joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40191b
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, 0x17
push ebx
push esi
mov dword [ebp - 0x4c], eax
push edi
mov esi, ecx
mov dword [ebp - 0x50], 0x15
xor ebx, ebx
mov dword [ebp - 0x40], eax
mov eax, 0x1a
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], eax
mov eax, 0x1b
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov eax, 0x1c
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x48], 0x18
mov dword [ebp - 0x44], 0x16
mov dword [ebp - 0x3c], 0x19
push 0x40d05c
push dword [ebp + 8]
call fcn.00407070
add esp, 8
mov dword [ebp - 4], eax
push 0x104
call fcn.00407060
add esp, 4
mov dword [esi + 0x25c], eax
mov byte [eax], bl
cmp dword [ebp - 4], ebx
je 0x401b2b
lea ecx, [ebp - 0x194]
xor edi, edi
push dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x50]
mov dword [ebp - 8], eax
push 0x19
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 8]
push dword [ecx]
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x4019ee
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x401a00
inc edi
lea eax, [ebp - 0x14]
add dword [ebp - 8], 0xc
cmp dword [ebp - 8], eax
jb 0x4019c5
jmp 0x401aff
imul edi, edi, 0xc
mov eax, dword [ebp + edi - 0x4c]
test eax, eax
je 0x401a98
push 0x104
lea ecx, [ebp - 0x298]
push ecx
push eax
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x23
lea ecx, [ebp - 0x90]
push ecx
push dword [ebp + edi - 0x48]
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x298]
push ecx
push 0xf003f
push ebx
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401ae7
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x194]
push eax
lea edx, [ebp - 0x10]
push ecx
lea eax, [ebp - 0x90]
mov dword [ebp - 0x14], 0x104
mov dword [ebp - 0x10], 1
push edx
push ebx
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401ae7
mov eax, dword [ebp + edi - 0x48]
cmp eax, 0x1a
je 0x401aad
cmp eax, 0x1b
je 0x401ac1
cmp eax, 0x1c
je 0x401ad5
jmp 0x401ae7
push 0x104
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x401ae7
push 0x104
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x401ae7
lea eax, [ebp - 0x194]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x401aff
mov al, byte [ebp + eax - 0x195]
lea eax, [ebp - 0x194]
push eax
push dword [esi + 0x25c]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40d05c
push ebx
call fcn.00407070
add esp, 8
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x4019ad
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401d8f
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
push ebx
push pe_nt_image_headers32
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov edi, eax
je 0x401e69
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push edi
call fcn.004010ce
add esp, 4
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x401def
push 0x40c458
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xd
push eax
call fcn.00406f00
push 0
lea ebx, [esi + 0x280]
push 0
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esi + 4]
push ebx
push 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [esi + 4]
call fcn.00407060
add esp, 4
mov dword [ebp - 4], eax
push 0
push ebx
push dword [esi + 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [esi + 4]
push dword [ebp - 4]
mov ecx, esi
call fcn.004018c5
push dword [esi + 4]
push dword [ebp - 4]
mov ecx, esi
call fcn.00401b34
push dword [ebp - 4]
mov eax, dword [esi + 4]
add eax, dword [ebp - 8]
add eax, 4
mov dword [esi + 8], eax
call fcn.00407050
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401e7e
push 0x40c458
lea eax, [ebp - 4]
mov dword [ebp - 4], 3
push eax
call fcn.00406f00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x401f19
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x80
mov ecx, dword [0x40e2c0]
lea eax, [esp]
push esi
push pe_nt_image_headers32
push eax
push 0x13
push dword [ecx + 0xc]
call dword [sym.imp.USER32.dll_LoadStringA]
push 1
mov eax, 0x40d06c
lea ecx, [esp + 8]
push eax
push eax
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov esi, eax
jg 0x401f65
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
mov eax, esi
pop esi
add esp, 0x80
ret
Function at 0x4027e4
Capabilities:
Get disk information

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov ebp, esp
sub esp, 0x208
test eax, eax
push ebx
push esi
je 0x402910
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x209], 0x5c
je 0x402832
push 0x40d090
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x208]
xor ebx, ebx
push eax
call fcn.00407240
add esp, 4
mov al, byte [ebp - 0x208]
sub al, 0x40
mov byte [ebp - 0x103], bl
mov byte [ebp - 0x104], al
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x402910
push 3
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406d90
add esp, 0xc
lea ecx, [ebp - 0x104]
mov byte [ebp - 0x101], bl
push ecx
call fcn.00401000
add esp, 4
cmp eax, dword [ebp + 0x10]
jb 0x402910
push ebx
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x104]
push str._sPFTW_03X
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x104]
push 0
push ecx
call fcn.00407000
add esp, 8
test eax, eax
jne 0x4028da
inc ebx
cmp ebx, 0xfff
jb 0x40289f
lea eax, [ebp - 0x104]
mov esi, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call fcn.00407240
add esp, 4
push esi
call fcn.00407200
add esp, 4
push 0x40d090
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, 1
jmp 0x402912
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402918
Capabilities:
Get common file path
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x402b5c
call fcn.00407788
sub esp, 0x234
push ebx
push esi
push edi
mov esi, ecx
mov edi, 0x104
lea eax, [ebp - 0x13c]
lea ebx, [esi + 0x24]
mov dword [ebp - 0x10], esp
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push ebx
push str.TEMP
call fcn.004076f0
add esp, 4
push eax
call fcn.004027e4
add esp, 0xc
test eax, eax
jne 0x402985
push edi
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
lea eax, [ebp - 0x240]
push ebx
push eax
call fcn.004027e4
add esp, 0xc
push ebx
mov edi, dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.pftw.cab
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea eax, [ebp - 0x13c]
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x4029d8
push 0x40c458
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 5
push eax
call fcn.00406f00
push 0
push pe_nt_image_headers32
push 2
push 0
push 2
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x402a17
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40c458
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 6
push eax
call fcn.00406f00
mov edi, dword [esi]
xor ebx, ebx
push 0x1000
call fcn.00407060
add esp, 4
mov dword [ebp - 0x1c], eax
push ebx
push ebx
push dword [esi + 8]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push str.Reading_package...
push 0x3f1
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x640000
push ebx
push 0x401
push 0x3f0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov dword [ebp - 4], ebx
cmp dword [esi], ebx
je 0x402afa
mov ecx, dword [esi]
mov eax, 0x1000
cmp ecx, eax
jb 0x402a7d
mov ecx, eax
mov dword [ebp - 0x20], ecx
push 0
lea eax, [ebp - 0x30]
push eax
push ecx
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402ac1
mov dword [ebp - 0x2c], 0x1e
push 0x40c458
lea eax, [ebp - 0x2c]
push eax
call fcn.00406f00
push 0
call fcn.00401051
add esp, 4
mov eax, dword [ebp - 0x20]
sub dword [esi], eax
add ebx, eax
mov eax, ebx
imul eax, eax, 0x64
sub edx, edx
div edi
push 0
push eax
push 0x402
push 0x3f0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
cmp dword [esi], 0
jne 0x402a70
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call fcn.00407050
add esp, 4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x402b66
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x44
push esi
push edi
lea esi, [ecx + 0x264]
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esi]
cmp eax, 3
je 0x402bbc
or byte [ebp - 0x2c], 1
test eax, eax
je 0x402ba6
cmp eax, 1
je 0x402bae
cmp eax, 2
je 0x402bb6
jmp 0x402bbc
mov word [ebp - 0x28], 5
jmp 0x402bbc
mov word [ebp - 0x28], 6
jmp 0x402bbc
mov word [ebp - 0x28], 3
mov eax, dword [edi + 0x25c]
test eax, eax
jne 0x402bc9
lea eax, [edi + 0x24]
push eax
lea ecx, [ebp - 0x260]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x260]
lea ecx, [ebp - 0x15c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x15c]
push ecx
call fcn.004010b1
add esp, 4
lea edx, [ebp - 0x15c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [edi + 0x254]
push edx
add edi, 0x258
call ebx
lea ecx, [ebp - 0x260]
push ecx
call fcn.00401037
add esp, 4
cmp dword [edi], 0
je 0x402c42
push 0x40d0bc
lea eax, [ebp - 0x15c]
push eax
call ebx
push dword [edi]
lea ecx, [ebp - 0x15c]
push ecx
call ebx
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x58]
push eax
lea edx, [ebp - 0x260]
push ecx
mov eax, dword [esi]
push edx
xor ecx, ecx
push ecx
sub eax, 3
cmp eax, 1
lea edx, [ebp - 0x15c]
sbb eax, eax
and eax, 8
push eax
push ecx
push ecx
push ecx
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x402c8e
push 0x40c458
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xc
push eax
call fcn.00406f00
jmp 0x402caa
push 0
call fcn.00401051
add esp, 4
push 0x64
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x402c8e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402cb1
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
lea eax, [ebp - 0x348]
push esi
push edi
lea edi, [ecx + 0x24]
mov esi, ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40d0c0
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 7
call fcn.00401051
add esp, 4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x348]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov ebx, eax
je 0x402d58
test byte [ebp - 0x140], 0x10
jne 0x402d3f
push edi
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x114]
lea ecx, [ebp - 0x244]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402d07
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [eax + esi + 0x23], 0
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40304c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 4]
push esi
push 0x40d108
mov esi, ecx
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40307e
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40307e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x403080
xor eax, eax
pop esi
ret 4

Function at 0x404a6c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x404ab3
cmp edx, 0x10
jl 0x404a9f
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x404a8c
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x404ab3
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x404aab
and edx, 3
cmp edx, 3
jne 0x404ac7
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x404acc
cmp edx, 2
jne 0x404ad8
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x404add
cmp edx, 1
jne 0x404ae3
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x4069d0
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x418
cmp dword [0x40f620], edx
push ebx
push esi
push edi
push ebp
jbe 0x406bd7
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x40f520
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ecx, dword [esp + 0x18]
shl eax, 3
mov ebx, dword [ecx]
mov ebp, eax
mov dword [esp + 0x1c], eax
mov al, byte [ebx + ebp + 4]
test al, 1
je 0x406bd7
xor esi, esi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], esi
cmp ebp, esi
jne 0x406a39
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
test al, 0x20
je 0x406a4a
push 2
push 0
push edx
call fcn.00406cd0
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x406ae6
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x406b1f
lea edi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x406aad
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x406a9b
mov byte [edi], 0xd
inc esi
inc edi
mov byte [edi], al
inc edi
mov eax, edi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x406a82
lea eax, [esp + 0x24]
push 0
sub edi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push edi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x406b15
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, edi
jge 0x406a6d
jmp 0x406b1f
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x406b15
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x406b1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x406bc6
cmp dword [esp + 0x10], 0
je 0x406b78
cmp dword [esp + 0x10], 5
jne 0x406b5b
mov dword [0x40db10], 9
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [0x40db14], eax
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.00408b60
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x406ba2
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x406ba2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x40db10], 0x1c
mov dword [0x40db14], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, esi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x40db10], 9
mov dword [0x40db14], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x407000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x407025
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00408b60
add esp, 4
mov eax, 0xffffffff
ret
test al, 1
je 0x40704a
test byte [esp + 8], 2
je 0x40704a
mov dword [0x40db10], 0xd
mov dword [0x40db14], 5
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x407200
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov eax, 0
jne 0x40721c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40722f
push eax
call fcn.00408b60
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x407a10
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c028
push 0x40a604
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x40db1c], eax
xor eax, eax
mov al, byte [0x40db1d]
mov dword [0x40db28], eax
mov eax, dword [0x40db1c]
shr dword [0x40db1c], 0x10
and eax, 0xff
mov dword [0x40db24], eax
shl eax, 8
add eax, dword [0x40db28]
mov dword [0x40db20], eax
call fcn.00407c10
test eax, eax
jne 0x407a84
push 0x1c
call fcn.00407bb0
add esp, 4
mov dword [ebp - 4], 0
call fcn.00408730
call fcn.0040a5f0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40f634], eax
call fcn.0040a1a0
mov dword [0x40d2d0], eax
test eax, eax
je 0x407ab7
cmp dword [0x40f634], 0
jne 0x407ac1
push 0xffffffffffffffff
call fcn.00408620
add esp, 4
call fcn.00409f20
call fcn.00409e30
call fcn.004085f0
mov esi, dword [0x40f634]
mov al, byte [esi]
cmp al, 0x22
je 0x407ae8
cmp al, 0x20
jbe 0x407b15
inc esi
cmp byte [esi], 0x20
ja 0x407ae0
jmp 0x407b15
inc esi
cmp byte [esi], 0x22
je 0x407b14
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x407b0f
xor eax, eax
mov al, bl
push eax
call fcn.00409dd0
add esp, 4
test eax, eax
je 0x407b09
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x407af1
cmp byte [esi], 0x22
jne 0x407b15
inc esi
cmp byte [esi], 0
je 0x407b25
cmp byte [esi], 0x20
ja 0x407b25
inc esi
cmp byte [esi], 0
jne 0x407b1a
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x407b49
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00408620
jmp 0x407b8a
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408480
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1004
call fcn.0040a9a0
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [esp + 0x1014]
push ebp
cmp dword [0x40f620], esi
jbe 0x4085cd
mov eax, esi
mov ecx, esi
and eax, 0xffffffe7
and ecx, 0x1f
sar eax, 3
mov edx, dword [eax + 0x40f520]
test byte [edx + ecx*8 + 4], 1
je 0x4085cd
push 1
push ebx
push esi
call fcn.00406cd0
mov dword [esp + 0x1c], eax
add esp, 0xc
cmp eax, 0xffffffff
je 0x4085bd
push 2
push ebx
push esi
call fcn.00406cd0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4085bd
mov ecx, dword [esp + 0x101c]
mov ebp, ecx
sub ebp, eax
test ebp, ebp
jle 0x408563
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, 0x400
push 0x8000
rep stosd dword es:[edi], eax
push esi
call fcn.0040a920
add esp, 8
mov edi, eax
mov eax, 0x1000
cmp ebp, eax
jge 0x408526
mov eax, ebp
push eax
lea eax, [esp + 0x18]
push eax
push esi
call fcn.004069d0
add esp, 0xc
cmp eax, 0xffffffff
je 0x408542
sub ebp, eax
test ebp, ebp
jg 0x40851b
jmp 0x408557
cmp dword [0x40db14], 5
jne 0x408555
mov dword [0x40db10], 0xd
mov ebx, eax
push edi
push esi
call fcn.0040a920
add esp, 8
jmp 0x4085a0
jge 0x4085a0
push 0
push ecx
push esi
call fcn.00406cd0
add esp, 0xc
push esi
call fcn.00408b10
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sbb ebx, ebx
cmp ebx, 0xffffffff
jne 0x4085a0
mov dword [0x40db10], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x40db14], eax
mov eax, dword [esp + 0x10]
push 0
push eax
push esi
call fcn.00406cd0
add esp, 0xc
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x40db10], 9
pop edi
pop esi
pop ebx
add esp, 0x1004
ret

Function at 0x408660
Capabilities:
Terminate process

Disassembly:
cmp dword [0x40db58], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x40867e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x40db54], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x40db50], bl
jne 0x4086d8
cmp dword [0x40f628], 0
je 0x4086c6
mov edi, dword [0x40f624]
sub edi, 4
cmp edi, dword [0x40f628]
jb 0x4086c6
mov eax, dword [edi]
test eax, eax
je 0x4086bb
call eax
sub edi, 4
cmp edi, dword [0x40f628]
jae 0x4086b3
push 0x40d01c
push 0x40d018
call fcn.00408710
add esp, 8
push 0x40d024
push 0x40d020
call fcn.00408710
add esp, 8
test ebx, ebx
jne 0x4086ff
mov dword [0x40db58], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret