joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ce10c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x4ce115
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040475c
mov eax, dword [ebp - 8]
call fcn.0040475c
mov eax, dword [ebp + 8]
call fcn.0040475c
xor eax, eax
push ebp
push 0x4ce339
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00404344
lea edx, [ebp - 0xc]
mov eax, dword [0x4d3fb8]
call fcn.004b8164
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov ecx, 0x4ce348
call fcn.00405d9c
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov ecx, 0x4ce358
call fcn.00405d9c
mov eax, dword [ebp - 0x1c]
call fcn.0040476c
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 0x1c]
call fcn.00409490
mov eax, dword [ebp - 0x130]
call fcn.0040476c
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
lea eax, [ebp - 0x18]
push eax
xor eax, eax
mov al, bl
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x129]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x129]
mov ecx, 0x105
call fcn.0040451c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x20]
call fcn.004ce030
cmp dword [ebp - 4], 0
je 0x4ce291
lea eax, [ebp - 0x138]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
call fcn.004045b8
mov eax, dword [ebp - 0x138]
call fcn.0040905c
test al, al
jne 0x4ce279
lea eax, [ebp - 0x13c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
call fcn.004045b8
mov eax, dword [ebp - 0x13c]
call fcn.00409080
test al, al
jne 0x4ce279
mov eax, dword [ebp - 4]
mov dword [ebp - 0x144], eax
mov byte [ebp - 0x140], 0xb
lea eax, [ebp - 0x144]
push eax
push 0
mov ecx, 0x4ce370
mov dl, 1
mov eax, dword [0x4079b4]
call fcn.0040c9f8
call fcn.00403c44
push dword [ebp - 0x20]
push dword [ebp - 4]
push 0x4ce390
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040462c
push dword [ebp - 0x20]
push dword [ebp + 8]
push 0x4ce39c
lea eax, [ebp - 0x148]
mov edx, 3
call fcn.0040462c
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 0x24]
call fcn.00404b04
push 0
mov eax, dword [ebp - 0x24]
call fcn.00404b14
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce340
lea eax, [ebp - 0x148]
call fcn.004042ac
lea eax, [ebp - 0x13c]
mov edx, 4
call fcn.004042d0
lea eax, [ebp - 0x24]
call fcn.004049b8
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004042d0
lea eax, [ebp - 0x14]
call fcn.00405d58
lea eax, [ebp - 0x10]
call fcn.00405d58
lea eax, [ebp - 0xc]
call fcn.00405d58
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042d0
lea eax, [ebp + 8]
call fcn.004042ac
ret
Function at 0x4ce3a4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040475c
mov eax, dword [ebp - 8]
call fcn.0040475c
xor eax, eax
push ebp
push 0x4ce451
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43c810]
call fcn.0043c8bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4ce42f
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.0043c95c
mov cl, 1
mov edx, 0x4ce468
mov eax, dword [ebp - 0x10]
call fcn.0043c9c0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0043cae4
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce436
mov eax, dword [ebp - 0x10]
call fcn.00403478
ret

Function at 0x4ce5d8
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040475c
xor eax, eax
push ebp
push 0x4ce69b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004042ac
xor edx, edx
push ebp
push 0x4ce67e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.0040476c
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4ce670
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
xor eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x28]
mov ecx, 3
mov eax, 0x4ce6b0
call fcn.00409f40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce685
ret

Function at 0x4ce6bc
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040475c
xor eax, eax
push ebp
push 0x4ce73e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004042ac
lea eax, [ebp - 0x194]
push eax
push 2
call sub.wsock32.dll_WSAStartup
xor eax, eax
push ebp
push 0x4ce721
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ce5d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce728
call sub.wsock32.dll_WSACleanup
ret
Function at 0x4ce74c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ce7c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0xff
call fcn.004048f8
mov dword [ebp - 4], 0xff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004047c4
push eax
call sub.kernel32.dll_GetComputerNameA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4ce7a4
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00404300
jmp 0x4ce7ab
mov eax, ebx
call fcn.004042ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce7c8
lea eax, [ebp - 8]
call fcn.004042ac
ret
Function at 0x412210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41223d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41223d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401642
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov eax, dword [ebp - 8]
xor ebx, ebx
mov dword [ebp - 0x10], eax
cmp esi, ebx
je 0x4016dd
cmp eax, 2
jl 0x4016dd
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call edi
test eax, eax
je 0x4016dd
push dword [esi + 4]
call edi
test eax, eax
je 0x4016dd
cmp dword [ebp - 0x10], 2
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
jle 0x4016ab
mov eax, dword [esi + 8]
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 4], ebx
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x4016dd
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], 2
mov eax, dword [esi + 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
jle 0x4016c0
mov ecx, dword [esi + 8]
mov dword [ebp - 0xc], ecx
cmp word [eax], 0x40
jne 0x401752
lea eax, [ebp - 0x14]
push eax
call fcn.004014fa
pop ecx
test eax, eax
je 0x4016eb
push esi
call edi
jmp 0x4016e4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [ebp - 0x14], 2
jge 0x401749
push 0x3c
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.0040153c
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x4400
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], str.runas
mov dword [ebp - 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
push 0x5c
pop ecx
mov dword [ebp - 0x3c], eax
mov word [eax], cx
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x4016d8
mov ecx, dword [ebp - 0x10]
push 0x5c
pop eax
mov word [ecx], ax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [section..data], eax
mov eax, dword [section..data]
test eax, eax
je 0x4016d8
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.004015e2
pop ecx
pop ecx
jmp 0x4016d8
Function at 0x40188b
Capabilities:
Check os version
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
mov esi, ecx
call fcn.00401869
mov edi, 0x114
push edi
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.0040153c
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4018cf
xor al, al
jmp 0x40192c
xor eax, eax
cmp dword [ebp - 0x110], 6
jb 0x4018ec
push dword [ebp + 0xc]
lea edi, [esi + 8]
call fcn.00401798
pop ecx
test eax, eax
je 0x4018cb
mov eax, edi
push eax
xor edi, edi
push edi
push edi
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push eax
lea ecx, [esi + 4]
call fcn.00401846
cmp dword [esi + 4], 0xffffffff
jne 0x401921
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 4], 0xffffffff
mov edi, eax
je 0x40192a
test edi, edi
jne 0x40192a
xor eax, eax
inc eax
jmp 0x40192c
xor eax, eax
pop edi
pop esi
leave
ret 0x14

Function at 0x401932
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push edi
push edi
push 1
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
cmp ebx, edi
jne 0x401964
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4019cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x40199e
xor esi, esi
inc esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x40195d
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x4019b8
cmp eax, 0x102
jne 0x401990
push 2
pop esi
jmp 0x401993
mov esi, dword [esi + 4]
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x401990
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 4], eax
jne 0x401990
xor esi, esi
jmp 0x401993
Function at 0x4019db
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push edi
push edi
push 1
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
cmp ebx, edi
jne 0x401a0d
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401a78
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x401a47
xor esi, esi
inc esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x401a06
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x401a61
cmp eax, 0x102
jne 0x401a39
push 2
pop esi
jmp 0x401a3c
mov esi, dword [esi + 4]
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x401a39
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 4], eax
jne 0x401a39
xor esi, esi
jmp 0x401a3c

Function at 0x401a84
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push edi
push edi
push 1
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
cmp ebx, edi
jne 0x401ab6
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x401b1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x401b1e
cmp eax, 0x3e5
je 0x401aed
xor esi, esi
inc esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x401aaf
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x401b07
cmp eax, 0x102
jne 0x401adf
push 2
pop esi
jmp 0x401ae2
mov esi, dword [esi + 4]
push edi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x401adf
xor esi, esi
jmp 0x401ae2

Function at 0x401b22
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push 0x114
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.0040153c
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x401b60
xor al, al
leave
ret
cmp dword [ebp - 0x110], 6
sbb eax, eax
inc eax
leave
ret
Function at 0x401c4a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ecx
cmp byte [ebp + 0x10], bl
je 0x401ca5
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
test eax, eax
jne 0x401c79
xor al, al
jmp 0x401d64
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x401c72
push dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
call fcn.00401c4a
jmp 0x401d64
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
test eax, eax
je 0x401c72
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
test eax, eax
jne 0x401cce
mov word [ebp - 0x20c], ax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
mov esi, eax
cmp esi, ebx
jne 0x401ce1
mov esi, dword [ebp + 0xc]
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [ebp + eax*2 - 0x20a]
movzx eax, word [esi]
mov ecx, eax
push 0x5c
mov word [edi - 2], ax
pop eax
cmp ax, cx
jne 0x401d0e
xor eax, eax
mov word [edi], ax
jmp 0x401d1a
xor eax, eax
cmp ax, cx
sete al
cmp al, bl
je 0x401d4d
cmp dword [ebp + 0x14], 0xffffffff
lea eax, [ebp - 0x20c]
je 0x401d34
push dword [ebp + 0x14]
push ebx
push eax
mov eax, dword [ebp - 4]
push ebx
call dword [eax + 0x20]
jmp 0x401d3c
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, ebx
jne 0x401d4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401d5c
xor eax, eax
cmp ax, word [esi]
je 0x401d60
add esi, 2
add edi, 2
jmp 0x401cf6
xor al, al
jmp 0x401d62
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x401dd0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
call fcn.00401b22
test al, al
je 0x401f16
push ebx
push edi
push str.ktmw32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
mov ecx, esi
call fcn.00401d8b
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
cmp eax, ebx
je 0x401e36
push str.CreateTransaction
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi]
push str.CommitTransaction
push eax
call edi
mov dword [esi + 8], eax
cmp dword [esi + 4], ebx
je 0x401e24
cmp eax, ebx
jne 0x401e36
mov eax, dword [esi]
cmp eax, ebx
je 0x401e33
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi], ebx
mov dword [esi + 8], ebx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
lea ecx, [esi + 0xc]
call fcn.00401d8b
mov eax, dword [esi + 0xc]
test eax, eax
je 0x401f14
push str.GetFullPathNameTransactedW
push eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
push str.SetFileAttributesTransactedW
push eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
push str.FindFirstFileTransactedW
push eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0xc]
push str.DeleteFileTransactedW
push eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xc]
push str.CreateDirectoryTransactedW
push eax
call edi
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0xc]
push str.RemoveDirectoryTransactedW
push eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0xc]
push str.CopyFileTransactedW
push eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0xc]
push str.MoveFileTransactedW
push eax
call edi
xor edi, edi
mov dword [esi + 0x2c], eax
cmp dword [esi + 0x10], edi
je 0x401eeb
cmp dword [esi + 0x14], edi
je 0x401eeb
cmp dword [esi + 0x18], edi
je 0x401eeb
cmp dword [esi + 0x1c], edi
je 0x401eeb
cmp dword [esi + 0x20], edi
je 0x401eeb
cmp dword [esi + 0x24], edi
je 0x401eeb
cmp dword [esi + 0x28], edi
je 0x401eeb
cmp eax, edi
jne 0x401f14
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x401efc
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
pop edi
pop ebx
mov byte [esi + 0x4c], 0
mov al, 1
pop esi
ret
Function at 0x401f2b
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
cmp dword [ebp + 0x18], 0xffffffff
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
mov byte [ebp - 1], 0
je 0x401f6c
push dword [ebp + 0x18]
push ebx
call fcn.00401b6c
test al, al
je 0x401f68
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0xc]
call fcn.00401b6c
mov byte [ebp - 1], al
jmp 0x401f6c
or dword [ebp + 0x18], 0xffffffff
mov byte [ebp + 0x13], 0
cmp byte [ebp - 1], 0
push dword [ebp + 0x18]
mov ecx, esi
je 0x401f8b
push 3
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c13
jmp 0x401f99
push 0
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401bd8
test al, al
jne 0x401fdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
dec eax
je 0x401fd6
dec eax
jne 0x401fc9
cmp byte [ebp + 0x13], al
jne 0x401fd2
push dword [ebp + 0x18]
mov ecx, esi
push 1
push ebx
push dword [ebp + 8]
call fcn.00401c4a
test al, al
je 0x401fd2
mov byte [ebp + 0x13], 1
jmp 0x401f70
dec eax
dec eax
je 0x401fe5
sub eax, 0x1b
je 0x401fe5
xor al, al
jmp 0x401fde
test byte [ebp + 0x14], 1
je 0x401fd2
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0x14
and dword [ebp + 0x10], 0
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push 0
mov edi, str._s._.3d
jmp 0x402080
mov eax, dword [ebp - 8]
cmp byte [eax + 0x4c], 0
je 0x40205e
push 0x40347c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebx + eax*2 - 6]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40205e
push 1
push ebx
lea eax, [ebp - 0x418]
push edi
push eax
call esi
add esp, 0x10
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x418]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x40205e
push eax
push str.OCXUpdateFailed
lea eax, [ebp - 0x418]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x401fd2
cmp dword [ebp + 0x10], 0x3e7
je 0x401fd2
inc dword [ebp + 0x10]
push dword [ebp + 0x10]
push ebx
lea eax, [ebp - 0x210]
push edi
push eax
call esi
mov ecx, dword [ebp - 8]
add esp, 0x10
push dword [ebp + 0x18]
lea eax, [ebp - 0x210]
push 1
push eax
push ebx
push dword [ebp + 8]
call fcn.00401c13
test al, al
je 0x401ffb
push dword [ebp + 0x18]
mov ecx, dword [ebp - 8]
push 4
push 0
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call fcn.00401c13
cmp byte [ebp - 1], 0
push dword [ebp + 0x18]
mov ecx, dword [ebp - 8]
je 0x4020e3
push 3
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c13
jmp 0x4020f1
push 0
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401bd8
test al, al
jmp 0x401fda