joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403310
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x489008], 0x8088405
inc edx
mov dword [ebx + 0x489008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x408b8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x408bde
test eax, edx
je 0x408be1
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x408ba1
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x408bc7
add ecx, 4
js 0x408bb7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x408bc4
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x408bed
test edx, edx
jne 0x408b94
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4094a8
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
or eax, 0xffffffff
mov esi, ebx
and esi, 3
cmp esi, 2
ja 0x4094fb
mov edx, ebx
and edx, 0xf0
cmp edx, 0x40
ja 0x4094fb
push 0
push 0x80
push 3
push 0
mov eax, ebx
and eax, 0xf0
shr eax, 4
mov eax, dword [eax*4 + 0x489844]
push eax
mov eax, dword [esi*4 + 0x489838]
push eax
mov eax, edi
call fcn.00404fec
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
pop edi
pop esi
pop ebx
ret

Function at 0x409774
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
jmp 0x409797
lea eax, [ebx + 0x20]
push eax
mov eax, dword [ebx + 0x1c]
push eax
call sub.KERNEL32.DLL_GetVersion
test eax, eax
jne 0x409797
call sub.KERNEL32.DLL_SetErrorMode
mov esi, eax
jmp 0x4097f0
mov eax, dword [ebx + 0x20]
and eax, dword [ebx + 0x18]
jne 0x40977d
push esp
lea eax, [ebx + 0x34]
push eax
call sub.KERNEL32.DLL_GetTempPathA
push ebx
lea eax, [ebx + 2]
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetLocalTime
mov eax, dword [ebx + 0x40]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x3c]
xor edx, edx
mov edx, eax
xor eax, eax
or eax, dword [esp]
or edx, dword [esp + 4]
add esp, 8
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x10], eax
lea eax, [ebx + 0x14]
lea edx, [ebx + 0x4c]
mov ecx, 0x104
call fcn.00404dcc
xor esi, esi
mov eax, esi
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x409958
Capabilities:
Clear file content

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
push esp
lea eax, [esp + 8]
push eax
push 0x104
mov eax, ebx
call fcn.00404fec
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov ecx, eax
lea edx, [esp + 4]
mov eax, esi
call fcn.00404c4c
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x40b6b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40b81a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404b5c
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0xe]
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0x10]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0x12]
mov word [ebp - 0xe], ax
lea eax, [ebp - 4]
mov edx, 0x40b830
call fcn.00404bf4
push 0x100
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 4]
call fcn.00404fec
push eax
lea eax, [ebp - 0x14]
push eax
push 4
call sub.KERNEL32.DLL_WinExec
push eax
call sub.KERNEL32.DLL_MulDiv
test eax, eax
je 0x40b7f9
mov eax, ebx
lea edx, [ebp - 0x114]
mov ecx, 0x100
call fcn.00404dcc
dec esi
jne 0x40b7f9
mov eax, dword [0x48f8c8]
sub eax, 4
je 0x40b78c
sub eax, 0xd
jne 0x40b7f9
push ebx
mov eax, dword [ebx]
mov edx, 1
call fcn.0040de4c
mov ecx, eax
mov eax, dword [ebx]
mov edx, 1
call fcn.00405054
jmp 0x40b7f9
cmp dword [0x48f8cc], 1
jne 0x40b7f9
mov eax, dword [ebx]
mov dword [ebp - 0x118], eax
mov esi, dword [ebp - 0x118]
test esi, esi
je 0x40b7ac
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebx]
mov edx, esi
call fcn.0040dcac
cmp eax, 4
jne 0x40b7f9
mov eax, dword [ebx]
mov edx, 3
call fcn.0040ddc8
mov esi, eax
lea eax, [ebp - 0x114]
add esi, eax
dec esi
lea eax, [ebp - 0x11c]
mov edx, esi
call fcn.00404d54
mov eax, dword [ebp - 0x11c]
mov edx, 2
call fcn.0040de4c
mov ecx, eax
mov eax, ebx
mov edx, esi
call fcn.00404c4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b821
lea eax, [ebp - 0x11c]
call fcn.00404b5c
lea eax, [ebp - 4]
call fcn.00404b5c
ret
Function at 0x40b834
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40b922
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404b5c
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0xe]
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0x10]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0x12]
mov word [ebp - 0xe], ax
cmp esi, 2
jg 0x40b892
lea eax, [ebp - 4]
mov edx, 0x40b938
call fcn.00404bf4
jmp 0x40b89f
lea eax, [ebp - 4]
mov edx, 0x40b944
call fcn.00404bf4
push 0x100
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 4]
call fcn.00404fec
push eax
lea eax, [ebp - 0x14]
push eax
push 4
call sub.KERNEL32.DLL_WinExec
push eax
call sub.KERNEL32.DLL_MulDiv
test eax, eax
je 0x40b90c
mov eax, ebx
lea edx, [ebp - 0x114]
mov ecx, 0x100
call fcn.00404dcc
dec esi
jne 0x40b90c
mov eax, dword [ebx]
cmp byte [eax], 0x30
jne 0x40b90c
mov eax, dword [ebx]
mov dword [ebp - 0x118], eax
mov esi, dword [ebp - 0x118]
test esi, esi
je 0x40b8fc
sub esi, 4
mov esi, dword [esi]
push ebx
mov ecx, esi
dec ecx
mov eax, dword [ebx]
mov edx, 2
call fcn.00405054
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b929
lea eax, [ebp - 4]
call fcn.00404b5c
ret

Function at 0x40cad4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
jle 0x40cb0d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404c4c
jmp 0x40cb16
mov eax, ebx
mov edx, esi
call fcn.00404bb0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40cb20
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
jle 0x40cb42
movzx eax, byte [esp]
jmp 0x40cb44
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40cb88
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x40cc9b
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_WinExec
mov dword [ebp - 4], eax
mov ebx, 1
mov esi, 0x48f82c
mov edi, 0x48f85c
push ebp
push 0xb
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x489880
mov edx, ebx
dec edx
lea eax, [ebx + 0x44]
dec eax
call fcn.0040cb4c
pop ecx
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00404bb0
push ebp
push 0xb
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4898b0
mov edx, ebx
dec edx
lea eax, [ebx + 0x38]
dec eax
call fcn.0040cb4c
pop ecx
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00404bb0
inc ebx
add edi, 4
add esi, 4
cmp ebx, 0xd
jne 0x40cbbb
mov ebx, 1
mov esi, 0x48f88c
mov edi, 0x48f8a8
lea eax, [ebx + 5]
mov ecx, 7
cdq
idiv ecx
mov dword [ebp - 8], edx
push ebp
push 6
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4898e0
mov edx, ebx
dec edx
mov eax, dword [ebp - 8]
add eax, 0x31
call fcn.0040cb4c
pop ecx
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00404bb0
push ebp
push 6
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4898fc
mov edx, ebx
dec edx
mov eax, dword [ebp - 8]
add eax, 0x2a
call fcn.0040cb4c
pop ecx
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.00404bb0
inc ebx
add edi, 4
add esi, 4
cmp ebx, 8
jne 0x40cc1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cca2
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404b80
ret

Function at 0x40cd60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push esi
xor eax, eax
push ebp
push 0x40cdf7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.KERNEL32.DLL_WinExec
mov ecx, 0x40ce0c
mov edx, 0x100b
call fcn.0040cad4
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.00409240
mov esi, eax
mov eax, esi
add eax, 0xfffffffd
sub eax, 3
jae 0x40cde1
push 4
push esi
call sub.KERNEL32.DLL_WinExec
push eax
push 0x40ccac
call sub.KERNEL32.DLL_GetLastError
mov edx, 7
mov eax, 0x48f8f0
mov dword [eax], 0xffffffff
add eax, 4
dec edx
jne 0x40cdc2
push 3
push esi
call sub.KERNEL32.DLL_WinExec
push eax
push 0x40cce8
call sub.KERNEL32.DLL_GetLastError
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cdfe
lea eax, [ebp - 4]
call fcn.00404b5c
ret
Function at 0x40ce10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40cfe0
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 1
mov eax, edi
call fcn.00404b5c
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_WinExec
mov ecx, 0x40cff8
mov edx, 0x1009
call fcn.0040cad4
mov eax, dword [ebp - 8]
mov edx, 1
call fcn.00409240
add eax, 0xfffffffd
sub eax, 3
jb 0x40cfb6
mov eax, dword [0x48f8c8]
sub eax, 4
je 0x40ce82
add eax, 0xfffffff3
sub eax, 2
jb 0x40ce82
xor eax, eax
jmp 0x40ce84
mov al, 1
test al, al
je 0x40cebf
jmp 0x40ceaf
movzx eax, byte [esi + ebx - 1]
sub al, 0x47
je 0x40ceae
sub al, 0x20
je 0x40ceae
lea eax, [ebp - 0xc]
movzx edx, byte [esi + ebx - 1]
call fcn.00404d44
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404e28
inc ebx
mov eax, esi
call fcn.00404e1c
cmp ebx, eax
jle 0x40ce8a
jmp 0x40cfc5
mov eax, edi
mov edx, esi
call fcn.00404bb0
jmp 0x40cfc5
movzx eax, byte [esi + ebx - 1]
movzx eax, al
bt dword [0x489804], eax
jae 0x40cf0c
mov edx, ebx
mov eax, esi
call fcn.0040dee4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.00405054
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00404e28
add ebx, dword [ebp - 4]
jmp 0x40cfb6
mov edx, 0x40cffc
lea eax, [esi + ebx - 1]
mov ecx, 2
call fcn.00409bb8
test eax, eax
jne 0x40cf35
mov eax, edi
mov edx, 0x40d008
call fcn.00404e28
inc ebx
jmp 0x40cfb5
mov edx, 0x40d00c
lea eax, [esi + ebx - 1]
mov ecx, 4
call fcn.00409bb8
test eax, eax
jne 0x40cf5d
mov eax, edi
mov edx, 0x40d01c
call fcn.00404e28
add ebx, 3
jmp 0x40cfb5
mov edx, 0x40d024
lea eax, [esi + ebx - 1]
mov ecx, 2
call fcn.00409bb8
test eax, eax
jne 0x40cf83
mov eax, edi
mov edx, 0x40d030
call fcn.00404e28
inc ebx
jmp 0x40cfb5
movzx eax, byte [esi + ebx - 1]
sub al, 0x59
je 0x40cf90
sub al, 0x20
jne 0x40cf9e
mov eax, edi
mov edx, 0x40d03c
call fcn.00404e28
jmp 0x40cfb5
lea eax, [ebp - 0x14]
movzx edx, byte [esi + ebx - 1]
call fcn.00404d44
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.00404e28
inc ebx
mov eax, esi
call fcn.00404e1c
cmp ebx, eax
jle 0x40cecd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cfe7
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404b80
ret
Function at 0x40db10
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40dbe6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404bf4
lea eax, [ebp - 4]
call fcn.00405044
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404fec
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40dbd0
mov eax, ebx
call fcn.00402e9c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40dbc9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404fec
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40dbb3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40dbf8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40dbb3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dbd0
mov eax, dword [ebp - 0x10]
call fcn.00402eb8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dbed
lea eax, [ebp - 4]
call fcn.00404b5c
ret

Function at 0x40e184
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xffffffec
push edi
push 0
call sub.KERNEL32.DLL_LoadResource
xor esi, esi
jmp 0x40e1c7
movzx eax, byte [edi + esi + 6]
movzx ebx, byte [edi + esi + 7]
sub bl, al
jb 0x40e1c4
inc ebx
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
movzx eax, al
bts dword [0x489804], eax
inc byte [ebp - 1]
dec bl
jne 0x40e1af
add esi, 2
cmp esi, 0xc
jge 0x40e1d7
movzx eax, byte [edi + esi + 6]
or al, byte [edi + esi + 7]
jne 0x40e19d
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40e1e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, 0x48f8c4
mov dword [esi], 0x409
mov dword [esi + 4], 9
mov dword [esi + 8], 1
call sub.KERNEL32.DLL_WinExec
test eax, eax
je 0x40e20d
mov dword [esi], eax
test ax, ax
je 0x40e228
mov edx, eax
and dx, 0x3ff
movzx edx, dx
mov dword [esi + 4], edx
movzx eax, ax
shr eax, 0xa
mov dword [esi + 8], eax
push esi
mov esi, 0x40e284
mov edi, 0x489804
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
cmp dword [0x4897c0], 4
jle 0x40e253
cmp dword [0x4897bc], 2
jne 0x40e253
mov byte [esi + 0xd], 1
jmp 0x40e262
push 0x4a
call sub.user32.dll_EnableWindow
test eax, eax
setne al
mov byte [esi + 0xd], al
push 0x2a
call sub.user32.dll_EnableWindow
test eax, eax
setne bl
mov byte [esi + 0xc], bl
test bl, bl
je 0x40e27c
push ebp
call fcn.0040e184
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ebd0
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
test dl, dl
je 0x40ebde
add esp, 0xfffffff0
call fcn.00403f80
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00403c44
mov dword [esi + 0xc], 0xffff
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
mov dword [esi + 0x10], eax
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0xffffffff
mov dl, 1
mov eax, dword [0x408870]
call fcn.00403c44
mov dword [esi + 0x20], eax
mov eax, esi
test bl, bl
je 0x40ec3d
call fcn.00403fd8
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret

Function at 0x40ecd0
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, eax
mov bl, 1
call sub.KERNEL32.DLL_MoveFileA
mov edi, eax
cmp edi, dword [ebp + 0x24]
je 0x40ed6f
mov eax, ebp
call fcn.0040ec8c
mov eax, dword [ebp + 0x28]
mov dword [esp + 4], eax
mov edx, esp
mov eax, dword [ebp + 0x20]
call fcn.0040eb04
mov eax, dword [esp]
cmp dword [eax + 0xc], 0
seta bl
test bl, bl
je 0x40ed35
lea eax, [ebp + 0xc]
call fcn.0040ea68
jmp 0x40ed35
lea eax, [ebp + 0xc]
mov edx, 0xffff
call fcn.0040ea88
mov esi, eax
test esi, esi
je 0x40ed35
mov eax, ebp
call fcn.0040ecc0
lea eax, [ebp + 0xc]
mov edx, 0xffff0001
call fcn.0040ea88
cmp eax, 0xffff
jne 0x40ed1b
mov eax, ebp
call fcn.0040ec8c
test bl, bl
je 0x40ed5c
lea eax, [ebp + 0xc]
call fcn.0040ea74
mov dword [ebp + 0x24], edi
lea eax, [ebp + 0x28]
call fcn.0040ea68
dec eax
cmp eax, dword [esp + 4]
sete bl
inc dword [ebp + 0x1c]
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40edcc
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, eax
mov edx, esp
mov eax, dword [edi + 0x20]
call fcn.0040eb04
mov eax, dword [esp]
inc dword [eax + 0xc]
mov eax, dword [esp]
cmp dword [eax + 0xc], 1
seta bl
call sub.KERNEL32.DLL_MoveFileA
cmp eax, dword [edi + 0x24]
je 0x40ee36
test bl, bl
jne 0x40ee36
mov eax, edi
call fcn.0040ecb0
jmp 0x40ee2a
lea eax, [edi + 0xc]
call fcn.0040ea68
mov esi, eax
cmp esi, 0xffff
jne 0x40ee1c
mov eax, edi
call fcn.0040eca4
push 0
call sub.KERNEL32.DLL_DeleteCriticalSection
mov eax, edi
call fcn.0040ecb0
lea eax, [edi + 0xc]
call fcn.0040ea74
test eax, eax
jle 0x40ee03
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ee3c
Capabilities:
Move file

Disassembly:
push ebx
push ecx
mov ebx, eax
mov edx, esp
mov eax, dword [ebx + 0x20]
call fcn.0040eb04
mov eax, dword [esp]
dec dword [eax + 0xc]
mov eax, dword [esp]
cmp dword [eax + 0xc], 0
jne 0x40eea1
mov edx, esp
mov eax, dword [ebx + 0x20]
call fcn.0040eb7c
call sub.KERNEL32.DLL_MoveFileA
cmp eax, dword [ebx + 0x24]
je 0x40eea1
lea eax, [ebx + 0xc]
call fcn.0040ea68
mov ecx, eax
cmp ecx, 0xffff
jne 0x40ee88
mov eax, ebx
call fcn.0040eca4
jmp 0x40eea1
test ecx, ecx
jg 0x40eea1
mov eax, ecx
mov ecx, 0xffff
cdq
idiv ecx
test edx, edx
jne 0x40eea1
mov eax, ebx
call fcn.0040eca4
pop edx
pop ebx
ret
Function at 0x410808
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce8
push ebx
push esi
push edi
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
test byte [eax + 1], 0x20
jne 0x410830
mov eax, 0x80070057
call fcn.004106d4
mov eax, dword [ebp - 0x304]
movzx eax, word [eax]
mov edx, eax
and dx, 0xfff
cmp dx, 0xc
jne 0x41096c
mov edx, dword [ebp - 0x304]
test ah, 0x40
je 0x410868
mov eax, dword [ebp - 0x304]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x308], eax
jmp 0x410877
mov eax, dword [ebp - 0x304]
mov eax, dword [eax + 8]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
movzx eax, word [eax]
mov dword [ebp - 0x310], eax
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x4108fc
inc ebx
xor edi, edi
lea esi, [ebp - 0x300]
mov eax, esi
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
add eax, 4
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x308]
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
call fcn.004106d4
lea eax, [ebp - 0x30c]
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x308]
push eax
call sub.KERNEL32.DLL_CreateEventA
call fcn.004106d4
mov eax, dword [ebp - 0x318]
mov edx, dword [ebp - 0x30c]
sub edx, dword [eax + 4]
inc edx
mov eax, dword [ebp - 0x318]
mov dword [eax], edx
inc edi
add esi, 8
dec ebx
jne 0x41089a
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x410921
inc ebx
lea eax, [ebp - 0x2fc]
lea edx, [ebp - 0x100]
mov ecx, dword [eax]
mov dword [edx], ecx
add edx, 4
add eax, 8
dec ebx
jne 0x410914
push ebp
mov ebx, dword [ebp - 0x310]
dec ebx
mov eax, ebx
call fcn.0041077c
pop ecx
test al, al
je 0x41095f
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp - 0x308]
push eax
call sub.KERNEL32.DLL_CreateFileA
call fcn.004106d4
mov eax, dword [ebp - 0x314]
call fcn.00410a00
push ebp
mov eax, ebx
call fcn.004107ac
pop ecx
test al, al
jne 0x410921
mov eax, dword [ebp - 0x304]
push eax
call fcn.0040f48c
call fcn.004106d4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410aa8
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce0
push ebx
push esi
push edi
mov dword [ebp - 0x308], ecx
mov ebx, edx
mov dword [ebp - 0x304], eax
test byte [ebx + 1], 0x20
jne 0x410ad2
mov eax, 0x80070057
call fcn.004106d4
movzx eax, word [ebx]
mov edx, eax
and dx, 0xfff
cmp dx, 0xc
jne 0x410c59
test ah, 0x40
je 0x410af8
mov eax, dword [ebx + 8]
mov eax, dword [eax]
mov dword [ebp - 0x314], eax
jmp 0x410b01
mov eax, dword [ebx + 8]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
movzx eax, word [eax]
mov dword [ebp - 0x310], eax
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x410b86
inc ebx
xor edi, edi
lea esi, [ebp - 0x300]
mov eax, esi
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
add eax, 4
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
call fcn.004106d4
lea eax, [ebp - 0x30c]
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_CreateEventA
call fcn.004106d4
mov eax, dword [ebp - 0x320]
mov edx, dword [ebp - 0x30c]
sub edx, dword [eax + 4]
inc edx
mov eax, dword [ebp - 0x320]
mov dword [eax], edx
inc edi
add esi, 8
dec ebx
jne 0x410b24
lea eax, [ebp - 0x300]
push eax
mov eax, dword [ebp - 0x310]
push eax
push 0xc
call sub.KERNEL32.DLL_CopyFileA
mov esi, eax
test esi, esi
jne 0x410ba6
call fcn.0041042c
mov eax, dword [ebp - 0x304]
call fcn.00410a00
mov eax, dword [ebp - 0x304]
mov word [eax], 0x200c
mov eax, dword [ebp - 0x304]
mov dword [eax + 8], esi
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x410bea
inc ebx
lea eax, [ebp - 0x2fc]
lea edx, [ebp - 0x100]
mov ecx, dword [eax]
mov dword [edx], ecx
add edx, 4
add eax, 8
dec ebx
jne 0x410bdd
push ebp
mov ebx, dword [ebp - 0x310]
dec ebx
mov eax, ebx
call fcn.00410a1c
pop ecx
test al, al
je 0x410c4a
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_CreateFileA
call fcn.004106d4
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x100]
push eax
push esi
call sub.KERNEL32.DLL_CreateFileA
call fcn.004106d4
mov eax, dword [ebp - 0x318]
mov edx, eax
mov eax, dword [ebp - 0x31c]
call dword [ebp - 0x308]
push ebp
mov eax, ebx
call fcn.00410a4c
pop ecx
test al, al
jne 0x410bea
jmp 0x410c6b
push ebx
mov eax, dword [ebp - 0x304]
push eax
call fcn.0040f494
call fcn.004106d4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41213c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, 0x49198c
push 0x491990
call sub.KERNEL32.DLL_GetFullPathNameA
xor edx, edx
push ebp
push 0x41219d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi]
call fcn.00405da0
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x412185
mov eax, dword [esi]
mov eax, dword [eax + ebx*4]
cmp eax, dword [0x489a1c]
je 0x41217f
call fcn.00403c74
dec ebx
cmp ebx, 0xffffffff
jne 0x41216d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4121a4
push 0x491990
call sub.KERNEL32.DLL_CreateThread
ret