joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c997
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x55cea0
call fcn.0040a243
mov ebx, ecx
call fcn.0040b511
lea edi, [ebx + 0xd4]
push eax
mov ecx, edi
call fcn.00401c6a
mov esi, 0x55e99c
push esi
call fcn.00419261
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00401b31
push str.guanf
push str.Spreader
push str.AppInfo
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.0040b601
lea esi, [ebx + 0xec]
push eax
mov ecx, esi
call fcn.00401345
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.004019dd
push str.guanf
mov ecx, esi
call fcn.00401d3a
test eax, eax
jne 0x40ca86
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00415ce0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x40ca37
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.guanf
push eax
push edi
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x40ca68
xor eax, eax
jmp 0x40ca75
lea eax, [ebp - 0x218]
push eax
call fcn.00419261
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00401c91
jmp 0x40ca8b
mov edi, str.guanf
push edi
mov ecx, esi
call fcn.00401d3a
test eax, eax
jne 0x40cb4e
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00415ce0
add esp, 0xc
lea eax, [ebx + 0x5c]
lea ecx, [ebp - 0x230]
push eax
call fcn.004012f8
and dword [ebp - 4], 0
push 0x55e99c
call fcn.00419261
pop ecx
push eax
push 0x55e99c
lea ecx, [ebp - 0x230]
call fcn.00401b31
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x40cb1f
xor eax, eax
jmp 0x40cb2c
lea eax, [ebp - 0x218]
push eax
call fcn.00419261
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00401c91
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
push 0
push 1
call fcn.004019dd
push edi
mov ecx, esi
call fcn.00401d3a
test eax, eax
jne 0x40cb8a
push edi
push str.Spreader
push str.AppInfo
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.0040b5ad
push eax
mov ecx, esi
call fcn.00401345
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.004019dd
call fcn.0040a1ed
ret
Function at 0x40cf09
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00419261
mov dword [ebp - 8], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004081c0
push dword [ebp + 8]
mov edi, eax
push edi
mov dword [ebp - 4], edi
call fcn.0041c316
add esp, 0x10
call fcn.00409c61
test al, al
je 0x40cf5c
push edx
push ebp
pop esp
pop edx
push esi
pop esi
pop edx
push eax
pop edx
pop ebx
pop ebx
pop esp
pop edx
push edi
push esp
push edi
mov eax, dword [ebp - 8]
xor esi, esi
xor ebx, ebx
inc esi
mov dword [ebp - 0xc], ebx
test eax, eax
js 0x40d026
cmp word [edi + ebx*2], 0x5c
jne 0x40d017
call fcn.00409a39
test al, al
je 0x40cf97
push ebp
pop ebp
push eax
push esp
pop ebp
push ebx
pop ebp
push esi
pop ebx
push edi
pop eax
pop esp
push esi
push eax
push ebp
pop eax
pop esi
push ecx
push ebx
push edx
call fcn.00409856
test al, al
je 0x40cfc1
push ebp
push ecx
push edi
push edx
push ebx
push ecx
pop esp
pop ebx
pop ebp
pop edx
pop ecx
pop edi
pop ebx
push esp
push eax
push edi
pop ebx
push edi
pop ebx
push eax
pop edx
push ebp
pop ecx
pop eax
pop eax
pop ebx
push ebx
pop ebx
push esp
push ebp
mov edi, dword [ebp - 4]
call fcn.00409925
test al, al
je 0x40cfec
push esi
push esp
push esp
push eax
pop ebx
pop esi
push ebp
push ecx
push eax
push esp
push esp
push edi
pop ebp
pop ebx
push edi
pop ecx
pop esi
push edi
push ecx
push esp
pop ebp
pop ecx
pop ebp
push eax
pop ebp
pop edi
push ecx
pop ebp
pop eax
pop ecx
push ecx
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
xor eax, eax
push edi
movzx esi, word [edi + ebx*2]
mov word [edi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40d010
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40d036
mov eax, dword [ebp - 8]
mov word [edi + ebx*2], si
inc ebx
mov dword [ebp - 0xc], ebx
cmp ebx, eax
jle 0x40cf6f
xor esi, esi
inc esi
push edi
call fcn.0040a8ac
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x40d026
Function at 0x40d03a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5dc050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x218], eax
xor eax, eax
push eax
push 0x1a
push ecx
push eax
mov dword [ebp - 0x210], ebx
call fcn.0040e472
lea eax, [ebp - 0x20c]
push eax
call fcn.00419261
add esp, 0x14
mov dword [ebp - 0x214], eax
call fcn.004097cc
test al, al
je 0x40d0b1
pop esp
push ecx
pop ebx
push ecx
pop ecx
pop edi
pop ecx
pop esi
push ebx
pop esp
pop ecx
push esi
push edx
push edx
push ebx
push edi
push ebx
push esi
pop esp
pop edx
push ebp
pop eax
push ebx
push edx
push ebp
mov ebx, dword [ebp - 0x210]
cmp dword [ebp - 0x214], 0
je 0x40d1bd
mov esi, 0x55e998
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00421862
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00421862
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00421862
add esp, 0x18
call fcn.00409ceb
test al, al
je 0x40d111
pop ebx
pop ecx
push ecx
push edx
pop ebp
push edx
pop esp
push ecx
pop ecx
push esp
push ecx
push esp
pop esi
pop eax
push esp
push ebp
push edi
pop ecx
pop ebx
push ebp
pop edi
push ebx
push esi
push ebx
push ebx
pop ebp
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40d12f
lea eax, [ebp - 0x20c]
push eax
call fcn.0040cf09
pop ecx
call fcn.0040989b
test al, al
je 0x40d14c
push ebp
push eax
pop ecx
push edx
pop ecx
pop ebx
pop ecx
pop ebp
push esp
push edi
pop ebx
pop esi
pop ebp
pop edx
push esp
push ebp
push edx
pop edi
pop eax
push esi
call fcn.00409ac3
test al, al
je 0x40d171
pop edi
push edi
pop esp
pop edi
push ebp
push edi
push ebx
pop esi
pop esi
pop edi
pop ebp
push ecx
push edx
pop ebx
pop ebx
pop eax
push ebp
pop esi
push edx
pop esi
pop edi
push esi
push ebp
pop ebp
push eax
pop edi
pop edx
push edi
call fcn.00409ceb
test al, al
je 0x40d18f
push esp
pop edx
push edi
pop ebp
pop eax
push ebp
push ecx
pop esi
push esp
pop edi
pop ecx
pop edx
push edx
pop ecx
push esp
push ebx
pop edx
pop edi
push edx
push edi
push ebp
cmp word [ebp - 0x20c], 0
jne 0x40d19d
xor eax, eax
jmp 0x40d1aa
lea eax, [ebp - 0x20c]
push eax
call fcn.00419261
pop ecx
mov ecx, dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00401c91
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a1c7
mov esp, ebp
pop ebp
ret
Function at 0x40ddba
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5dc050]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x5e169c], 0
push ebx
push esi
push edi
je 0x40de42
call fcn.0040989b
test al, al
je 0x40ddf6
push ebp
push eax
pop ecx
push edx
pop ecx
pop ebx
pop ecx
pop ebp
push esp
push edi
pop ebx
pop esi
pop ebp
pop edx
push esp
push ebp
push edx
pop edi
pop eax
push esi
call fcn.00409ac3
test al, al
je 0x40de1b
pop edi
push edi
pop esp
pop edi
push ebp
push edi
push ebx
pop esi
pop esi
pop edi
pop ebp
push ecx
push edx
pop ebx
pop ebx
pop eax
push ebp
pop esi
push edx
pop esi
pop edi
push esi
push ebp
pop ebp
push eax
pop edi
pop edx
push edi
call fcn.00409ceb
test al, al
je 0x40df39
push esp
pop edx
push edi
pop ebp
pop eax
push ebp
push ecx
pop esi
push esp
pop edi
pop ecx
pop edx
push edx
pop ecx
push esp
push ebx
pop edx
pop edi
push edx
push edi
push ebp
jmp 0x40df39
call fcn.00409ceb
test al, al
je 0x40de66
pop edx
push ecx
pop edi
push esi
pop ebp
push ebp
push esp
pop ebp
push ebx
push ecx
push ecx
pop esi
push ebp
push ebp
pop esp
push eax
pop edi
push esp
push ebx
push ebp
push eax
pop ecx
pop ebx
pop edi
pop esp
pop esi
pop ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00415ce0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40ded6
lea eax, [ebp - 0x20c]
push eax
call fcn.00421a3c
lea eax, [ebp - 0x20c]
mov dword [esp], 0x560c10
push eax
call fcn.00415614
pop ecx
pop ecx
test eax, eax
jne 0x40decf
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.00415614
pop ecx
pop ecx
test eax, eax
je 0x40ded6
mov byte [0x5e169c], 1
call fcn.00409b4d
test al, al
je 0x40def1
pop ecx
push ecx
push esi
push edx
push eax
pop esi
push eax
push ebx
pop ebx
push esi
push eax
push eax
push edi
push ebp
pop esi
push esp
pop eax
push esp
call fcn.0040989b
test al, al
je 0x40df15
push edx
push esi
push esi
push edi
push esi
push edi
pop edi
push esi
push ecx
push esp
push esp
push edx
push ecx
pop esp
push esp
push ebx
pop edi
pop edx
pop ebp
pop ebx
pop esi
push esp
pop ebx
pop edx
pop eax
pop esi
push ebx
call fcn.0040989b
test al, al
je 0x40df39
push ebx
pop ebp
pop edi
push esi
pop esp
pop ecx
pop ebx
pop edi
pop eax
pop edi
pop edi
push edx
pop eax
pop ecx
push eax
push edi
push ecx
pop edi
pop esi
push ebp
push esp
push esi
push edx
push edi
push esi
push edx
push ebp
mov ecx, dword [ebp - 4]
mov al, byte [0x5e169c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040a1c7
mov esp, ebp
pop ebp
ret
Function at 0x40df4f
Capabilities:
Get common file path

Disassembly:
push 0x138
mov eax, 0x55cf71
call fcn.0040a243
mov al, byte [0x5e169d]
test al, al
jne 0x40e018
push 0x104
xor esi, esi
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.00415ce0
add esp, 0xc
lea eax, [ebp - 0x114]
xor edi, edi
inc edi
push edi
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40e013
push str.config_systemprofile
lea ecx, [ebp - 0x12c]
call fcn.004092cd
lea eax, [ebp - 0x114]
mov dword [ebp - 4], esi
push eax
lea ecx, [ebp - 0x144]
call fcn.004092cd
push dword [ebp - 0x11c]
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x12c]
push esi
cmovae eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x144]
push eax
call fcn.0040e5ea
movzx ecx, byte [0x5e169d]
cmp eax, 0xffffffff
push esi
cmovne ecx, edi
mov byte [0x5e169d], cl
lea ecx, [ebp - 0x144]
push edi
call fcn.00409498
push esi
push edi
lea ecx, [ebp - 0x12c]
call fcn.00409498
mov al, byte [0x5e169d]
call fcn.0040a1ed
ret
Function at 0x40eb4e
Capabilities:
Enumerate processes

Disassembly:
push 0x280
mov eax, 0x55d288
call fcn.0040a243
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x28c], ebx
test eax, eax
je 0x40ed3b
push eax
lea ecx, [ebp - 0x40]
call fcn.00401320
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.004124ca
mov edi, 0x22c
lea eax, [ebp - 0x284]
push edi
push 0
push eax
call fcn.00415ce0
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x28c], esi
cmp esi, 0xffffffff
je 0x40ed2b
call fcn.00409ac3
test al, al
je 0x40ebd0
pop eax
pop ecx
push ebp
push edi
pop ecx
push esp
pop edx
pop ebp
pop edx
pop esp
push eax
push ebx
push ebx
push edx
push esp
push edx
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x40eca8
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
je 0x40ec0f
lea eax, [ebp - 0x260]
push eax
call fcn.00419261
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.00401c91
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.004124ca
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00401d0a
test eax, eax
je 0x40ec63
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004122f8
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
or ebx, 1
call fcn.00401d0a
mov byte [ebp - 0x285], 0
test eax, eax
jne 0x40ec6a
mov byte [ebp - 0x285], 1
test bl, 1
je 0x40ec7e
push 0
push 1
lea ecx, [ebp - 0x58]
and ebx, 0xfffffffe
call fcn.004019dd
cmp byte [ebp - 0x285], 0
jne 0x40ed41
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.004019dd
lea eax, [ebp - 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40ebe8
call fcn.00409bd7
test al, al
je 0x40ecd8
push esp
push edi
pop ebx
pop ecx
pop esp
pop ebx
pop ebx
push ecx
pop ebp
pop eax
pop ebp
push ebx
pop ebx
pop edx
push ebp
push ebx
pop edi
pop eax
push ebx
push edx
pop edx
pop eax
pop edi
push ebp
pop edx
push ebp
push ebx
pop ebp
push ebx
pop edx
pop esi
call fcn.004096fd
test al, al
je 0x40ecfa
pop edx
push ecx
push ebp
pop edx
push esp
push esp
push edx
push esi
pop eax
push esi
pop ebx
pop ecx
pop esi
pop ebx
push edi
pop edi
push ecx
push esi
pop edi
pop edi
push ecx
push esp
pop ebp
push ebp
push edi
call fcn.004099af
test al, al
je 0x40ed1f
pop edx
push ecx
pop ebp
pop ebx
pop ebp
pop eax
pop ebx
push edi
push edx
push esi
pop edi
push eax
push edx
push edi
push esi
push esp
pop ebp
push ecx
push edx
pop eax
pop ebp
pop esi
push ecx
pop ecx
push ebx
pop edi
push edi
pop ebp
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.004019dd
mov eax, esi
call fcn.0040a1ed
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.004019dd
jmp 0x40ed2d
Function at 0x411ae5
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x89], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x4127d3
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0xe8
mov eax, 0x55d35a
call fcn.0040a243
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
xor eax, eax
mov dword [ebp - 0xf0], ebx
push 0x55e5d0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
call fcn.00401c91
lea ecx, [ebp - 0xe4]
mov dword [ebp - 4], ebx
call fcn.004118f6
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412922
push ebx
push 1
push 4
push ebx
push 1
push bind
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x412857
push 0x55e5d0
mov ecx, esi
call fcn.00401320
jmp 0x41292d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xe8], eax
inc eax
push eax
mov dword [ebp - 0xec], eax
call fcn.004081c0
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x41288b
push 0x55e5d0
mov ecx, esi
call fcn.00401320
push ebx
jmp 0x41292e
push dword [ebp - 0xec]
push 0
push ebx
call fcn.00415ce0
add esp, 0xc
lea eax, [ebp - 0xf4]
push 0
push eax
push dword [ebp - 0xe8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xe4]
push ebx
call fcn.004122c4
push ebx
call fcn.0040a8ac
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xe4]
call fcn.00411b0f
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.0041238c
pop ecx
pop ecx
xor ebx, ebx
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.00409498
cmp dword [ebp - 0x30], ebx
jbe 0x412917
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00401bd5
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.004019dd
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004012d3
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.004019dd
mov eax, esi
call fcn.0040a1ed
ret
Function at 0x412940
Capabilities:
Create process on windows

Disassembly:
push 0x88
mov eax, 0x55d392
call fcn.0040a243
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
mov edi, dword [ebp + 0xc]
push 0x44
pop ebx
push ebx
push 0
push eax
call fcn.00415ce0
push 0x10
lea eax, [ebp - 0x50]
mov dword [ebp - 0x94], ebx
push 0
push eax
call fcn.00415ce0
add esp, 0x18
xor edx, edx
xor eax, eax
mov dword [ebp - 0x18], edx
mov word [ebp - 0x28], ax
push 7
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov word [ebp - 0x40], ax
or ebx, 0xffffffff
mov byte [ebp - 4], 1
test edi, edi
je 0x412a1e
cmp word [edi], dx
jne 0x4129af
mov eax, edx
jmp 0x4129b6
push edi
call fcn.00419261
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.00401c91
cmp dword [ebp - 0x30], 0
je 0x412a1e
mov edi, 0x560ec8
push edi
call fcn.00419261
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00401c91
xor edi, edi
cmp word [esi], di
jne 0x4129e7
mov eax, edi
jmp 0x4129ee
push esi
call fcn.00419261
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401b31
mov esi, 0x560ecc
push esi
call fcn.00419261
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401b31
push ebx
push edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00401a6b
jmp 0x412a3a
xor edi, edi
cmp word [esi], di
jne 0x412a29
mov eax, edi
jmp 0x412a30
push esi
call fcn.00419261
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401c91
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push edi
push edi
push edi
push 1
push edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x412a67
mov esi, edi
jmp 0x412a92
cmp byte [ebp + 0x10], 0
je 0x412a7f
cmp dword [ebp + 0x14], 0
cmovg ebx, dword [ebp + 0x14]
push ebx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x4c]
call esi
xor esi, esi
inc esi
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.004019dd
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.004019dd
mov eax, esi
call fcn.0040a1ed
ret

Function at 0x412ab0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00419261
pop ecx
test eax, eax
je 0x412b13
push ebx
push edi
push 0x3c
xor edi, edi
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.00415ce0
add esp, 0xc
mov dword [ebp - 0x38], 0x200
xor ebx, ebx
mov dword [ebp - 0x28], esi
inc ebx
mov eax, 0x56113c
mov dword [ebp - 0x30], eax
push ebx
push edi
push edi
push esi
push eax
push edi
mov dword [ebp - 0x20], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x412b0f
push edi
push edi
push edi
push esi
call fcn.00412940
add esp, 0x10
jmp 0x412b11
mov eax, ebx
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412b18
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1604
call fcn.0040a660
mov eax, dword [0x5dc050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.00415ce0
push esi
lea eax, [ebp - 0x20c]
push 0x55e694
push eax
call fcn.00410ebd
lea eax, [ebp - 0x20c]
push eax
call fcn.00419261
add esp, 0x1c
lea ecx, [eax - 1]
test ecx, ecx
jle 0x412b84
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x20e], cx
je 0x412b84
mov word [ebp + eax*2 - 0x20c], cx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xbe4]
push str._s.
push eax
call fcn.00410ebd
add esp, 0xc
lea eax, [ebp - 0x1604]
push eax
lea eax, [ebp - 0xbe4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x412c7d
push ebx
push 0x2e
pop ebx
lea eax, [ebp - 0x1604]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x412c7c
cmp word [ebp - 0x15d8], bx
je 0x412bc2
cmp word [ebp - 0x15d6], 0
je 0x412bc2
cmp word [ebp - 0x15d6], bx
jne 0x412bfe
cmp word [ebp - 0x15d4], 0
je 0x412bc2
test byte [ebp - 0x1604], 0x10
je 0x412c48
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00415ce0
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x55e67c
push eax
call fcn.00410ebd
lea eax, [ebp - 0x414]
push eax
call fcn.00412b18
add esp, 0x20
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x13b4]
push 0x55e5d4
push eax
call fcn.00410ebd
add esp, 0x10
lea eax, [ebp - 0x13b4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x412bc2
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040a1c7
mov esp, ebp
pop ebp
ret

Function at 0x413302
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5dc050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x160], ebx
jne 0x413398
lea eax, [edi + 0x2c]
cmp dword [eax + 0x14], 8
jb 0x41332e
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x20c]
push str._sSkin_
push eax
call fcn.00401e62
add esp, 0xc
cmp word [ebp - 0x20c], bx
je 0x41335b
lea eax, [ebp - 0x20c]
push eax
call fcn.00419261
pop ecx
mov ebx, eax
push esi
push ebx
lea eax, [ebp - 0x20c]
lea esi, [edi + 0x150]
push eax
mov ecx, esi
call fcn.00401c91
cmp dword [esi + 0x14], 8
jb 0x41337b
mov eax, dword [esi]
jmp 0x41337d
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413397
cmp dword [esi + 0x14], 8
jb 0x413390
mov esi, dword [esi]
push esi
call fcn.0040cf09
pop ecx
pop esi
lea eax, [edi + 0x150]
cmp dword [eax + 0x14], 8
pop edi
pop ebx
jb 0x4133a8
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a1c7
mov esp, ebp
pop ebp
ret