joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40861c
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [eax]
inc ecx
push 0x45113a
mov dword [eax], ecx
call dword [sym.imp.USER32.dll_IntersectRect]
pop ecx
push edi
push 0x4043b0
call 0x408641
dec dword [esi]
jne 0x4086a3
push esi
call dword [eax + 0x18]
push edi
lea esp, [esp + 8]
mov edi, dword [esp + 8]
push 0x4026a8
call 0x408658
push edx
push eax
call dword [ecx + 0x10]
lea esp, [esp + 8]
add dword [esp + 4], edi
push 0xffffffffffffffc5
push dword [esp + 0x28]
push 0x1a
push dword [esp - 0xef]
call 0x40867a
xor eax, eax
mov ecx, dword [esp]
push ecx
lea esp, [esp + 0x14]
pop edi
ret 8
push ecx
shl ecx, 2
push 0x400fe6
push dword [esp + 4]
push 0x400927
push 0x40bd37
call fcn.00402a70
pop ebx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
jne 0x4086bf
pop edi
pop esi
xor eax, eax
pop ebx
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
push edx
push esp
push 0x404378
jmp loc.004844ed

Function at 0x408d90
Capabilities:
Packed with generic packer

Disassembly:
mov ebx, dword [0x451d47]
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x4518a5
push edi
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [eax]

Function at 0x408dd4
Capabilities:
Packed with generic packer

Disassembly:
push 0x4511bf
push 1
lea ecx, [esp + 0x20]
mov ebp, esp
add esp, 0xffffffb4
push 0x4e8f185a
mov dword [esp], ebx
push 0x4e8f185a
mov dword [esp], esi
push 0x400873
push ecx
push 0x30
push 0x3ff5da
call fcn.00402c64
cmp eax, 0xffffffff
jne fcn.00408d90
xor eax, eax

Function at 0x408dfa
Capabilities:
Packed with generic packer

Disassembly:
push 0x4511bf
push 1
lea ecx, [esp + 0x20]
mov ebp, esp
add esp, 0xffffffb4
push 0x4e8f185a
mov dword [esp], ebx
push 0x4e8f185a
mov dword [esp], esi
push 0x400873
push ecx
push 0x30
push 0x3ff5da
call fcn.00402c64
cmp eax, 0xffffffff
jne fcn.00408d90
xor eax, eax

Function at 0x40909c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
push eax
xor dword [esp], eax
xor dword [esp], esi
push 0x400442
push 0x400c53
push eax
push 0x403b30
call fcn.00403147
call fcn.004042a0
cmp eax, 0xffffffff
je 0x4090e2
mov ecx, dword [esp + 8]
push ecx
jmp loc.00484890
mov edx, eax

Function at 0x4096be
Capabilities:
Packed with generic packer

Disassembly:
add edi, edx
cmp eax, 1
je 0x4096fe
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
call eax
mov edx, dword [esp + 4]
call fcn.0040a03b
push dword [esp + 8]
push dword [esp + 8]
push 0x20
push 0x3fb3f1
call fcn.00402dfa
add edi, edx
cmp eax, 1
je 0x409698
cmp eax, 2
je 0x4096a7
movzx eax, word [esi + 0xe]
imul eax, dword [esi + 4]
add eax, 0x1f
shr eax, 3
mov edx, dword [esp + 0x10]
mov dword [eax + 0x1c], edx
mov eax, dword [str.Engine_]
inc dword [eax]
mov eax, dword [0x451085]
pop esi
sub esp, 8
or edi, dword [esp]
add esp, 4
push 0x7f
push 0x40034c
push dword [esp + 4]
push 0x3fdfa7
call fcn.00402fa9
mov ch, 0
adc al, cl
mov eax, 0x451ff2
add byte [eax], dl
Function at 0x409747
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push dword [esp + 0xd]
call fcn.0040977b
xor eax, eax
push 0x451a88
call fcn.00405da8
push 0x451565
call fcn.0040beac
push 0x451117
jmp loc.00484547

Function at 0x409e66
Capabilities:
Packed with generic packer
Query or enumerate registry value

Disassembly:
cmp eax, 0xffffffff
je 0x409e74
mov eax, dword [0x451e45]
lea ecx, [esp + 0xc]
push 1
add esp, 4
leave
push 0x400955
push 0x6a
push 0x400c5b
push 0x3fc00d
call fcn.0040386c
lea ecx, [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x3c]
cmp eax, ebp
mov dword [esp + 0x30], 0xffffffff

Function at 0x40a494
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
mov edi, dword [esp + 8]
push dword [esp - 0x51]
push ecx
push 0xffffffffffffff91
push edx
push dword [esp - 0x41]
call fcn.0040a4ce

Function at 0x40a4ce
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
call fcn.0040e5e8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea esp, [esp + 0x18]
add dword [esp + 4], edi
push 0xfffffffffffffff6
call 0x40a4ea
je 0x40a508
xor eax, eax
pop ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40a4b0
lea esp, [esp + 8]
pop edi
ret 8
mov eax, dword [0x451ce4]
inc dword [eax]
mov eax, dword [0x4510b7]
sub esp, 8
push esp
push dword [esp + 4]
push 0x400fcd
push 0xffffffffffffff82
push 0x3f9ac1
call fcn.00402c64
jmp loc.004840fb

Function at 0x40a642
Capabilities:
Get disk information

Disassembly:
add byte [eax], al
push ebp
push edi
push dword [esp + 0x75]
push eax
push dword [esp + 0x43]
call 0x40a660
call fcn.00404065
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea esp, [esp + 0x10]
mov edi, dword [esp + 8]
push ebp
push 0x405a00
push dword [esp - 0x23]
call 0x40a681
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x40a67d
lea esp, [esp + 0x10]
add dword [esp + 4], edi
push 0x3d
push dword [esp - 0x28]
push 0x32
push dword [esp - 0xab]
call 0x40a6b2
inc dword [eax]
mov eax, dword [0x451d52]
pop esi
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
lea esp, [esp + 0x14]
pop edi
ret 0xc

Function at 0x40a9e9
Capabilities:
Get file size

Disassembly:
push ebp
call fcn.00407fe9
push eax
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
pop edi
pop esi
push edi
push dword [esp - 0x4d]
push dword [esp - 0xfb]
push 0x401ad0
push 0x60
push dword [esp - 0x8f]
call fcn.0040aa2a
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [ebp + 8]
Function at 0x40ac32
Capabilities:
Set file attributes

Disassembly:
push 1
push ecx
mov ecx, dword [esp + 8]
call fcn.00404c6b
cmp eax, 0xffffffff
mov dword [ebp - 0x44], esp
push 0x400224
push dword [esp + 4]
push 0xffffffffffffff8d
push 0x3f9a26
call fcn.00402fa9
sub esp, 0xc
mov edx, dword [esp + 0x14]
lea ebx, [ebx]
movzx ecx, byte [esi]
mov edx, ecx
shr edx, 4
mov dl, byte [edx + 0x10009344]
and ecx, 0xf
mov byte [eax], dl
mov cl, byte [ecx + 0x10009344]
inc eax
and ecx, dword [esp]
add esp, 4
push 0x400989
push ebx
push dword [esp + 4]
push 0x4086f1
call fcn.0040333d
setge al
pop esi
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x40ac14
xor eax, eax
movzx edx, byte [esp + 4]
mov eax, dword [ecx + 0x14]
add eax, ecx
test edx, edx
jne 0x40abc2
xor ecx, ecx
mov ecx, dword [esi + 8]
sub ecx, edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
push eax
push eax
push dword [esp - 0xb3]
push esi
call 0x40ac32
sub esp, 0xc
mov edx, dword [esp + 0x14]
lea esp, [esp + 0x10]
mov eax, dword [esp + 8]
push dword [esp - 0x5b]
push dword [esp + 0x53]
push 0x402558
push dword [esp - 0xe1]
push edx
call 0x40ac61
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40aca5
lea esp, [esp + 0x18]
add dword [esp + 4], eax
push 0x45
push 0x4049a8
call 0x40ac8b
mov dword fs:[0], ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebx + 0x14]
mov eax, dword [ecx]
push 0xe
lea esp, [esp + 0xc]
pop eax
ret 0xc
call fcn.00406d39
push str.CD_5
call fcn.0040a0fd

Function at 0x40b055
Capabilities:
Packed with generic packer

Disassembly:
call ebx
test eax, eax
jne 0x40b018
pop edi
pop eax
push edx
or edx, ebx
mov edx, 0xeaaf3146
push esp
push dword [esp + 8]
push 0xfffffffffffffffa
push 0x40880f
call fcn.0040333d
dec eax
mov dword [esi], eax
jne 0x40b06c
mov ecx, dword [esi + 4]
push esi
mov ebp, eax
mov edi, esi
test eax, eax
je 0x4079e5
push 0x10
call fcn.0040991b

Function at 0x40b33f
Capabilities:
Packed with generic packer

Disassembly:
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x444]
call fcn.0040720a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push dword [ebp + 8]
call fcn.0040ab02
jmp loc.00484317

Function at 0x40b507
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
push 1
push eax
mov eax, dword [0x4510b5]
call fcn.0040787d
push eax
push edx
push esp
call 0x40b507
lea edx, [esp + 0x1a10]
push edx
stosw word es:[edi], ax
lea eax, [esp + 0x1214]
push eax
lea ecx, [esp + 0x618]
push ecx
lea esp, [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
push 0x5f
call 0x40b533
call dword [sym.imp.USER32.dll_GetKeyState]
push edi
lea edx, [esp + 0x20]
push edx
push 0x451f61
mov esi, eax
call fcn.0040fe55
test esi, esi
je 0x40b4d0
lea esp, [esp + 0xc]
add dword [esp + 4], eax
push 0x404340
push dword [esp + 4]
push 0x402fd8
push 0xffffffffffffffac
push esp
call 0x40b573
mov eax, dword [esp + 4]
sub esp, 0x10
test eax, eax
jne 0x40b568
mov eax, 0x451f05
mov ecx, dword [esp + 0x18]
lea edx, [esp]
mov dword [esp + 0xc], edx
lea edx, [esp + 8]
lea esp, [esp + 0x18]
pop eax
ret 8
Function at 0x40b682
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x10]
mov ecx, dword [esp + 8]
push 0xffffffffffffffe5
push 0xffffffffffffffba
push 0x6b
push 0x401bc0
call fcn.0040b6aa
mov ebp, eax
mov dword [esp + 0xc], ebp
mov eax, dword [esi + 0x14]
test eax, eax
mov dword [esp + 0x40], 0
jmp loc.00484063

Function at 0x40b8a0
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
mov edi, dword [esp + 8]
push 0xd
push dword [esp + 0x59]
push 0xffffffffffffffc2
push dword [esp - 0x43]
push dword [esp - 0x55]
call 0x40b8c9
test eax, eax
je 0x40b927
xor eax, eax
lea esp, [esp + 0x18]
add dword [esp + 4], edi
push 0x401810
push 0xffffffffffffffd3
push dword [esp - 0xec]
push 0x401d90
call 0x40b8f2
mov eax, dword [ecx + 0x14]
test eax, eax
jne fcn.0040b932
xor eax, eax
lea esp, [esp + 0x14]
pop edi
ret 0xc
call fcn.004106b7
push esi
call fcn.00406a5b

Function at 0x40b8c9
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
mov edi, dword [esp + 8]
push 0xd
push dword [esp + 0x59]
push 0xffffffffffffffc2
push dword [esp - 0x43]
push dword [esp - 0x55]
call 0x40b8c9
test eax, eax
je 0x40b927
xor eax, eax
lea esp, [esp + 0x18]
add dword [esp + 4], edi
push 0x401810
push 0xffffffffffffffd3
push dword [esp - 0xec]
push 0x401d90
call 0x40b8f2
mov eax, dword [ecx + 0x14]
test eax, eax
jne fcn.0040b932
xor eax, eax
lea esp, [esp + 0x14]
pop edi
ret 0xc
call fcn.004106b7
push esi
call fcn.00406a5b

Function at 0x40b932
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax + 0x1000634c], bh
push esi
push 0
push edi
push 0xffffffffffffffc5
push 0x1a
call fcn.0040b959
mov eax, dword [ecx + 4]
test eax, eax
jne 0x40b934
jmp loc.00484396

Function at 0x40bbe4
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esp + 0xc]
push esi
or edi, dword [esp]
add esp, 4
push ecx
push dword [esp + 0xc]
push ecx
push 0x3f8614
call fcn.00402a70
mov eax, dword [0x451760]
Function at 0x40bc20
Capabilities:
Packed with generic packer

Disassembly:
pop esi
mov ecx, dword [esp + 0x21c]
call fcn.0040c0e3
add esp, 0x4518b9
mov ecx, dword [esp + 8]
push 0x4514d5
mov eax, dword [esp + 4]
test eax, eax
jne 0x40bc05
mov eax, 0x451374
mov edx, dword [esp + 8]
mov ecx, dword [eax]
or edi, dword [esp]
push eax
push dword [esp + 0xc]
push 0x400eb3
push 0x3fbf32
call fcn.00402c64
pop ebp
xor edi, edi
lea esp, [esp]
mov eax, esi
sub eax, edi
cmp eax, 0x1000
jae 0x40bc04
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
mov esi, eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
test eax, eax
je 0x40bcc1
xchg dword [esp], ecx
push eax
push dword [esp + 4]
push dword [esp + 4]
push 0x40006e
push 0x407d2e
call fcn.00402a70
call esi
mov ecx, dword [str.TypeNa]
mov edi, eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
cmp eax, ecx
je 0x40bd02
mov eax, dword [esp + 8]
push 0x451438
push eax
call dword [sym.imp.OLEAUT32.dll_OleLoadPicture]
test eax, eax
jne fcn.0040bcbb
call fcn.0040aae1
test eax, eax
push edx
and edx, eax
push 0x400da5
push 0x40057a
push dword [esp + 8]
push 0x406fe1
call fcn.00402fa9
push edx
call fcn.0040c41d
cmp eax, 0xffffffff
jne fcn.0040bcbb
xor eax, eax
mov eax, dword [esp + 4]
push eax
push esi
push 0x45100d
mov esi, ecx
jmp loc.00484574

Function at 0x40bca2
Capabilities:
Packed with generic packer

Disassembly:
xor eax, eax
push eax
push 0x4511c0
call fcn.00408a16
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40bc68
mov eax, dword [esi + 0x18]
test eax, eax

Function at 0x40c583
Capabilities:
Get common file path

Disassembly:
mov edx, eax
and edx, 0x45175e
cmp edx, 0x451709
jne 0x40c603
xor ebp, ebp
cmp edi, 0x45155e
je 0x40c5e2
cmp dword [esi], ebx
dec ecx
jne 0x40c84b
ret

Function at 0x40c5ed
Capabilities:
Query or enumerate registry key

Disassembly:
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x45139d
push ebx
push dword [esp - 0x1b]
push eax
call 0x40c623
add byte [eax], al
mov eax, 0x4514f6
push esi
push 0
mov esi, ecx
lea esp, [esp + 0xc]
mov ebx, dword [esp + 8]
push 0x78
call 0x40c63f
sub esp, 0xc
mov edx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 8], eax
lea esp, [esp + 8]
add dword [esp + 4], ebx
push 0x404b38
push ecx
call 0x40c65f
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
jne fcn.0040c68f
xor eax, eax
pop esi
push ebx
lea esp, [esp + 0xc]
pop ebx
ret 8

Function at 0x40c873
Capabilities:
Get common file path

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
leave
push dword [esp + 0xc]
push 0x400cc0
push ebx
push 0x3ffd3f
call fcn.00403a16
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
mov edx, dword [esi]
push esi
call dword [edx + 0x38]
test eax, eax
jl 0x40c83b
Function at 0x40c87d
Capabilities:
Get common file path

Disassembly:
push ecx
push 0x405210
push 0xffffffffffffff9f
call 0x40c895
push 0x45162f
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea esp, [esp + 0xc]
mov ecx, dword [esp + 8]
push ebx
push dword [esp - 0x47]
push 0xffffffffffffffec
push 0x401780
call 0x40c8b9
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edx, dword [esp + 0x1c]
lea esp, [esp + 0x14]
add dword [esp + 4], ecx
push 0xffffffffffffffb5
push 0x403d08
push dword [esp - 0x63]
call 0x40c8dd
mov ebx, dword [esp + 0x288]
mov edx, dword [ebx]
lea esp, [esp + 0x10]
pop ecx
ret 0xc

Function at 0x40c895
Capabilities:
Get common file path

Disassembly:
push ecx
push 0x405210
push 0xffffffffffffff9f
call 0x40c895
push 0x45162f
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea esp, [esp + 0xc]
mov ecx, dword [esp + 8]
push ebx
push dword [esp - 0x47]
push 0xffffffffffffffec
push 0x401780
call 0x40c8b9
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edx, dword [esp + 0x1c]
lea esp, [esp + 0x14]
add dword [esp + 4], ecx
push 0xffffffffffffffb5
push 0x403d08
push dword [esp - 0x63]
call 0x40c8dd
mov ebx, dword [esp + 0x288]
mov edx, dword [ebx]
lea esp, [esp + 0x10]
pop ecx
ret 0xc

Function at 0x40ddb3
Capabilities:
Get file size

Disassembly:
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x451b9f
call dword [sym.imp.USER32.dll_IsRectEmpty]
push eax
push 0x452135
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x451715
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax

Function at 0x40e6d3
Capabilities:
Get common file path

Disassembly:
call fcn.00406631
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub esp, 0x14
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax

Function at 0x40f4b8
Capabilities:
Terminate process

Disassembly:
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax + 0x20]
test ebx, ebx
jne 0x405d7a
lea ebx, [eax + 0xa4]
push ebx
push esi
push 0xffffffffffffffc3
push dword [esp + 8]
push 0x40aa36
call fcn.0040333d
push 0x451d30
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov eax, dword [ebp - 0x34]
push dword [esp + 4]
push dword [esp + 8]
push dword [esp + 0xc]
push 0x40da53
call fcn.0040333d
push 0
push 0x45214b
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [0x45153f]
call fcn.00407998
mov dword [ebp - 0x1c], 0x10034a68
cmp dword [ebp + 0x1f], 0x10004512
jae 0x40f53f
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
test eax, eax
test eax, eax
jne 0x40532e
push 0xf
push 0xffffffffffffff9c
push 0xffffffffffffffa5
push 0x404271
call fcn.004034ad
mov ecx, 0x4513f4
mov ecx, 0x451fb7
call fcn.0040d953
push 0x4510dd
call fcn.0040bd56
pop ecx
mov ecx, 0x451212
jmp dword [sym.imp.KERNEL32.dll_GetStringTypeW]
Function at 0x40fbf1
Capabilities:
Get geographical location

Disassembly:
push ecx
mov edx, dword [ecx + 0x14]
xor eax, eax
test edx, edx
mov dword [esp], eax
je 0x405b57
mov edx, dword [esp + 8]
cmp edx, 0x451d26
push ebx
push dword [esp - 0xfb]
call 0x40fc35
mov ecx, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
call fcn.0040a5cc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
sub esp, 0xc
mov edx, dword [esp + 0x14]
lea esp, [esp + 8]
mov ebx, dword [esp + 8]
push dword [esp]
push dword [esp + 0x6b]
push ecx
call 0x40fc5a
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x40fc93
mov eax, dword [0x4514a8]
lea esp, [esp + 0x10]
add dword [esp + 4], ebx
push dword [esp + 5]
push dword [esp - 0x76]
push 0x4034f8
push dword [esp - 0x7f]
call 0x40fc7f
lea edx, [esp + 4]
push 1
push edx
lea esp, [esp + 0x14]
pop ebx
ret 4
dec dword [ecx + 0x7b890443]
or byte [ebx], dh
mov dword [esi + 0x104], edi
mov dword [esi + 0x108], edi
mov dword [esi + 0x10c], edi
call esi
push dword [esp + 8]
push dword [esp + 0xc]
push 0xffffffffffffffd5
push 0x3ff070
call fcn.00402c64

Function at 0x40fe55
Capabilities:
Delete directory

Disassembly:
push 0x4519a0
push edx
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
test eax, eax
je 0x40fe27
shl ecx, 2
push 0xffffffffffffff9a
push ebx
push 0xffffffffffffffcb
push 0x402685
call fcn.00402a70
push 0xffffffffffffffff
push 0x4513db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov ecx, dword [esp + 0x44]
push edx
push 0x27
mov dword [esp + 0x28], ecx
mov ecx, dword [eax]
push edx
push 0x404d08
push ecx
push 0x66
call 0x40feb6
push 0x451147
push eax
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
lea esp, [esp + 0x10]
mov edx, dword [esp + 8]
push dword [esp - 0xe7]
push 0xffffffffffffffa7
push dword [esp + 0x4d]
call 0x40fedf
push 0
push 0
push 0x451ae0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea esp, [esp + 0x10]
add dword [esp + 4], edx
push dword [esp + 0x34]
push 0x405980
push dword [esp - 0x3a]
push 0x54
push dword [esp - 0xca]
call fcn.0040ff0c
jne 0x40ff3f
mov ecx, dword [esp + 0xc]
test edi, edi
je 0x40ff43
mov esi, dword [esp + 0x20]
test esi, esi
je 0x40ff91
mov dl, byte [esp + 0x18]
xor ecx, ecx
Function at 0x40feb6
Capabilities:
Delete directory

Disassembly:
push 0x4519a0
push edx
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
test eax, eax
je 0x40fe27
shl ecx, 2
push 0xffffffffffffff9a
push ebx
push 0xffffffffffffffcb
push 0x402685
call fcn.00402a70
push 0xffffffffffffffff
push 0x4513db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov ecx, dword [esp + 0x44]
push edx
push 0x27
mov dword [esp + 0x28], ecx
mov ecx, dword [eax]
push edx
push 0x404d08
push ecx
push 0x66
call 0x40feb6
push 0x451147
push eax
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
lea esp, [esp + 0x10]
mov edx, dword [esp + 8]
push dword [esp - 0xe7]
push 0xffffffffffffffa7
push dword [esp + 0x4d]
call 0x40fedf
push 0
push 0
push 0x451ae0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea esp, [esp + 0x10]
add dword [esp + 4], edx
push dword [esp + 0x34]
push 0x405980
push dword [esp - 0x3a]
push 0x54
push dword [esp - 0xca]
call fcn.0040ff0c
jne 0x40ff3f
mov ecx, dword [esp + 0xc]
test edi, edi
je 0x40ff43
mov esi, dword [esp + 0x20]
test esi, esi
je 0x40ff91
mov dl, byte [esp + 0x18]
xor ecx, ecx

Function at 0x40ff6a
Capabilities:
Packed with generic packer

Disassembly:
lea edx, [esp + 0xc]
cmp eax, 0xffffffff
jne 0x40ff08
dec ecx
jmp loc.00484000

Function at 0x410240
Capabilities:
Get common file path

Disassembly:
mov ecx, 0x4511af
mov ecx, 0x451a01
call fcn.00411968
push 0x451b5e

Function at 0x410264
Capabilities:
Get common file path

Disassembly:
call fcn.00405398
pop ecx
mov ecx, 0x451bd4
mov ecx, 0x4513d2
push edx
push dword [esp - 0x32]
push 0xfffffffffffffffa
push 0xffffffffffffffab
call 0x41027e
mov eax, dword [esp + 0xc]
test eax, eax
je 0x410254
mov word [eax + 0x1a], si
lea esp, [esp + 0x10]
mov edx, dword [esp + 8]
push dword [esp - 0x48]
push dword [esp + 0x5c]
push 0x401ab8
call 0x4102a4
add byte [eax], al
add byte [eax + 0x1000634c], bh
push esi
lea esp, [esp + 0x10]
add dword [esp + 4], edx
push dword [esp - 0x8e]
push dword [esp + 1]
push ecx
call 0x4102da
cmp eax, 0xffffffff
jne 0x410325
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.0040ca29
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub esp, 8
lea esp, [esp + 0x10]
pop edx
ret 8
mov dword [esi + 4], ebx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0x18]
call fcn.00406420
push ebx
push 0xffffffffffffffb4
push 0x400ddd
push 0x3fe4ff
call fcn.00402c64
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x41034e
xor eax, eax
pop esi
Function at 0x41027e
Capabilities:
Get common file path

Disassembly:
call fcn.00405398
pop ecx
mov ecx, 0x451bd4
mov ecx, 0x4513d2
push edx
push dword [esp - 0x32]
push 0xfffffffffffffffa
push 0xffffffffffffffab
call 0x41027e
mov eax, dword [esp + 0xc]
test eax, eax
je 0x410254
mov word [eax + 0x1a], si
lea esp, [esp + 0x10]
mov edx, dword [esp + 8]
push dword [esp - 0x48]
push dword [esp + 0x5c]
push 0x401ab8
call 0x4102a4
add byte [eax], al
add byte [eax + 0x1000634c], bh
push esi
lea esp, [esp + 0x10]
add dword [esp + 4], edx
push dword [esp - 0x8e]
push dword [esp + 1]
push ecx
call 0x4102da
cmp eax, 0xffffffff
jne 0x410325
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.0040ca29
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub esp, 8
lea esp, [esp + 0x10]
pop edx
ret 8
mov dword [esi + 4], ebx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0x18]
call fcn.00406420
push ebx
push 0xffffffffffffffb4
push 0x400ddd
push 0x3fe4ff
call fcn.00402c64
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x41034e
xor eax, eax
pop esi

Function at 0x4102a4
Capabilities:
Get common file path

Disassembly:
call fcn.00405398
pop ecx
mov ecx, 0x451bd4
mov ecx, 0x4513d2
push edx
push dword [esp - 0x32]
push 0xfffffffffffffffa
push 0xffffffffffffffab
call 0x41027e
mov eax, dword [esp + 0xc]
test eax, eax
je 0x410254
mov word [eax + 0x1a], si
lea esp, [esp + 0x10]
mov edx, dword [esp + 8]
push dword [esp - 0x48]
push dword [esp + 0x5c]
push 0x401ab8
call 0x4102a4
add byte [eax], al
add byte [eax + 0x1000634c], bh
push esi
lea esp, [esp + 0x10]
add dword [esp + 4], edx
push dword [esp - 0x8e]
push dword [esp + 1]
push ecx
call 0x4102da
cmp eax, 0xffffffff
jne 0x410325
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.0040ca29
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub esp, 8
lea esp, [esp + 0x10]
pop edx
ret 8
mov dword [esi + 4], ebx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0x18]
call fcn.00406420
push ebx
push 0xffffffffffffffb4
push 0x400ddd
push 0x3fe4ff
call fcn.00402c64
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x41034e
xor eax, eax
pop esi