joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41db48
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x46d978]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x471da0]
push esi
xor esi, esi
test al, 1
jne 0x41db92
or eax, 1
mov dword [0x471da0], eax
xor eax, eax
push 0x453025
mov dword [0x471db8], 7
mov dword [0x471db4], esi
mov word [0x471da4], ax
call fcn.0042db59
pop ecx
cmp dword [0x471db4], esi
je 0x41dba4
mov eax, 0x471da4
jmp 0x41dc54
push ebx
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.00435650
add esp, 0xc
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, 0x471da4
test eax, eax
je 0x41dc50
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.00430095
pop ecx
pop ecx
push esi
push esi
push esi
xor ecx, ecx
mov word [eax + 2], cx
push esi
lea eax, [ebp - 0x210]
push eax
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x210], esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x41dc50
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push 0x461760
push ebx
push eax
call fcn.0041d211
lea eax, [ebp - 0x20c]
push eax
call fcn.00401723
add esp, 0x14
lea ecx, [ebp - 0x20c]
push eax
push ecx
mov ecx, edi
call fcn.00405103
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042d3d2
leave
ret
Function at 0x41df8e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x298
mov eax, 0x451f48
call fcn.0043364b
mov esi, ecx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00435650
add esp, 0xc
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0x461854
push 0x46161c
push 0x80000002
mov dword [ebp - 0x2a4], 0x208
mov dword [ebp - 0x2a0], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
jne 0x41e01c
mov edi, 0x461618
push edi
call fcn.00401001
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00401368
jmp 0x41e074
lea eax, [ebp - 0x298]
mov dword [ebp - 0x29c], eax
push 3
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x29c]
call fcn.0041e251
and dword [ebp - 4], 0
push dword [ebp - 0x29c]
call fcn.00401001
pop ecx
push eax
push dword [ebp - 0x29c]
mov ecx, esi
call fcn.00401368
lea eax, [ebp - 0x298]
cmp dword [ebp - 0x29c], eax
je 0x41e074
push dword [ebp - 0x29c]
call fcn.0042df00
pop ecx
xor eax, eax
call fcn.004335fa
ret

Function at 0x41e0a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x46d978]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x14], 0x10
push edi
mov dword [esi + 0x10], ebx
jb 0x41e0cb
mov eax, dword [esi]
jmp 0x41e0cd
mov eax, esi
mov byte [eax], bl
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.00435650
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x46185c
xor edi, edi
push str.SoftwareClasses9B7A98EC_7EF9_468c_ACC8_37C793DBD7E0Implemented_CategoriesA5F7140E_4311_4ef9_AABC_F55941B5EBE5
inc edi
push 0x80000001
mov dword [ebp - 0x114], 0x104
mov dword [ebp - 0x110], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x41e184
cmp dword [ebp - 0x110], edi
jne 0x41e184
lea eax, [ebp - 0x108]
push eax
call fcn.00401001
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.00401368
cmp dword [esi + 0x10], ebx
jbe 0x41e184
push edi
push ebx
lea eax, [ebp - 0x10c]
push eax
mov ecx, esi
mov byte [ebp - 0x10c], 0xa
call fcn.00415707
cmp eax, 0xffffffff
je 0x41e180
push edi
push eax
mov ecx, esi
call fcn.00401542
mov ecx, esi
call fcn.0041e07c
mov eax, edi
jmp 0x41e186
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d3d2
leave
ret
Function at 0x41f06b
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x46d978]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
push 0x58
lea eax, [ebp - 0x6c]
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.00435650
push dword [ebp + 8]
and dword [ebp - 0x58], 0
and dword [ebp - 0x5c], 0
mov edx, esi
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x6c], 0x67452301
mov dword [ebp - 0x68], 0xefcdab89
mov dword [ebp - 0x64], 0x98badcfe
mov dword [ebp - 0x60], 0x10325476
call fcn.0041f11d
push 8
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x10]
call fcn.0041f8a4
mov edx, dword [ebp - 0x5c]
push 0x38
pop ecx
shr edx, 3
and edx, 0x3f
push 0x78
sub ecx, edx
pop eax
sub eax, edx
cmp edx, 0x38
cmovb eax, ecx
push eax
mov edx, 0x46fa08
lea ecx, [ebp - 0x6c]
call fcn.0041f11d
push 8
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x6c]
call fcn.0041f11d
push 0x10
lea edx, [ebp - 0x6c]
mov ecx, edi
call fcn.0041f8a4
mov ecx, dword [ebp - 8]
add esp, 0x20
xor ecx, ebp
pop edi
pop esi
call fcn.0042d3d2
leave
ret
Function at 0x41fb30
Capabilities:
Get file version info

Disassembly:
push 0x244
mov eax, 0x4523ec
call fcn.0043364b
mov eax, edx
mov dword [ebp - 0x244], eax
mov edi, ecx
xor ebx, ebx
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], ebx
jb 0x41fb56
mov eax, dword [eax]
mov byte [eax], bl
push 0x103
lea eax, [ebp - 0x11b]
push ebx
push eax
mov byte [ebp - 0x11c], bl
call fcn.00435650
add esp, 0xc
lea eax, [ebp - 0x11c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x11c], bl
jne 0x41fb95
xor al, al
jmp 0x41fceb
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x23c]
call fcn.004012d4
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov esi, eax
push esi
call fcn.00401001
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00401368
cmp dword [ebp - 0x228], 0x10
lea eax, [ebp - 0x23c]
cmovae eax, dword [ebp - 0x23c]
push ebx
push eax
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x248], ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov edi, eax
test edi, edi
je 0x41fcde
push edi
call fcn.0042c7fe
cmp dword [ebp - 0x228], 0x10
pop ecx
mov esi, eax
push esi
push edi
lea ecx, [ebp - 0x23c]
cmovae ecx, dword [ebp - 0x23c]
push ebx
push ecx
mov dword [ebp - 0x250], esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
jne 0x41fc37
push esi
call fcn.0042db6e
jmp 0x41fcdd
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x240]
push eax
push 0x461318
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x41fc2c
mov eax, dword [ebp - 0x240]
push 0x103
movzx ecx, word [eax + 0xa]
movzx ebx, word [eax + 8]
movzx edi, word [eax + 0xe]
movzx esi, word [eax + 0xc]
xor eax, eax
push eax
mov byte [ebp - 0x224], al
lea eax, [ebp - 0x223]
push eax
mov dword [ebp - 0x24c], ecx
call fcn.00435650
mov eax, dword [ebp - 0x24c]
push esi
push edi
movzx eax, ax
push ebx
push eax
push str._d._d._d._d
lea eax, [ebp - 0x224]
push 0x104
push eax
call fcn.0043070e
lea eax, [ebp - 0x224]
push eax
call fcn.00401001
mov ecx, dword [ebp - 0x244]
add esp, 0x2c
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00401368
push dword [ebp - 0x250]
call fcn.0042db6e
mov bl, 1
pop ecx
lea ecx, [ebp - 0x23c]
call fcn.00401303
mov al, bl
call fcn.004335fa
ret
Function at 0x4200ae
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x46d978]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x288
push esi
mov dword [ebp - 0x38], eax
call fcn.0042df38
mov ebx, eax
pop ecx
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], esi
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
push ebx
call esi
cmp eax, 0x6f
jne 0x420106
push ebx
call fcn.0042df00
push dword [ebp - 0x34]
call fcn.0042df38
pop ecx
mov ebx, eax
pop ecx
lea eax, [ebp - 0x34]
push eax
push ebx
call esi
test eax, eax
jne 0x42016a
push 8
lea eax, [ebx + 0x194]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0041fdb1
push eax
mov ecx, edi
call fcn.004048fe
lea ecx, [ebp - 0x30]
call fcn.00401303
xor eax, eax
mov byte [ebp - 0x18], 0
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xa
lea eax, [ebp - 0x18]
push eax
lea eax, [ebx + 0x1b0]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push eax
call fcn.00431133
mov esi, eax
push esi
call fcn.00401001
mov ecx, dword [ebp - 0x38]
add esp, 0x10
push eax
push esi
call fcn.00401368
test ebx, ebx
je 0x420175
push ebx
call fcn.0042df00
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d3d2
leave
ret 8
Function at 0x4211bc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push esi
xor esi, esi
push edi
mov dword [ebp - 4], edx
mov dword [eax], esi
cmp dword [ebp + 0xc], esi
jne 0x4211d2
int3
cmp byte [ebp + 8], 0
je 0x4211de
cmp dword [edx + 0x10], esi
ja 0x4211de
int3
cmp dword [ecx + 0x14], 0x10
jb 0x4211e6
mov ecx, dword [ecx]
push 0x461bc8
push ecx
call fcn.00430080
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x421280
push ebx
push 2
push esi
push edi
call fcn.00431727
push edi
call fcn.00431630
push esi
push esi
push edi
mov ebx, eax
call fcn.00431727
add esp, 0x1c
test ebx, ebx
jle 0x421278
mov dl, byte [ebp + 8]
test dl, dl
je 0x42122f
mov ecx, dword [ebp + 0x14]
lea eax, [ebx + 0x18]
mov dword [ecx], eax
jmp 0x421236
mov eax, dword [ebp + 0x14]
mov ecx, eax
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
cmp eax, dword [ecx]
jb 0x421278
test dl, dl
je 0x421267
mov ecx, dword [ebp - 4]
push 0x18
push dword [ebp + 0xc]
mov edx, ebx
call fcn.00421141
mov eax, dword [ebp + 0xc]
push edi
xor esi, esi
push ebx
inc esi
add eax, 0x18
push esi
push eax
call fcn.00431087
add esp, 0x18
jmp 0x421278
push edi
xor esi, esi
push ebx
inc esi
push esi
push dword [ebp + 0xc]
call fcn.00431087
add esp, 0x10
push edi
call fcn.0042f520
pop ecx
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x421c8c
Capabilities:
Get common file path

Disassembly:
push 0x80c
mov eax, 0x45226e
call fcn.0043364b
mov ebx, ecx
xor eax, eax
mov esi, 0x45f645
push esi
lea ecx, [ebx + 0x3c]
mov dword [ebp - 0x818], ebx
mov dword [ebx], vtable.statistics_util::KSReportUtil.0
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
call fcn.004012d4
and dword [ebp - 4], 0
push esi
lea ecx, [ebx + 0x54]
call fcn.004012d4
push str.h_lvse
lea ecx, [ebx + 0x6c]
mov byte [ebp - 4], 1
call fcn.004012d4
xor ecx, ecx
mov dword [ebx + 0x84], ecx
mov dword [ebx + 0x88], ecx
mov dword [ebx + 0x8c], ecx
mov dword [ebx + 0x90], ecx
mov byte [ebx + 0x94], cl
mov byte [ebx + 0x95], cl
mov byte [ebx + 0x96], cl
mov byte [ebx + 0x97], cl
mov dword [ebx + 0x98], ecx
mov dword [ebx + 0x9c], ecx
mov dword [ebx + 0xa0], ecx
mov dword [ebx + 0xa4], ecx
mov dword [ebx + 0xa8], ecx
mov dword [ebx + 0xac], ecx
lea edi, [ebx + 0xb0]
push 0xf
pop eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x10], ecx
mov byte [edi], cl
mov dword [ebx + 0xdc], eax
mov dword [ebx + 0xd8], ecx
mov byte [ebx + 0xc8], cl
mov dword [ebx + 0xf4], eax
mov dword [ebx + 0xf0], ecx
mov byte [ebx + 0xe0], cl
mov dword [ebx + 0x10c], eax
mov dword [ebx + 0x108], ecx
mov byte [ebx + 0xf8], cl
lea ecx, [ebx + 0x110]
mov byte [ebp - 4], 9
call fcn.00421286
lea esi, [ebx + 0x20c]
mov ecx, esi
mov dword [ebp - 0x814], esi
call fcn.00417939
mov byte [esi + 0xc4], 0
and dword [esi + 0xd8], 0
mov dword [esi + 0xdc], 7
xor eax, eax
mov word [esi + 0xc8], ax
mov byte [ebp - 4], 0xc
push str.h_lvse
lea ecx, [esi + 0xe4]
mov byte [esi + 0xe0], al
call fcn.004012d4
mov ecx, esi
call fcn.00417a00
lea eax, [ebx + 0x308]
push eax
mov byte [ebp - 4], 0xd
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp - 0x810]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x810]
push eax
call fcn.00401001
pop ecx
push eax
lea eax, [ebp - 0x810]
push eax
mov ecx, edi
call fcn.00401368
mov eax, ebx
call fcn.004335fa
ret
Function at 0x421f26
Capabilities:
Read .ini file

Disassembly:
push 0x81c
mov eax, 0x45266d
call fcn.0043364b
mov edi, ecx
mov ebx, 0x800
push ebx
lea eax, [ebp - 0x810]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.004012d4
and dword [ebp - 4], 0
mov esi, str.AppDataupdatemsg.ini
push esi
call fcn.00401001
pop ecx
push eax
push esi
lea ecx, [ebp - 0x828]
call fcn.0041ab41
cmp dword [ebp - 0x814], 0x10
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
push ebx
lea eax, [ebp - 0x810]
push eax
mov ebx, 0x461618
push ebx
push 0x461c50
push str.report
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.004307b8
cmp dword [ebp - 0x814], 0x10
pop ecx
mov dword [edi + 8], eax
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
push 0x800
lea eax, [ebp - 0x810]
push eax
push ebx
push str.send
push str.report
mov dword [edi + 0xc], edx
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.004307b8
cmp dword [ebp - 0x814], 0x10
pop ecx
mov dword [edi + 0x10], eax
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
push 0x800
lea eax, [ebp - 0x810]
push eax
push ebx
push str.post
push str.report
mov dword [edi + 0x14], edx
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.004307b8
cmp dword [ebp - 0x814], 0x10
mov dword [edi + 0x18], eax
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
pop ecx
push eax
mov dword [edi + 0x1c], edx
push 0x800
lea eax, [ebp - 0x810]
push eax
push ebx
push str.off1
push str.report
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.004307b8
cmp dword [ebp - 0x814], 0x10
pop ecx
mov dword [edi + 0x20], eax
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
push 0x800
lea eax, [ebp - 0x810]
push eax
push ebx
push str.send1
push str.report
mov dword [edi + 0x24], edx
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.004307b8
cmp dword [ebp - 0x814], 0x10
pop ecx
mov dword [edi + 0x28], eax
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
push 0x800
lea eax, [ebp - 0x810]
push eax
push ebx
push str.post1
mov ebx, str.report
push ebx
mov dword [edi + 0x2c], edx
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.004307b8
cmp dword [ebp - 0x814], 0x10
mov dword [edi + 0x30], eax
pop ecx
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
push 0
push str.disable
push ebx
mov dword [edi + 0x34], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [ebp - 0x828]
mov dword [edi + 0x38], eax
call fcn.00401303
call fcn.004335fa
ret
Function at 0x42214d
Capabilities:
Create thread
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x452634
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x46d978]
xor eax, esp
mov dword [esp + 0x170], eax
push ebx
push esi
push edi
mov eax, dword [0x46d978]
xor eax, esp
push eax
lea eax, [esp + 0x188]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0x18]
call fcn.004012d4
and dword [esp + 0x190], 0
cmp dword [esp + 0x24], 0
je 0x42235b
cmp byte [esi + 0x96], 0
jne 0x42235b
lea ebx, [esi + 0x308]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [esi + 0x96], 0
jne 0x422354
push str._report.ini
lea edx, [esp + 0x18]
lea ecx, [esp + 0x60]
mov byte [esi + 0x96], 1
call fcn.0042442c
pop ecx
lea edi, [esi + 0xc8]
push eax
mov ecx, edi
call fcn.004048fe
lea ecx, [esp + 0x5c]
call fcn.00401303
cmp dword [edi + 0x14], 0x10
jb 0x42220f
mov edi, dword [edi]
push edi
push 0
push str.outlog
push str.report
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
setne al
push str.delay_
lea edx, [esp + 0x18]
lea ecx, [esp + 0x30]
mov byte [esi + 0x97], al
mov byte [esi + 0x1f0], al
mov byte [esi + 0x2ec], al
call fcn.0042442c
pop ecx
lea ecx, [esi + 0xe0]
push eax
call fcn.004048fe
lea ecx, [esp + 0x2c]
call fcn.00401303
push 0x103
lea eax, [esp + 0x79]
push 0
push eax
mov byte [esp + 0x80], 0
call fcn.00435650
add esp, 0xc
lea eax, [esp + 0x74]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x42230d
lea eax, [esp + 0x74]
push 0x5c
push eax
call fcn.004311a0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x42230d
inc edi
push 0x2e
push edi
call fcn.00430a40
pop ecx
pop ecx
test eax, eax
je 0x4222b9
mov byte [eax], 0
push 6
push str.liebao
push edi
call fcn.004303f0
add esp, 0xc
test eax, eax
jne 0x4222f5
push str.delay.txt
lea edx, [esp + 0x18]
lea ecx, [esp + 0x48]
call fcn.0042442c
pop ecx
push eax
lea ecx, [esi + 0xf8]
call fcn.004048fe
lea ecx, [esp + 0x44]
call fcn.00401303
push edi
call fcn.00401001
pop ecx
push eax
push edi
lea edi, [esi + 0xe0]
mov ecx, edi
call fcn.0041ab41
jmp 0x422313
lea edi, [esi + 0xe0]
push str..txt
call fcn.00401001
pop ecx
push eax
push str..txt
mov ecx, edi
call fcn.0041ab41
mov ecx, esi
call fcn.00421f26
xor eax, eax
cmp dword [esi + 0x90], eax
jne 0x422354
push eax
push eax
push eax
push 0x42238a
push eax
push eax
call fcn.00430b6b
add esp, 0x18
mov dword [esi + 0x90], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esp + 0x14]
call fcn.00401303
mov ecx, dword [esp + 0x188]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x170]
xor ecx, esp
call fcn.0042d3d2
mov esp, ebp
pop ebp
ret 4
Function at 0x422c27
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4522d1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x46d978]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
cmp byte [esi + 0x96], 0
je 0x422e0f
lea eax, [esi + 0x308]
test edi, edi
je 0x422c9b
cmp byte [esi + 0x94], 0
jne 0x422c9b
push edi
call fcn.0042f520
lea eax, [esi + 0xe0]
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x422c8c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edi, edi
lea eax, [esi + 0x308]
and dword [esp + 0x14], 0
xor ebx, ebx
and dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
and dword [esp + 0x38], ebx
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [esi + 0xa4]
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
je 0x422ce6
lea edx, [esp + 0x14]
cmp edx, ecx
je 0x422ce6
xor edx, edx
mov dword [ecx], edx
mov ebx, dword [ecx + 4]
mov dword [ecx + 4], edx
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
mov dword [ecx + 8], edx
lea eax, [esi + 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x14], ebx
je 0x422d05
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00422a85
xor ebx, ebx
and dword [esp + 0x24], ebx
and dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
lea eax, [esi + 0x308]
push eax
mov byte [esp + 0x3c], 2
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [esi + 0x98]
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
je 0x422d58
lea edx, [esp + 0x20]
cmp edx, ecx
je 0x422d58
xor edx, edx
mov dword [ecx], edx
mov ebx, eax
mov eax, dword [ecx + 4]
mov dword [ecx + 4], edx
mov dword [esp + 0x24], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], eax
mov dword [ecx + 8], edx
lea eax, [esi + 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, dword [esp + 0x24]
je 0x422dba
cmp dword [esi + 0x64], 0
je 0x422db1
cmp dword [esi + 0x4c], 0
je 0x422db1
test edi, edi
jne 0x422da4
lea eax, [esi + 0xe0]
cmp dword [eax + 0x14], 0x10
jb 0x422d89
mov eax, dword [eax]
push 0x461d0c
push eax
call fcn.00430080
pop ecx
pop ecx
mov edi, eax
push edi
mov ecx, esi
call fcn.00422e49
test edi, edi
je 0x422db1
push edi
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call fcn.00422ec5
lea ecx, [esp + 0x20]
call fcn.004156e4
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x20]
call fcn.00404ee2
or dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x14]
test eax, eax
je 0x422df1
push eax
call fcn.0042d3cd
and dword [esp + 0x18], 0
and dword [esp + 0x1c], 0
and dword [esp + 0x20], 0
pop ecx
cmp byte [esi + 0x96], 0
lea eax, [esi + 0x308]
jne 0x422c6a
test edi, edi
je 0x422e0f
push edi
call fcn.0042f520
pop ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422e49
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x452327
call fcn.0043364b
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x422ebd
lea edi, [ebx + 0x54]
cmp dword [edi + 0x14], 0x10
jb 0x422e6e
mov ecx, dword [edi]
jmp 0x422e70
mov ecx, edi
push eax
push dword [ebx + 0x64]
push 1
push ecx
call fcn.0042f436
push dword [ebp - 0x2c]
mov esi, eax
call fcn.0042fc4b
add esp, 0x14
cmp esi, 8
je 0x422ebd
push 0x45f645
lea ecx, [ebp - 0x28]
call fcn.004012d4
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
push edi
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 0x28]
push eax
push 6
mov ecx, ebx
call fcn.00423492
lea ecx, [ebp - 0x28]
call fcn.00401303
call fcn.004335fa
ret 4

Function at 0x422ec5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 0
push ebx
push esi
mov dword [ebp - 4], ecx
jne 0x422ed6
int3
mov esi, dword [ebp + 8]
push 0x18
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
cdq
pop ebx
idiv ebx
test eax, eax
jne 0x422eeb
int3
xor ebx, ebx
jmp 0x422ef5
add ebx, dword [ecx + 0x10]
add ecx, 0x18
cmp ecx, dword [esi + 4]
jne 0x422eef
test bl, 7
je 0x422f09
shr ebx, 3
lea ebx, [ebx*8 + 8]
push ebx
call fcn.0042df38
pop ecx
push ebx
mov esi, eax
push 0
push esi
call fcn.00435650
mov ecx, dword [ebp - 4]
add esp, 0xc
push ebx
push esi
push dword [ebp + 8]
call fcn.00422f4f
push dword [ebp + 0xc]
push ebx
push 1
push esi
call fcn.0042f436
push dword [ebp + 0xc]
call fcn.0042fc4b
add esp, 0x14
push esi
call fcn.0042df00
pop ecx
pop esi
pop ebx
leave
ret 8