joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e779
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
lea eax, [ebp - 0x210]
push eax
push 0x10008
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40e846
mov dword [ebp - 0x10c], 0
cmp dword [ebp - 8], 0
jne 0x40e844
mov dword [ebp - 4], 0x100
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x103
jne 0x40e816
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40e844
cmp dword [ebp - 8], 0
jne 0x40e83f
mov ecx, dword [ebp - 0x10c]
add ecx, 1
mov dword [ebp - 0x10c], ecx
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40e7b5
jmp 0x40e862
cmp dword [ebp - 8], 2
jne 0x40e850
xor eax, eax
jmp 0x40e864
push 0x10001
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e864
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40e868
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 1
push 2
push 1
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40e8fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x431
jne 0x40e8ca
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x40e94f
cmp dword [ebp - 8], 0x430
je 0x40e8e5
push 0x20003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e94f
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x40e902
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0x430
jne 0x40e915
cmp dword [ebp - 0xc], 0xa
jl 0x40e875
cmp dword [ebp - 0xc], 0xa
jne 0x40e92d
push 0x20003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e94f
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x40e94d
push 0x20004
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e94f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40e953
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40e98a
push 0x20005
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40ea85
push 0
push 0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x40ea63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x420
jne 0x40ea47
lea eax, [ebp - 0x3c]
push eax
push 1
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x40e9f3
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20006
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40ea85
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x18], 1
jne 0x40e9f3
push 0
push 0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x40ea45
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20007
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40ea85
jmp 0x40ea63
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20007
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40ea85
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x40ea83
push 0x20004
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40ea85
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40ea89
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40ead4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x40eabf
xor eax, eax
jmp 0x40eb65
push 0x20005
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40eb65
lea edx, [ebp - 0x3c]
push edx
push 1
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x40eb24
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x41c
je 0x40eb24
cmp dword [ebp - 0x40], 0x426
je 0x40eb24
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20006
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40eb65
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x18], 1
jne 0x40eb24
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x40eb63
push 0x20004
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40eb65
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40eb69
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40ebac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x40eb9a
xor eax, eax
jmp 0x40ebf8
push 0x20005
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40ebf8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x40ebd6
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20008
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40ebf8
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x40ebf6
push 0x20002
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40ebf8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40ecea
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x654], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [0x5a2a80], eax
cmp dword [0x5a2a80], 0
jne 0x40ed46
push 0x20001
call fcn.0040435c
add esp, 4
push 0x2008001
call fcn.004042f8
add esp, 4
or eax, 0xffffffff
jmp 0x40eefd
cmp dword [ebp + 0xc], 0
je 0x40ed71
mov eax, dword [ebp + 0xc]
push eax
push 0x5a2660
call fcn.0041bfa0
add esp, 8
push 0x51e744
push 0x5a2660
call fcn.0041bfb0
add esp, 8
jmp 0x40ed93
push 0x200
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x51e748
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x5a2660
lea ecx, [ebp - 0x64c]
push ecx
call fcn.0041bfa0
add esp, 8
push 0x51e754
lea edx, [ebp - 0x64c]
push edx
call fcn.0041bfb0
add esp, 8
push 0x5a2660
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfa0
add esp, 8
push 0x51e764
lea ecx, [ebp - 0x200]
push ecx
call fcn.0041bfb0
add esp, 8
push 0x51e76c
lea edx, [ebp - 0x200]
push edx
call fcn.0041bfb0
add esp, 8
mov eax, dword [ebp + 8]
and eax, 2
test eax, eax
je 0x40ee22
lea ecx, [ebp - 0x200]
push ecx
push 0x51e774
mov edx, dword [0x5a2a80]
push edx
call fcn.0040e868
add esp, 0xc
mov dword [ebp - 0x650], eax
mov eax, dword [ebp + 8]
and eax, 1
test eax, eax
je 0x40ee56
cmp dword [ebp - 0x650], 0
jne 0x40ee56
lea ecx, [ebp - 0x64c]
push ecx
push 0x51e77c
mov edx, dword [0x5a2a80]
push edx
call fcn.0040e868
add esp, 0xc
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x650], 0xffffffff
je 0x40ee68
cmp dword [ebp - 0x654], 0xffffffff
jne 0x40ee86
mov eax, dword [0x5a2a80]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x2008006
call fcn.004042f8
add esp, 4
or eax, 0xffffffff
jmp 0x40eefd
mov ecx, dword [0x5a2a80]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 0
jne 0x40eec1
push 0x20002
call fcn.0040435c
add esp, 4
push 0x2008001
call fcn.004042f8
add esp, 4
or eax, 0xffffffff
jmp 0x40eefd
push 0x51e788
lea edx, [ebp - 0x44c]
push edx
call fcn.0041bfa0
add esp, 8
push 0x51e7b4
lea eax, [ebp - 0x44c]
push eax
call fcn.0041bfb0
add esp, 8
lea ecx, [ebp - 0x44c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40f0ba
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 4]
push eax
push 0x51e7e4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40f127
cmp dword [ebp - 8], 5
jne 0x40f105
push 0x2010000
call fcn.004042f8
add esp, 4
push 0
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40f1fa
push 0x2002007
call fcn.004042f8
add esp, 4
push 0x10007
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40f1fa
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x51e810
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x200
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x51e83c
lea eax, [ebp - 0x208]
push eax
call fcn.0041bfb0
add esp, 8
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xffffffff
jne 0x40f1dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 5
jne 0x40f1bd
push 0x2010000
call fcn.004042f8
add esp, 4
push 0
call fcn.0040435c
add esp, 4
jmp 0x40f1d7
push 0x2002007
call fcn.004042f8
add esp, 4
push 0x10007
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40f1fa
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x208]
push eax
call fcn.00406151
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40f703
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x51e8e0
push 0x5a2aa0
call fcn.0041bfa0
add esp, 8
push 0x51e904
push 0x5a2aa0
call fcn.0041bfb0
add esp, 8
push 0x5a2860
push 0x5a2aa0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40f74d
xor eax, eax
jmp 0x40f7b2
push 0x51e944
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
push 7
push 0x51e94c
push 1
push 0
push 0x5a2d00
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40f7a3
mov ecx, dword [0x5a2860]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40f7b2
mov edx, dword [0x5a2860]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40f7cf
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [ebp - 0x20c], 0x200
lea eax, [ebp - 0x200]
mov dword [ebp - 0x204], eax
push 0x200
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x51e9a8
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x51e9b4
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x51e9bc
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x5a2660
call fcn.00406151
add esp, 4
test eax, eax
je 0x40f84c
xor eax, eax
jmp 0x40f8d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
je 0x40f885
cmp dword [ebp - 0x208], 3
je 0x40f885
cmp dword [ebp - 0x208], 5
jne 0x40f880
push 0x4000b
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40f8d7
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041bdf0
add esp, 4
test eax, eax
je 0x40f8d5
mov edx, dword [ebp + 8]
push edx
call fcn.00406151
add esp, 4
test eax, eax
jne 0x40f8d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
je 0x40f8d5
cmp dword [ebp - 0x208], 5
jne 0x40f8d0
push 0x4000b
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40f8d7
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40f8db
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x200
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x51e9c4
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x51e9c8
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x51e9d0
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x5a2660
call fcn.00406151
add esp, 4
test eax, eax
jne 0x40f95d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x40f95d
cmp dword [ebp - 4], 5
jne 0x40f958
push 0x4000b
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40f95f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40f963
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x200
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x51e9d8
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x51e9dc
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x5a2660
call fcn.00406151
add esp, 4
test eax, eax
jne 0x40f9d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x40f9d3
cmp dword [ebp - 4], 5
jne 0x40f9ce
push 0x4000b
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40f9d5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40f9d9
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [ebp - 0x20c], 0x200
lea eax, [ebp - 0x200]
mov dword [ebp - 0x204], eax
push 0x200
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x51e9e8
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x51e9f4
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x5a2660
call fcn.00406151
add esp, 4
test eax, eax
je 0x40fa44
xor eax, eax
jmp 0x40facf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
je 0x40fa7d
cmp dword [ebp - 0x208], 3
je 0x40fa7d
cmp dword [ebp - 0x208], 5
jne 0x40fa78
push 0x4000b
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40facf
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041bdf0
add esp, 4
test eax, eax
je 0x40facd
mov edx, dword [ebp + 8]
push edx
call fcn.00406151
add esp, 4
test eax, eax
jne 0x40facd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
je 0x40facd
cmp dword [ebp - 0x208], 5
jne 0x40fac8
push 0x4000b
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40facf
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40fad3
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x200
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x51ea04
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x51ea08
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x5a2660
call fcn.00406151
add esp, 4
test eax, eax
jne 0x40fb43
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x40fb43
cmp dword [ebp - 4], 5
jne 0x40fb3e
push 0x4000b
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40fb45
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40ff06
Capabilities:
Check if file exists
Get common file path
Get file attributes
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x550
mov byte [ebp - 0x550], 0
cmp dword [ebp + 8], 0
je 0x40ff69
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0xffffffff
je 0x40ff69
mov ecx, dword [ebp - 0x34c]
and ecx, 0x10
test ecx, ecx
je 0x40ff69
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x550]
push eax
call fcn.0041bfa0
add esp, 8
push 0x51ea90
lea ecx, [ebp - 0x550]
push ecx
call fcn.0041bfb0
add esp, 8
movsx edx, byte [ebp - 0x550]
test edx, edx
jne 0x40ff9a
push 0x200
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x51ea94
lea ecx, [ebp - 0x550]
push ecx
call fcn.0041bfb0
add esp, 8
push 0x51eaa0
lea edx, [ebp - 0x550]
push edx
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 0x550]
push eax
call fcn.00406151
add esp, 4
test eax, eax
jne 0x410033
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x410033
push 0x200
push 0x5a2880
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x51eab0
push 0x5a2880
call fcn.0041bfb0
add esp, 8
push 0x51eabc
push 0x5a2880
call fcn.0041bfb0
add esp, 8
push 0x51eac8
push 0x5a2880
call fcn.0041bfb0
add esp, 8
push 0x5a2880
lea ecx, [ebp - 0x550]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea edx, [ebp - 0x550]
push edx
call fcn.00406151
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x4100e1
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.0041bfa0
add esp, 8
push 0x51ead0
lea edx, [ebp - 0x208]
push edx
call fcn.0041bfb0
add esp, 8
push 0x51ead4
lea eax, [ebp - 0x208]
push eax
call fcn.0041bfb0
add esp, 8
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4100e1
push 0
lea eax, [ebp - 0x550]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.00406177
add esp, 0xc
test eax, eax
jne 0x4100d0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x41018d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x41018d
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x550]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5a2644], eax
cmp dword [0x5a2644], 0xffffffff
jne 0x410120
push 0x40003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x41018d
push 0
lea edx, [ebp - 4]
push edx
push 0x6ec00
push 0x4ad444
mov eax, dword [0x5a2644]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0
jne 0x41015d
push 0x40004
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x41018d
mov ecx, dword [0x5a2644]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0
jne 0x41018b
push 0x40005
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x41018d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41091e
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push 0x200
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x51ebac
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x51ebb0
push 0x5a2660
call fcn.0041bfb0
add esp, 8
cmp dword [ebp + 8], 0
je 0x410a07
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.0041bfa0
add esp, 8
push 0x51ebbc
lea edx, [ebp - 0x204]
push edx
call fcn.0041bfb0
add esp, 8
push 0x51ebc0
lea eax, [ebp - 0x204]
push eax
call fcn.0041bfb0
add esp, 8
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x410a07
push 0
push 0x5a2660
lea eax, [ebp - 0x204]
push eax
call fcn.00406177
add esp, 0xc
test eax, eax
jne 0x4109f6
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x410ad1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x410ad1
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5a2644], eax
cmp dword [0x5a2644], 0xffffffff
jne 0x410a47
push 0x40003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x410ad1
push 0
lea eax, [ebp - 0x208]
push eax
push 0x17f
push 0x51da44
mov ecx, dword [0x5a2644]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x410a95
mov edx, dword [0x5a2644]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x410ad1
mov eax, dword [0x5a2644]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x410acf
mov ecx, dword [0x5a2644]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40005
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x410ad1
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x410ad5
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
cmp dword [0x42a16c], 0
jne 0x410aee
xor eax, eax
jmp 0x410d39
cmp dword [0x42a168], 0
jne 0x410afe
xor eax, eax
jmp 0x410d39
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x198]
push ecx
call fcn.00402160
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
je 0x410b2b
mov eax, dword [ebp - 0xd0]
jmp 0x410d39
push 0x200
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x194], 3
jne 0x410bae
push 0x51ebcc
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jne 0x410bae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x410bae
push 0x4000d
call fcn.0040435c
add esp, 4
push 0x2020001
call fcn.004042f8
add esp, 4
mov dword [ebp - 0xd0], 0xffffffff
mov eax, dword [ebp - 0xd0]
jmp 0x410d39
push 0x200
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x194], 3
jne 0x410bdb
push 0x51ebdc
push 0x5a2660
call fcn.0041bfb0
add esp, 8
jmp 0x410bed
push 0x51ebec
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x51ebf8
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x5a2660
mov edx, dword [ebp + 8]
push edx
call fcn.00410eda
add esp, 8
cmp eax, 0xffffffff
jne 0x410c2a
push 0x2004012
call fcn.004042f8
add esp, 4
or eax, 0xffffffff
jmp 0x410d39
push 0x200
push 0x5a2d40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x194], 3
jne 0x410c57
push 0x51ec04
push 0x5a2d40
call fcn.0041bfb0
add esp, 8
jmp 0x410c69
push 0x51ec14
push 0x5a2d40
call fcn.0041bfb0
add esp, 8
push 0x51ec1c
push 0x5a2d40
call fcn.0041bfb0
add esp, 8
mov eax, dword [ebp - 0x194]
push eax
push 0x5a2d40
mov ecx, dword [ebp + 8]
push ecx
call fcn.00410d3d
add esp, 0xc
cmp eax, 0xffffffff
jne 0x410cad
push 0x2004013
call fcn.004042f8
add esp, 4
or eax, 0xffffffff
jmp 0x410d39
cmp dword [ebp - 0x194], 3
jne 0x410d1b
cmp dword [0x5a1a28], 0
jne 0x410d1b
push 0x200
push 0x5a2d40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x51ec28
push 0x5a2d40
call fcn.0041bfb0
add esp, 8
push 0x51ec38
push 0x5a2d40
call fcn.0041bfb0
add esp, 8
push 0x5a2d40
mov edx, dword [ebp + 8]
push edx
call fcn.00411049
add esp, 8
cmp eax, 0xffffffff
jne 0x410d1b
push 0x200401e
call fcn.004042f8
add esp, 4
or eax, 0xffffffff
jmp 0x410d39
cmp dword [ebp - 0x194], 3
jne 0x410d37
call fcn.00411b39
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x410d37
or eax, 0xffffffff
jmp 0x410d39
xor eax, eax
mov esp, ebp
pop ebp
ret