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor esi, esi
push 0xffffffffffffffff
push esi
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00405240
push 0x24
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], esi
call fcn.0041b5e0
mov eax, dword [esp + 0x10]
mov esi, 8
add esp, 4
cmp dword [esp + 0x20], esi
jae 0x415fa8
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x415fcf
test al, 0x10
jne 0x415fcf
cmp dword [esp + 0x20], esi
jb 0x415fcb
mov eax, dword [esp + 0xc]
push eax
call fcn.004a85e6
add esp, 4
mov al, 1
jmp 0x415fe4
cmp dword [esp + 0x20], esi
jb 0x415fe2
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004a85e6
add esp, 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004a85d7
add esp, 0x2c
ret

Function at 0x416000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4ccf08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4f87d8]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4f87d8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor esi, esi
push 0xffffffffffffffff
push esi
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00405240
push 0x24
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], esi
call fcn.0041b5e0
mov eax, dword [esp + 0x10]
mov esi, 8
add esp, 4
cmp dword [esp + 0x20], esi
jae 0x416078
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41609f
test al, 0x10
je 0x41609f
cmp dword [esp + 0x20], esi
jb 0x41609b
mov eax, dword [esp + 0xc]
push eax
call fcn.004a85e6
add esp, 4
mov al, 1
jmp 0x4160b4
cmp dword [esp + 0x20], esi
jb 0x4160b2
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004a85e6
add esp, 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004a85d7
add esp, 0x2c
ret
Function at 0x4160d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ce038
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4f87d8]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
push edi
mov eax, dword [0x4f87d8]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6c]
xor esi, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], esi
mov word [esp + 0x38], si
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [esp + 0x6c], esi
call fcn.00426140
add esp, 8
test al, al
je 0x41616a
mov eax, dword [esp + 0x2c]
and eax, 0x10
or eax, esi
jne 0x41616a
cmp dword [esp + 0x4c], 8
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
jb 0x416164
mov edx, dword [esp + 0x38]
push edx
call fcn.004a85e6
add esp, 4
mov eax, esi
mov edx, edi
jmp 0x416182
cmp dword [esp + 0x4c], 8
jb 0x41617e
mov eax, dword [esp + 0x38]
push eax
call fcn.004a85e6
add esp, 4
xor eax, eax
xor edx, edx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.004a85d7
add esp, 0x5c
ret

Function at 0x4161a0
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
cmp dword [edi + 0x18], 8
push esi
lea esi, [edi + 4]
jb 0x4161ae
mov eax, dword [esi]
jmp 0x4161b0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
cmp dword [edi + 0x18], 8
jb 0x4161c4
mov ecx, dword [esi]
jmp 0x4161c6
mov ecx, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [edi + 0x18], 8
jb 0x4161d6
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub eax, 1
neg eax
sbb eax, eax
add eax, 1
pop esi
ret
Function at 0x4161f0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4ce008
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4f87d8]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f87d8]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x48]
mov eax, dword [ebx + 0x14]
xor edi, edi
test eax, eax
mov dword [esp + 0x14], eax
jbe 0x416319
lea ebp, [ebx + 4]
lea ebx, [ebx]
cmp edi, dword [ebx + 0x14]
jbe 0x41624a
call fcn.004a8d14
mov esi, 8
cmp dword [ebx + 0x18], esi
jb 0x416259
mov eax, dword [ebp]
jmp 0x41625b
mov eax, ebp
cmp word [eax + edi*2], 0x2f
je 0x416283
cmp edi, dword [ebx + 0x14]
jbe 0x41626c
call fcn.004a8d14
cmp dword [ebx + 0x18], esi
jb 0x416276
mov eax, dword [ebp]
jmp 0x416278
mov eax, ebp
cmp word [eax + edi*2], 0x5c
jne 0x41630c
push edi
xor ecx, ecx
lea esi, [esp + 0x1c]
mov edx, ebx
call fcn.00405050
xor esi, esi
mov dword [esp + 0x40], esi
cmp dword [esp + 0x2c], esi
je 0x4162df
lea ecx, [esp + 0x18]
push ecx
call fcn.00415e60
add esp, 4
test al, al
jne 0x4162df
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x4162bd
lea eax, [esp + 0x1c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4162df
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x4162fb
mov edx, dword [esp + 0x1c]
push edx
jmp 0x4162f3
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x4162fb
mov eax, dword [esp + 0x1c]
push eax
call fcn.004a85e6
add esp, 4
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], esi
mov word [esp + 0x1c], si
add edi, 1
cmp edi, dword [esp + 0x14]
jb 0x416240
push ebx
call fcn.00415e60
add esp, 4
test al, al
jne 0x416345
cmp dword [ebx + 0x18], 8
jb 0x416331
mov eax, dword [ebx + 4]
jmp 0x416334
lea eax, [ebx + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x416345
xor al, al
jmp 0x41634e
push ebx
call fcn.00416000
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a85d7
add esp, 0x30
ret
Function at 0x418ed0
Capabilities:
Get file size

Disassembly:
push ecx
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x418edf
xor al, al
pop ecx
ret 4
push esi
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x418f04
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x418f04
xor al, al
pop esi
pop ecx
ret 4
mov edx, dword [esp + 4]
push 1
push 0
push 0
push edx
call fcn.004b61c0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [esp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
pop ecx
ret 4

Function at 0x4192b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push 0x400
mov esi, eax
mov dword [esp + 0x14], 1
xor bl, bl
call fcn.004a9ad4
push 0x400
mov edi, eax
push 0
push edi
call fcn.004b1550
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebp]
push edi
lea ecx, [esp + 0x18]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x30], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x419326
mov dword [ebp + 4], eax
mov eax, esi
call fcn.0040b810
push edi
call fcn.004aa2ff
add esp, 4
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, edi
mov bl, 1
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419330
sub eax, edx
sar eax, 1
push eax
push edi
call fcn.00405810
push edi
call fcn.004aa2ff
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret 8

Function at 0x4195a0
Capabilities:
Get common file path
Get startup folder

Disassembly:
sub esp, 0x210
mov eax, dword [0x4f87d8]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push edi
xor edi, edi
push 0x206
lea eax, [esp + 0x12]
push edi
push eax
mov esi, ecx
mov dword [esp + 0x14], edi
mov word [esp + 0x18], di
call fcn.004b1550
mov ecx, dword [esp + 0x228]
add esp, 0xc
push edi
push ecx
lea edx, [esp + 0x14]
push edx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov word [esi + 4], di
jne 0x419605
push edi
push 0x4d40cc
jmp 0x419625
lea eax, [esp + 0xc]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x419610
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00405810
mov ecx, dword [esp + 0x214]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.004a85d7
add esp, 0x210
ret