joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x40ba5b
cmp dword [edi + 4], 0
jl 0x40ba5b
mov eax, dword [edi + 0x24]
lea ecx, [edi + 0x2c]
sub eax, dword [edi + 0x20]
mov edx, dword [edi + 0x1c]
sar eax, 1
push esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
lea eax, [eax*2 - 2]
mov dword [ebp - 4], edx
mov dword [ecx], eax
xor eax, eax
mov esi, dword [edi + 0x20]
lea ecx, [edi + 8]
cmp esi, dword [edi + 0x24]
cmove esi, eax
call fcn.0041a940
lea ecx, [edi + 0x2c]
push ecx
push esi
lea edx, [edi + 0x30]
push edx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [edi + 4]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
jne 0x40ba3d
mov ecx, dword [edi + 0x2c]
mov eax, dword [edi + 0x24]
inc ecx
sub eax, dword [edi + 0x20]
shr ecx, 1
inc ecx
sar eax, 1
cmp ecx, eax
jbe 0x40b9ea
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push ecx
lea ecx, [edi + 0x20]
call fcn.0040c010
mov eax, dword [edi + 0x24]
mov ecx, 0x4000
sub eax, dword [edi + 0x20]
sar eax, 1
lea eax, [eax*2 - 2]
mov dword [edi + 0x2c], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 4], eax
mov esi, dword [edi + 0x20]
cmove eax, ecx
xor ecx, ecx
cmp esi, dword [edi + 0x24]
mov edx, eax
mov dword [ebp - 4], eax
cmove esi, ecx
lea ecx, [edi + 8]
call fcn.0041a940
lea ecx, [edi + 0x2c]
push ecx
push esi
lea ecx, [edi + 0x30]
push ecx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [edi + 4]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
pop esi
test eax, eax
jne 0x40ba5b
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov eax, dword [edi + 0x20]
inc ecx
shr ecx, 1
xor edx, edx
pop edi
pop ebx
mov word [eax + ecx*2], dx
mov al, 1
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x1c], 8
lea eax, [edi + 8]
jb 0x40ba66
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [edi + 0x20]
mov word [eax], cx
xor al, al
mov dword [edi + 0x2c], ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bbd0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
or eax, 0x20019
push esi
mov esi, ecx
push esi
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bc1d
push eax
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x40bc30
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], 0
xor eax, eax
mov word [esi + 8], ax
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi]
dec ecx
mov dword [esi + 4], ecx
test edx, edx
je 0x40bc66
test ecx, ecx
js 0x40bc66
lea eax, [ebp - 8]
mov dword [ebp + 0x10], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp + 0x10]
push eax
lea eax, [esi + 8]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40bc6c
xor eax, eax
mov word [esi + 8], ax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410da0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x260
mov eax, dword [0x55e0a0]
xor eax, esp
mov dword [esp + 0x25c], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
cmp eax, 0x104
jb 0x410ddf
xor al, al
pop esi
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x410df9
mov al, 1
pop esi
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
mov bl, byte [ebp + 0xc]
test bl, bl
jne 0x410e5b
lea ecx, [esp + 0x28]
call fcn.00432790
mov edx, ecx
mov ecx, esi
call fcn.00412300
test al, al
je 0x410e44
cmp byte [esp + 0x30], bl
je 0x410e44
cmp dword [esi + 0x14], 8
jb 0x410e24
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
pop esi
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x410e4e
mov eax, dword [esi]
jmp 0x410e50
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x410de3
xor eax, eax
push 0x208
push eax
mov word [esp + 0x58], ax
lea eax, [esp + 0x5a]
push eax
call fcn.004dbc00
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x410e7d
mov esi, dword [esi]
lea ecx, [esp + 0x50]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x410e81
mov word [esp + 0x24], ax
xorps xmm0, xmm0
mov dword [esp + 8], 0
lea eax, [esp + 0x50]
movq qword [esp + 0x1c], xmm0
movdqu xmmword [esp + 0xc], xmm0
mov dword [esp + 0x10], eax
mov eax, 0x414
mov dword [esp + 0xc], 3
mov word [esp + 0x18], ax
test bl, bl
jne 0x410ed6
mov eax, 0x1494
mov word [esp + 0x18], ax
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [esp + 0x1a], 0
jne 0x410dc9
test eax, eax
je 0x410f17
cmp eax, 2
je 0x410f17
cmp eax, 0x402
je 0x410f17
cmp eax, 0x7c
je 0x410f17
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x264]
mov eax, 1
pop esi
pop ebx
xor ecx, esp
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
Function at 0x4114a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4114ae
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x4114f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x4114f8
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41150b
shr eax, 4
and eax, 1
ret
xor al, al
ret

Function at 0x411510
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x55e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x210]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x41162f
sub esp, 8
lea eax, [ebp - 0x210]
mov edx, esp
mov dword [edx], eax
cmp word [ebp - 0x210], 0
jne 0x411560
xor ecx, ecx
jmp 0x41157f
lea ecx, [ebp - 0x210]
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411570
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x240]
call fcn.0040d9a0
sub esp, 8
mov edx, esp
cmp dword [eax + 0x14], 8
jb 0x41159c
mov ecx, dword [eax]
jmp 0x41159e
mov ecx, eax
mov dword [edx], ecx
lea ecx, [ebp - 0x228]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.0040d9a0
lea ecx, [ebp - 0x228]
call fcn.0040f420
lea eax, [ebp - 0x228]
cmp esi, eax
je 0x4115d2
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00406910
cmp dword [ebp - 0x214], 8
jb 0x4115e9
push dword [ebp - 0x228]
call fcn.004daf7e
add esp, 4
xor eax, eax
mov dword [ebp - 0x214], 7
cmp dword [ebp - 0x22c], 8
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
jb 0x41161d
push dword [ebp - 0x240]
call fcn.004daf7e
add esp, 4
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
Function at 0x411830
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x55e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x14], 8
push esi
push edi
mov esi, edx
mov dword [ebp - 0x450], 0
jb 0x411859
mov ecx, dword [ecx]
lea eax, [ebp - 0x210]
push eax
push 0
push 0x545198
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x411884
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x104
ja 0x411947
test eax, eax
je 0x411947
xor ecx, ecx
mov dword [ebp - 0x420], 7
push eax
lea eax, [ebp - 0x41c]
mov word [ebp - 0x434], cx
push eax
lea ecx, [ebp - 0x434]
mov dword [ebp - 0x424], 0
call fcn.004063e0
sub esp, 8
lea eax, [ebp - 0x434]
cmp dword [ebp - 0x420], 8
mov ecx, esp
cmovae eax, dword [ebp - 0x434]
mov dword [ecx], eax
mov eax, dword [ebp - 0x424]
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x44c]
call fcn.0040d9a0
cmp esi, eax
je 0x41191f
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00406910
cmp dword [ebp - 0x438], 8
jb 0x411936
push dword [ebp - 0x44c]
call fcn.004daf7e
add esp, 4
cmp dword [ebp - 0x420], 8
jb 0x4119b4
push dword [ebp - 0x434]
jmp 0x4119ac
sub esp, 8
lea eax, [ebp - 0x210]
mov edx, esp
mov dword [edx], eax
cmp word [ebp - 0x210], 0
jne 0x411962
xor ecx, ecx
jmp 0x41197f
lea ecx, [ebp - 0x210]
lea edi, [ecx + 2]
jmp 0x411970
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411970
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x44c]
call fcn.0040d9a0
cmp esi, eax
je 0x41199d
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00406910
cmp dword [ebp - 0x438], 8
jb 0x4119b4
push dword [ebp - 0x44c]
call fcn.004daf7e
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
Function at 0x4119d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x55e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
mov dword [ebp - 0x50], eax
xor eax, eax
push edi
mov dword [ebp - 0x58], edx
xor edi, edi
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jmp 0x411a10
xor eax, eax
mov dword [ebp - 8], 7
push 0xffffffffffffffff
push eax
push edx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], 0
mov word [ebp - 0x1c], ax
call fcn.00406910
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x4c]
call fcn.0042df90
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040c6a0
cmp dword [ebp - 0x38], 8
jb 0x411a61
push dword [ebp - 0x4c]
call fcn.004daf7e
add esp, 4
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
cmovae ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x1c]
cmovae ecx, dword [ebp - 0x1c]
test eax, eax
je 0x411a81
sub eax, ecx
sar eax, 1
push 0x5f
push 1
push eax
lea ecx, [ebp - 0x1c]
call fcn.00413110
sub esp, 8
call fcn.00434520
add esp, 8
lea ecx, [ebp - 0x4c]
mov edx, eax
call fcn.0042df90
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040c6a0
cmp dword [ebp - 0x38], 8
jb 0x411ac4
push dword [ebp - 0x4c]
call fcn.004daf7e
add esp, 4
sub esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 8
mov ecx, esp
cmovae eax, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x4c]
mov ecx, dword [ebp - 0x54]
push eax
call fcn.0040ebf0
lea ecx, [ebp - 0x34]
cmp ecx, eax
je 0x411af9
push 0xffffffffffffffff
push 0
push eax
call fcn.00406910
cmp dword [ebp - 0x38], 8
jb 0x411b0a
push dword [ebp - 0x4c]
call fcn.004daf7e
add esp, 4
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push 0
cmovae eax, dword [ebp - 0x34]
push eax
call ebx
test eax, eax
jne 0x411b40
cmp dword [ebp - 8], 8
jb 0x411b2f
push dword [ebp - 0x1c]
call fcn.004daf7e
add esp, 4
mov edx, dword [ebp - 0x58]
inc edi
cmp edi, 0x32
jl 0x411a10
xor bl, bl
jmp 0x411b69
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x34]
cmp eax, ecx
je 0x411b56
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.00406910
cmp dword [ebp - 8], 8
jb 0x411b67
push dword [ebp - 0x1c]
call fcn.004daf7e
add esp, 4
mov bl, 1
cmp dword [ebp - 0x20], 8
jb 0x411b7a
push dword [ebp - 0x34]
call fcn.004daf7e
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
Function at 0x411c00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x55e0a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0
mov esi, edx
cmp dword [edi + 0x14], 8
jb 0x411c2d
mov ebx, dword [edi]
jmp 0x411c2f
mov ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x411c71
test al, 0x10
je 0x411c53
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x411c5d
mov dword [esi], 0xfffffff7
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.0040e0c0
cmp dword [edi + 0x14], 8
jb 0x411c87
mov eax, dword [edi]
jmp 0x411c89
mov eax, edi
push dword [edi + 0x10]
lea ecx, [esp + 0x18]
push eax
push dword [esp + 0x2c]
push 0
call fcn.0040ff70
test eax, eax
jne 0x411cae
test esi, esi
je 0x411cf6
mov dword [esi], 0xfffffffc
xor bl, bl
jmp 0x411cfc
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.00411c00
test al, al
jne 0x411cc1
xor bl, bl
jmp 0x411cfc
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x411cfa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xb7
jne 0x411ce9
mov ecx, edi
call fcn.004114f0
test al, al
jne 0x411cfa
test esi, esi
je 0x411cf6
mov ecx, ebx
call fcn.00433ec0
mov dword [esi], eax
xor bl, bl
jmp 0x411cfc
mov bl, 1
cmp dword [esp + 0x28], 8
jb 0x411d0f
push dword [esp + 0x14]
call fcn.004daf7e
add esp, 4
mov ecx, dword [esp + 0x2c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
Function at 0x412100
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x55e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x14], 8
push ebx
push esi
push edi
mov edi, edx
jb 0x412120
mov ecx, dword [ecx]
push 0
push 0x80
push 3
push 0
push 7
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x23c], 0
test esi, esi
je 0x4122cf
lea ecx, [ebp - 0x23c]
call fcn.00405a50
cmp esi, 0xffffffff
je 0x41219c
mov dword [ebp - 0x23c], esi
call fcn.00416a40
mov ebx, eax
mov eax, dword [ebp + 4]
mov ecx, dword [0x562498]
mov dword [ebp - 0x244], eax
test ecx, ecx
jne 0x412188
call fcn.004249c0
mov ecx, dword [0x562498]
mov eax, dword [ecx]
lea edx, [ebp - 0x23c]
push ebx
push dword [ebp - 0x244]
push edx
push esi
call dword [eax + 4]
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x4122cf
cmp eax, 0xffffffff
je 0x4122cf
push 0
push 1
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
mov dword [ebp - 0x240], 0
test esi, esi
je 0x4122c0
lea ecx, [ebp - 0x240]
call fcn.00405a50
cmp esi, 0xffffffff
je 0x412227
mov dword [ebp - 0x240], esi
call fcn.00416a40
mov ebx, eax
mov eax, dword [ebp + 4]
mov ecx, dword [0x562498]
mov dword [ebp - 0x244], eax
test ecx, ecx
jne 0x412213
call fcn.004249c0
mov ecx, dword [0x562498]
mov eax, dword [ecx]
lea edx, [ebp - 0x240]
push ebx
push dword [ebp - 0x244]
push edx
push esi
call dword [eax + 4]
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x4122c0
cmp eax, 0xffffffff
je 0x4122c0
push 1
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x4122c0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x10e
lea ecx, [ebp - 0x220]
push ecx
push esi
push eax
call dword [sym.imp.PSAPI.DLL_GetMappedFileNameW]
test eax, eax
je 0x4122ac
sub esp, 8
lea eax, [ebp - 0x220]
mov ecx, esp
push eax
call fcn.00404400
lea ecx, [ebp - 0x238]
call fcn.0040d9a0
cmp edi, eax
je 0x41229f
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.00406910
lea ecx, [ebp - 0x238]
call fcn.0040da20
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea ecx, [ebp - 0x240]
call fcn.00405a50
jmp 0x4122d1
lea ecx, [ebp - 0x240]
xor bl, bl
call fcn.00405a50
jmp 0x4122d1
xor bl, bl
lea ecx, [ebp - 0x23c]
call fcn.00405a50
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
Function at 0x412dd0
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ecx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.0040f080
test al, al
jne 0x412e3c
mov ecx, esi
call fcn.0040f080
test al, al
jne 0x412e3c
cmp dword [edi + 0x10], 0x104
jae 0x412e3c
cmp dword [esi + 0x10], 0x104
jae 0x412e3c
cmp dword [esi + 0x14], 8
jb 0x412e05
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x412e0d
mov edi, dword [edi]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x412e3c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x412e3c
test al, 1
je 0x412e36
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov al, 1
pop edi
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret

Function at 0x414150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, edx
push esi
mov esi, ecx
test ebx, ebx
je 0x414176
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x414171
mov eax, dword [ebx]
jmp 0x414173
mov eax, ebx
mov byte [eax], 0
call fcn.0040f080
test al, al
je 0x414187
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edx, 0x54a0f8
mov ecx, esi
call fcn.00412430
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x4141a6
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10000
call fcn.004db0c5
push edi
push 0x10000
mov esi, eax
mov dword [ebp - 8], 0
push 1
push esi
call fcn.004df8c3
mov edi, eax
add esp, 0x14
mov dword [ebp - 0x10], edi
test edi, edi
je 0x414225
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x4141f8
sub eax, dword [ebp - 8]
lea edx, [ebp - 0x10]
cmp eax, edi
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
cmovae ecx, edx
push dword [ecx]
mov ecx, ebx
push esi
call fcn.00404f40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sub eax, ecx
cmp eax, edi
jb 0x41423b
push dword [ebp - 0xc]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp - 8], ecx
call fcn.004df8c3
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], edi
test edi, edi
jne 0x4141d6
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004df20b
add esp, 4
test eax, eax
jne 0x41423e
mov byte [ebp - 1], 1
jmp 0x414242
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 0
push ebx
call fcn.004df16e
add esp, 4
test esi, esi
je 0x414258
push esi
call fcn.004db0ce
add esp, 4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414380
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.00411c00
Function at 0x415b80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x55e0a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x40], 0
je 0x415cc4
cmp byte [ebx + 0x45], 0
je 0x415cc4
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x415bcd
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [esp + 0x14], 0
xorps xmm0, xmm0
mov dword [esp + 0x28], ecx
cmp ecx, 0x10
movq qword [esp + 0x14], xmm0
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 8
cmovae eax, dword [esp + 0x14]
mov byte [eax + 8], 0
lea esp, [esp]
cmp dword [esp + 0x28], 0x10
lea eax, [esp + 0x10]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x14]
cmovae edi, dword [esp + 0x14]
lea esi, [esp + 0x14]
cmovae esi, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x415c41
dec eax
je 0x415c45
sub eax, 2
je 0x415c9b
xor bl, bl
jmp 0x415c9d
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x14]
mov edx, dword [esp + 0x14]
cmp ecx, 0x10
mov esi, dword [esp + 0x10]
cmovae eax, edx
sub esi, eax
je 0x415c7c
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x18]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004e4de8
add esp, 0x10
cmp esi, eax
jne 0x415c3d
cmp byte [ebx + 0x45], 0
je 0x415c9b
test esi, esi
jne 0x415c00
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.00405030
jmp 0x415c00
mov bl, 1
cmp dword [esp + 0x28], 0x10
jb 0x415cb0
push dword [esp + 0x14]
call fcn.004daf7e
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret

Function at 0x41f440
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x55e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x20], 0
mov ecx, str._t_n_v_f_r
mov dword [ebp - 8], 7
mov dword [ebp - 0xc], 0
mov word [ebp - 0x1c], ax
lea esi, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f480
sub ecx, esi
lea eax, [ebp - 0x1c]
sar ecx, 1
push eax
push ecx
push str._t_n_v_f_r
mov ecx, edx
call fcn.00419b00
add esp, 0xc
cmp dword [ebp - 0xc], 0
je 0x41f4da
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], 0
cmovae eax, dword [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, edi
push esi
push dword [ebp - 0x20]
call fcn.0041e3d0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], 8
jb 0x41f4eb
push dword [ebp - 0x1c]
call fcn.004daf7e
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret 4