joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408799
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0
lea eax, [ebp - 8]
push eax
call fcn.004089a4
mov edi, dword [ebp + 0x18]
mov esi, eax
test esi, esi
je 0x4087f8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4087eb
cmp dword [ebp - 0xc], 1
jne 0x4087eb
cmp dword [ebp - 8], eax
je 0x4087e5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
dec eax
jmp 0x408816
cmp dword [ebp - 8], 0
je 0x4087f8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
push esi
push edi
push dword [ebp + 0x14]
call fcn.00419fc8
add esp, 0xc
lea eax, [esi + 1]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x40880b
sub esi, eax
mov eax, esi
pop edi
pop esi
leave
ret 0x14

Function at 0x408887
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x42733c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp + 0x10], eax
push esi
mov esi, dword [ebp + 0xc]
sete al
push eax
push esi
push dword [ebp + 8]
call fcn.0040892d
cmp eax, dword [ebp + 0x10]
je 0x40891b
push edi
push 0x4015d0
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00419fc8
add esp, 0xc
xor edi, edi
push edi
lea eax, [ebp - 0x10c]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
lea eax, [ebp - 0x108]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40891a
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push edi
push esi
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.00419fba
leave
ret 0xc
Function at 0x4094bd
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Set file attributes
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x42733c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x16c], ebx
test ebx, ebx
je 0x409688
push esi
call fcn.004097a6
test eax, eax
je 0x409688
push esi
push ebx
push 0x104
mov edi, 0x4281f8
push edi
call fcn.004096b0
test eax, eax
je 0x409688
push ebx
call fcn.004092a1
mov esi, eax
push edi
mov dword [ebp - 0x170], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
mov dword [ebp - 0x168], eax
cmp eax, 0xffffffff
je 0x4095c1
test al, 1
je 0x4095c1
push edi
push 0x2d6
call fcn.0040d387
push eax
lea eax, [ebp - 0x130]
push 0x12c
push eax
call fcn.0041a2bf
add esp, 0x10
cmp dword [0x428374], ebx
jne 0x40959c
push 1
call fcn.0040d3af
cmp dword [ebp + 0x10], ebx
jne 0x4095a3
push 0x11
push 0x2d7
call fcn.0040d387
push eax
lea eax, [ebp - 0x130]
push eax
push dword [0x429ea8]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
je 0x4095a3
push ebx
call fcn.0040d3af
xor esi, esi
jmp 0x409673
push ebx
call fcn.0040d3af
mov eax, dword [ebp - 0x168]
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x168], eax
test eax, eax
je 0x40966d
push ebx
push 0x80
push 3
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x80000000
push esi
call ebx
mov esi, eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push 0x4281f8
call ebx
mov esi, eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call edi
cmp dword [ebp + 0x14], 0
je 0x409667
push 0x80
push 0x4281f8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
inc dword [0x4281f0]
mov esi, dword [ebp - 0x168]
push dword [ebp - 0x170]
push dword [ebp - 0x16c]
call fcn.00409331
mov eax, esi
jmp 0x40968a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419fba
leave
ret 0x10

Function at 0x4097a6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4097bb
xor eax, eax
jmp 0x4097c4
movzx eax, al
shr eax, 4
and eax, 1
pop ebp
ret 4
Function at 0x40999d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x2a
push esi
call fcn.0041a099
pop ecx
pop ecx
test eax, eax
jne 0x4099e9
push 0x3f
push esi
call fcn.0041a099
pop ecx
pop ecx
test eax, eax
jne 0x4099e9
mov al, byte [esi]
test al, al
je 0x4099d5
cmp al, 0x2f
jne 0x4099d5
mov al, byte [esi + 1]
test al, al
je 0x4099d5
cmp al, 0x2f
je 0x4099e5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4099e5
test al, 0x10
jne 0x4099e9
xor eax, eax
jmp 0x4099ec
xor eax, eax
inc eax
pop esi
pop ebp
ret 4

Function at 0x409a4b
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea edi, [ebx + 0x10]
push dword [edi]
call fcn.00413530
jmp 0x409af4
mov ecx, dword [esi]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409a68
sub ecx, edx
push ecx
push dword [esi]
push dword [0x429eb0]
call fcn.00413a00
cmp dword [esi + 0x20], 0
je 0x409aee
test byte [esi + 0x28], 4
je 0x409aaa
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0xfffffffe
push eax
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push dword [esi + 0x20]
push dword [0x429eb0]
call fcn.00413a00
mov edx, dword [esi + 4]
and dword [esi + 0x20], 0
test edx, edx
je 0x409aee
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp + 8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409ad0
sub ecx, dword [ebp + 8]
lea eax, [ecx + 1]
push eax
push edx
push dword [0x429eb0]
call fcn.00413a00
and dword [esi + 4], 0
push esi
call fcn.0041357f
mov esi, eax
test esi, esi
jne 0x409a63
push edi
call fcn.004131b2
lea edi, [ebx + 0x14]
push dword [edi]
call fcn.00413530
jmp 0x409b1c
push esi
call fcn.00409a4b
push esi
call fcn.0041357f
mov esi, eax
test esi, esi
jne 0x409b10
push edi
call fcn.004131b2
mov ecx, dword [ebx]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409b2d
sub ecx, edx
lea eax, [ecx + 1]
push eax
push dword [ebx]
push dword [0x429eb0]
call fcn.00413a00
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x40a0bf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40a0d4
xor eax, eax
jmp 0x40a0df
not al
movzx eax, al
shr eax, 4
and eax, 1
pop ebp
ret 4

Function at 0x40a3a9
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x42733c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push ebx
call fcn.00409981
test eax, eax
je 0x40a3db
xor eax, eax
xor edx, edx
jmp 0x40a490
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x148], eax
cmp eax, 0xffffffff
jne 0x40a43e
lea eax, [ebp - 0x144]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40a3d2
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
je 0x40a42a
mov eax, dword [ebp - 0x130]
mov dword [esi], eax
mov eax, dword [ebp - 0x12c]
mov dword [esi + 4], eax
test edi, edi
je 0x40a436
mov eax, dword [ebp - 0x144]
mov dword [edi], eax
mov eax, dword [ebp - 0x124]
jmp 0x40a3d4
lea ecx, [ebp - 0x14c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x150], eax
test esi, esi
je 0x40a46a
push esi
mov esi, dword [ebp - 0x148]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
jmp 0x40a470
mov esi, dword [ebp - 0x148]
test edi, edi
je 0x40a47d
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [edi], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x150]
mov edx, dword [ebp - 0x14c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419fba
leave
ret 0xc
Function at 0x410894
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xc
push dword [0x429eb0]
call fcn.00413857
test eax, eax
je 0x4108dd
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [0x42721c]
mov dword [eax + 8], ecx
lea ecx, [ebp - 4]
push ecx
xor ecx, ecx
push ecx
push eax
push 0x41088e
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4108dd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret 8

Function at 0x41114f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call fcn.0041a74c
add esp, 0xc
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
dec eax
leave
ret 0xc
Function at 0x411183
Capabilities:
Delete file
Get common file path
Get file size
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x42733c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x104
push edi
xor ebx, ebx
lea eax, [ebp - 0x108]
push ebx
push eax
or esi, 0xffffffff
call fcn.0041a74c
add esp, 0xc
cmp dword [0x428388], ebx
je 0x41130d
lea eax, [ebp - 0x108]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x108]
push eax
push ebx
push 0x4012c4
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x108]
push eax
push dword [0x428388]
call fcn.00408667
push eax
call fcn.004065d1
mov dword [ebp - 0x10c], eax
cmp eax, esi
je 0x4112c0
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4112c0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x4112c0
test edi, edi
je 0x4112b3
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4112b3
inc edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x4112ab
push edi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4112ab
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x411285
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4112be
push edi
push eax
push esi
call fcn.0041114f
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test edi, edi
jne 0x4112a3
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4112b9
mov edi, dword [ebp - 0x10c]
jmp 0x4112a3
mov edi, dword [ebp - 0x10c]
cmp edi, 0xffffffff
jne 0x4112f4
xor ebx, ebx
cmp dword [0x428374], 0
jne 0x4112f4
push 1
call fcn.0040d3af
push 0x10
push 0x4019e0
push 0x337
call fcn.0040d387
push eax
push dword [0x429ea8]
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.0040d3af
cmp esi, 0xffffffff
je 0x411300
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419fba
leave
ret
Function at 0x411eb6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x42733c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
push ebx
call fcn.00411999
mov edi, eax
test edi, edi
je 0x412018
cmp dword [edi + 0x514], esi
je 0x411ff9
cmp dword [edi + 0x51c], esi
je 0x411f90
mov ecx, dword [edi + 0x520]
add ecx, 0x210
movsx eax, byte [ecx]
neg eax
sbb eax, eax
test ecx, eax
je 0x411f90
lea ecx, [edi + 0x104]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411f1a
sub ecx, edx
lea eax, [ecx + ebx]
push eax
mov ebx, 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00419fc8
add esp, 0xc
cmp byte [ebp - 0x20c], 0
lea eax, [ebp - 0x20c]
je 0x411f59
cmp byte [eax], 0x5c
jne 0x411f53
mov byte [eax], 0x2f
inc eax
cmp byte [eax], 0
jne 0x411f4b
mov ecx, dword [edi + 0x520]
add ecx, 0x210
lea eax, [ebp - 0x20c]
push eax
movsx eax, byte [ecx]
neg eax
sbb eax, eax
and eax, ecx
push eax
push 0x401d50
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0041a2bf
add esp, 0x14
jmp 0x412012
push ebx
mov ebx, 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00419fc8
lea ecx, [ebp - 0x20c]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411faf
sub ecx, edx
je 0x411fdb
lea edx, [ebp - 0x20c]
add edx, ecx
cmp byte [edx - 1], 0x5c
je 0x411fdb
mov eax, ebx
push 0x401614
sub eax, ecx
push eax
push edx
call fcn.00419fc8
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x401d58
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0041a2bf
add esp, 0x10
jmp 0x412012
lea eax, [edi + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x412012
test al, 0x10
je 0x412012
xor esi, esi
inc esi
push edi
call fcn.00411e6b
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419fba
leave
ret 4
Function at 0x4126c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa10
mov eax, dword [0x42733c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xa10], ebx
lea eax, [ebp - 0x20c]
test edi, edi
jne 0x412713
push eax
mov esi, 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x41275c
push 0x4015ec
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00419fc8
add esp, 0xc
jmp 0x41275c
push 0x207
push edi
push 0x208
push eax
call fcn.0041a157
add esp, 0x10
push 0x5c
lea eax, [ebp - 0x20c]
push eax
call fcn.0040d2ca
mov esi, eax
test esi, esi
jne 0x41274f
push 0x2f
lea eax, [ebp - 0x20c]
push eax
call fcn.0040d2ca
mov esi, eax
test esi, esi
je 0x41275c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], bl
jne 0x41275c
mov byte [esi], bl
push 0x428e30
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x4287c8]
jmp 0x412787
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + 8]
push eax
call fcn.0041b05f
pop ecx
pop ecx
test eax, eax
je 0x41278b
mov esi, dword [esi]
test esi, esi
jne 0x41276f
push 0x428e30
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x4127a1
mov eax, esi
jmp 0x412883
cmp dword [0x4287b0], ebx
jne 0x4127b3
mov dword [0x4287b0], 1
mov eax, dword [0x4287c4]
test eax, eax
je 0x4127cc
lea ecx, [ebp - 0xa10]
push ecx
push 0x401cd8
call eax
jmp 0x4127f1
cmp dword [0x4287bc], ebx
je 0x4127f1
mov ecx, dword [0x4287b4]
test ecx, ecx
je 0x4127f1
mov eax, dword [ecx]
lea edx, [ebp - 0xa10]
push edx
push 0x401cf0
push ebx
push ecx
call dword [eax + 0xc]
mov esi, dword [ebp - 0xa10]
test esi, esi
je 0x41284e
mov eax, 0x401d10
test edi, edi
jne 0x412809
mov eax, 0x4012c0
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x4014c0
lea eax, [ebp - 0xa0c]
push 0x800
push eax
call fcn.0041a2bf
mov eax, dword [ebp - 0xa10]
add esp, 0x14
push 1
lea edx, [ebp - 0xa0c]
push edx
mov byte [ebp - 0x20d], bl
mov ecx, dword [eax]
push eax
call dword [ecx + 0x88]
mov esi, dword [ebp - 0xa10]
push 0x31c
push 1
call fcn.0041ba7f
pop ecx
pop ecx
test eax, eax
je 0x412877
lea ecx, [ebp - 0x20c]
push ecx
push esi
mov ecx, eax
call fcn.00412967
mov esi, dword [ebp - 0xa10]
mov ebx, eax
test esi, esi
je 0x412881
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419fba
leave
ret 4
Function at 0x412dab
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebx]
and dword [edi], eax
cmp byte [esi], 0x2f
mov dword [ebp + 8], esi
mov dword [ebp - 4], eax
jne 0x412dcf
cmp byte [esi + 1], 0x2f
je 0x412e69
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x412de7
test al, 0x10
je 0x412de7
mov dword [edi], 1
jmp 0x412e24
mov al, byte [esi]
test al, al
je 0x412e05
cmp byte [esi + 1], 0x3a
jne 0x412e05
add esi, 2
mov al, byte [esi]
xor ecx, ecx
test al, al
je 0x412e64
cmp al, 0x2e
jne 0x412e2b
inc ecx
jmp 0x412e35
cmp al, 0x5c
jne 0x412df6
cmp byte [esi + 1], al
jne 0x412df6
xor ecx, ecx
cmp al, 0x5c
jne 0x412e1a
inc ecx
cmp ecx, 4
jge 0x412df6
inc esi
mov al, byte [esi]
test al, al
jne 0x412e10
mov esi, dword [ebp + 8]
and dword [ebx], 0
mov eax, esi
jmp 0x412e6b
xor ecx, ecx
cmp al, 0x5c
je 0x412e44
cmp al, 0x2f
je 0x412e44
cmp ecx, 2
jg 0x412e50
cmp al, 0x2a
je 0x412e50
cmp al, 0x3f
je 0x412e50
jmp 0x412e49
mov eax, esi
mov dword [ebp - 4], eax
inc esi
mov al, byte [esi]
test al, al
jne 0x412dfe
mov eax, dword [ebp - 4]
test eax, eax
je 0x412e64
lea ecx, [eax + 1]
mov byte [eax], 0
mov eax, dword [ebp + 8]
mov dword [ebx], ecx
jmp 0x412e6b
mov eax, dword [ebp + 8]
mov dword [ebx], eax
xor eax, eax
pop esi
pop ebx
leave
ret 4

Function at 0x412e71
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi + 4], 0
je 0x412ed2
push ebx
mov ebx, dword [edi]
test ebx, ebx
je 0x412ec8
mov eax, ebx
imul eax, eax, 0x10c
push esi
mov esi, dword [edi + 4]
sub eax, 0x10c
dec ebx
push ebx
mov ecx, edi
mov dword [ebp - 4], eax
add esi, eax
call fcn.00413020
add esi, 8
cmp byte [esi], 0
je 0x412ec0
mov eax, dword [edi + 4]
mov ecx, dword [ebp - 4]
cmp dword [ecx + eax + 4], 0
jne 0x412ec0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
test ebx, ebx
jne 0x412e8e
pop esi
push dword [edi + 4]
call fcn.0041b0a6
pop ecx
pop ebx
pop edi
leave
ret
Function at 0x412ed5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, esi
mov edx, 0x10c
mul edx
seto cl
mov dword [ebx], esi
neg ecx
or ecx, eax
push ecx
call fcn.004114d8
pop ecx
mov ecx, eax
mov dword [ebx + 4], ecx
test ecx, ecx
je 0x412f8a
mov eax, esi
imul eax, eax, 0x10c
push edi
push eax
push 0
push ecx
call fcn.0041a74c
and dword [ebp - 8], 0
mov ebx, dword [ebx + 4]
add esp, 0xc
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], 1
test esi, esi
je 0x412f86
lea edi, [ebx + 8]
push edi
push 0x104
dec esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push edi
push 0
push 0x401d0c
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0
push 0x100
push 2
lea eax, [ebp - 0xc]
push eax
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x412f90
mov eax, 0x10c
add ebx, eax
add edi, eax
test esi, esi
jne 0x412f3b
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
xor eax, eax
jmp 0x412f89

Function at 0x413655
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0x42a3e0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffff
jbe 0x413676
xor eax, eax
jmp 0x413744
push esi
push edi
mov edi, dword [0x428e48]
test edi, edi
je 0x41369e
mov esi, dword [edi + 0x10]
lea eax, [ebp + 8]
push eax
push ebx
push esi
call fcn.00413631
test eax, eax
js 0x4136e2
lea eax, [esi + ebx]
cmp eax, 0x61a9
jbe 0x41371c
push 0x61bc
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x4136c1
and dword [0x428e48], eax
push 0x401d94
jmp 0x4136dc
mov edi, dword [0x428e48]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [0x428e48], eax
test eax, eax
jne 0x4136e6
push 0x401dac
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x413742
mov dword [eax], edi
mov eax, dword [0x428e48]
xor ecx, ecx
mov dword [eax + 4], ecx
mov eax, dword [0x428e48]
mov dword [eax + 8], esi
mov eax, dword [0x428e48]
mov dword [eax + 0xc], ecx
mov eax, dword [0x428e48]
mov dword [eax + 0x10], ecx
test edi, edi
je 0x413716
mov eax, dword [0x428e48]
mov dword [edi + 4], eax
mov edi, dword [0x428e48]
mov esi, dword [edi + 0x10]
inc dword [edi + 0xc]
mov ecx, dword [0x428e48]
add dword [ecx + 0x10], ebx
mov edx, dword [0x428e48]
mov ecx, dword [edx + 0x10]
add ecx, 3
and ecx, 0xfffffffc
lea eax, [edi + 0x14]
mov dword [edx + 0x10], ecx
add eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x413afd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x42733c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x191
push dword [0x42a3a4]
call dword [sym.imp.USER32.dll_LoadStringA]
push edi
lea eax, [ebp - 0x108]
push eax
push 0x192
push dword [0x42a3a4]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x12
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
cmp eax, 3
jne 0x413b6e
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419fba
leave
ret

Function at 0x413e91
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
test edi, edi
je 0x413ea2
mov dword [edi], ebx
push 0x7018
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x413f48
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x413ef4
test edi, edi
je 0x413f45
push ebx
push ebx
push ebx
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x413ef8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x413f47
lea eax, [esi + 0xc]
xor ecx, ecx
mov dword [esi], ebx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0x500c], ecx
cmp dword [ebp - 4], 2
jne 0x413f3b
mov eax, 0xfeff
cmp ax, word [ebp + 0xc]
jne 0x413f3b
xor eax, eax
inc eax
mov dword [esi + 0x500c], eax
mov dword [edi], eax
lea eax, [esi + 0x5010]
mov dword [esi + 0x7010], eax
mov dword [esi + 0x7014], eax
jmp 0x413f45
push ecx
push ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
pop esi
pop edi
pop ebx
leave
ret 8