joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e550
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x543e5c
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x5960c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esi + 4]
lea ecx, [ebp - 0x120]
mov edi, edx
call fcn.0040eef0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x120]
cmp dword [ecx - 0xc], 1
jge 0x40e5d0
lea eax, [ecx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e5c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x40e746
mov ecx, dword [esi + 8]
push ecx
lea ecx, [ebp - 0x124]
call fcn.00401ea0
push 0x103
lea edx, [ebp - 0x117]
push 0
mov byte [ebp - 4], 1
push edx
mov byte [ebp - 0x118], 0
call fcn.00521f30
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x118]
push ecx
lea ecx, [ebp - 0x11c]
call fcn.00401ea0
push 1
mov bl, 2
push 0x5718c4
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], bl
call fcn.00401b30
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x11c]
call fcn.00401b30
push ecx
lea edx, [ebp - 0x11c]
mov dword [ebp - 0x12c], esp
mov ecx, esp
push edx
call fcn.00405870
push ecx
lea eax, [ebp - 0x120]
mov dword [ebp - 0x128], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 3
call fcn.00405870
mov byte [ebp - 4], bl
call fcn.0040de40
mov edx, dword [ebp - 0x11c]
add esp, 8
mov bl, al
test edi, edi
je 0x40e6ca
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x40e6b8
push 0
lea ecx, [ebp - 0x11c]
call fcn.00402080
mov edx, dword [ebp - 0x11c]
mov eax, edx
sub edi, edx
lea esp, [esp]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x40e6c0
test bl, bl
jne 0x40e6d2
xor esi, esi
jmp 0x40e6d5
movzx esi, bl
lea eax, [edx - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e6f5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x124]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e71b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x120]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e744
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051ac68
mov esp, ebp
pop ebp
ret
Function at 0x40ecd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x543dc1
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x5960c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push 0x103
mov edi, ecx
lea ecx, [ebp - 0x243]
push ebx
mov dword [ebp - 0x248], ebx
push ecx
mov dword [ebp - 0x254], eax
mov byte [ebp - 0x244], bl
call fcn.00521f30
add esp, 0xc
lea edx, [ebp - 0x244]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x248]
call fcn.00401ea0
push 1
push 0x5718c4
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], ebx
call fcn.00401b30
push 0xa
push str.update.txt
lea ecx, [ebp - 0x248]
call fcn.00401b30
xor eax, eax
push 0x103
lea ecx, [ebp - 0x13b]
push ebx
push ecx
mov byte [ebp - 0x30], bl
mov dword [ebp - 0x2f], eax
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov byte [ebp - 0x13c], bl
call fcn.00521f30
add esp, 0xc
lea ecx, [ebp - 0x13c]
call fcn.0040c910
lea eax, [ebp - 0x13c]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x40edc1
mov edx, dword [str._ver.txt]
mov ecx, dword [0x573290]
mov dword [eax], edx
mov dl, byte [0x573294]
mov dword [eax + 4], ecx
mov byte [eax + 8], dl
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - method.CIni.virtual_0], vtable.CIni.0
call fcn.0051ca76
add esp, 4
mov dword [ebp - 0x24c], eax
push edi
mov byte [ebp - 4], 1
push str.version
lea ecx, [ebp - 0x250]
mov byte [ebp - 0x30], bl
push ecx
mov ebx, 0x5722cf
call fcn.00412970
push 0x1c
mov ebx, eax
push ebx
lea edx, [ebp - 0x30]
push 0x1c
push edx
call fcn.0051d134
push ebx
call fcn.0041aff6
mov eax, dword [ebp - 0x248]
xor ebx, ebx
add esp, 0x14
mov dword [ebp - method.CIni.virtual_0], vtable.CIni.0
mov dword [ebp - 0x258], ebx
test eax, eax
je 0x40ee66
push eax
call fcn.0051ca76
mov ebx, eax
add esp, 4
mov dword [ebp - 0x258], ebx
lea eax, [ebp - 0x30]
push eax
mov ecx, edi
mov edi, dword [ebp - 0x254]
mov eax, str.Version
lea edx, [ebp - 0x25c]
mov byte [ebp - 4], 2
call fcn.00412930
test ebx, ebx
je 0x40ee93
push ebx
call fcn.0051bf76
add esp, 4
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x40eea6
push eax
call fcn.0051bf76
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x248]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40eecf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0051ac68
mov esp, ebp
pop ebp
ret 4
Function at 0x40eef0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x543d76
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x5960c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push 0x103
lea eax, [ebp - 0x117]
push esi
mov dword [ebp - 0x11c], esi
push eax
mov edi, ecx
mov byte [ebp - 0x118], 0
call fcn.00521f30
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x118]
push edx
lea ecx, [ebp - 0x11c]
call fcn.00401ea0
push 1
push 0x5718c4
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], esi
call fcn.00401b30
push 0xa
push str.update.txt
lea ecx, [ebp - 0x11c]
call fcn.00401b30
mov eax, dword [ebp - 0x11c]
mov dword [ebp - method.CIni.virtual_0], vtable.CIni.0
mov dword [ebp - 0x120], esi
test eax, eax
je 0x40efb9
push eax
call fcn.0051ca76
mov esi, eax
add esp, 4
mov dword [ebp - 0x120], esi
push 0x5722cf
mov eax, str.File
mov ecx, ebx
lea edx, [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.00412930
test esi, esi
je 0x40efe1
push esi
call fcn.0051bf76
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f00a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051ac68
mov esp, ebp
pop ebp
ret
Function at 0x40f180
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x543d36
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x5960c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x22c], ebx
call fcn.004219a6
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40f1db
push 0x80004005
call fcn.00402210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x228], esi
push 0x85
mov dword [ebp - 4], ebx
call fcn.00422d52
cmp eax, ebx
je 0x40f215
push 0x85
push eax
lea ecx, [ebp - 0x228]
call fcn.00401d30
mov esi, dword [ebp - 0x228]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [ebp - 0x220]
call fcn.00401ea0
mov byte [ebp - 4], 1
mov eax, dword [esi - 0xc]
push eax
push esi
lea ecx, [ebp - 0x220]
call fcn.00401b30
push 0x207
lea ecx, [ebp - 0x21b]
push ebx
push ecx
mov byte [ebp - 0x21c], bl
call fcn.00521f30
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x220]
mov dword [ebp - 0x23c], 0x208
mov dword [ebp - 0x238], ebx
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
add esp, 0xc
or ecx, eax
jge 0x40f28f
push ebx
lea ecx, [ebp - 0x220]
call fcn.00402080
mov edx, dword [ebp - 0x220]
lea eax, [ebp - 0x224]
push eax
push 0x20019
push ebx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x22c], eax
cmp eax, ebx
je 0x40f2c9
push 0x58a844
lea ecx, [ebp - 0x230]
push ecx
mov dword [ebp - 0x230], eax
call fcn.005222e2
lea edx, [ebp - 0x23c]
push edx
mov edx, dword [ebp - 0x224]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x238]
push ecx
push ebx
push str.DisplayVersion
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x22c], eax
cmp eax, ebx
je 0x40f329
mov dword [ebp - 0x234], eax
push 0x58a844
lea eax, [ebp - 0x234]
push eax
call fcn.005222e2
mov dword [ebp - 4], 1
mov eax, 0x40f31f
ret
cmp edi, ebx
je 0x40f33f
lea ecx, [ebp - 0x21c]
mov edx, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x40f335
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x224]
cmp eax, ebx
je 0x40f357
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
mov dword [ebp - 0x224], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f382
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f3a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0051ac68
mov esp, ebp
pop ebp
ret
Function at 0x40fd70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push 0x38
xor edi, edi
lea eax, [ebp - 0x3c]
push edi
push eax
mov dword [ebp - 0x40], 0x3c
call fcn.00521f30
mov esi, 0x10
add esp, 0xc
cmp dword [ebp + 0x1c], esi
jb 0x40fda2
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x30], ecx
jmp 0x40fda8
lea edx, [ebp + 8]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x38], esi
jb 0x40fdc2
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
jmp 0x40fdc8
lea ecx, [ebp + 0x24]
mov dword [ebp - 0x2c], ecx
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x40fe0e
cmp dword [ebp + 0x1c], esi
jb 0x40fde7
mov eax, dword [ebp + 8]
push eax
call fcn.0041aff6
add esp, 4
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], edi
mov byte [ebp + 8], 0
cmp dword [ebp + 0x38], esi
jb 0x40fe06
mov ecx, dword [ebp + 0x24]
push ecx
call fcn.0041aff6
add esp, 4
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea edx, [ebp - 4]
push edx
push eax
mov dword [ebp - 4], edi
call esi
cmp dword [ebp - 4], 0x103
jne 0x40fe4c
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push edx
call esi
push 0x1f4
call edi
cmp dword [ebp - 4], 0x103
je 0x40fe30
xor edi, edi
mov esi, 0x10
cmp dword [ebp + 0x1c], esi
jb 0x40fe62
mov eax, dword [ebp + 8]
push eax
call fcn.0041aff6
add esp, 4
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], edi
mov byte [ebp + 8], 0
cmp dword [ebp + 0x38], esi
jb 0x40fe81
mov ecx, dword [ebp + 0x24]
push ecx
call fcn.0041aff6
add esp, 4
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc54
mov eax, dword [0x5960c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
mov ebx, edx
jne 0x411583
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051ac68
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne 0x41158a
lea ebx, [edi + 8]
push ebx
call fcn.004116e0
add esp, 4
test al, al
je 0x411570
lea esi, [ebp - 0xc50]
call fcn.00411440
cmp byte [ebp - 0xa20], 0
push 0
mov eax, esi
push eax
je 0x4115e5
add edi, 8
push edi
lea ecx, [ebp - 0x218]
push 0
push ecx
call fcn.0051c2c3
lea edx, [ebp - 0x218]
add esp, 0x14
push edx
call fcn.004116e0
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051ac68
mov esp, ebp
pop ebp
ret
push ebx
lea ecx, [ebp - 0x110]
push 0
push ecx
call fcn.0051c2c3
add esp, 0x14
lea eax, [ebp - 0x110]
call fcn.00411790
test al, al
je 0x411570
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x411570
mov eax, dword [edi + 4]
push eax
call fcn.00415a70
test eax, eax
jne 0x411570
jmp 0x411650
mov edx, dword [edi + 4]
push 0x800
lea ecx, [ebp - 0xa18]
push ecx
push edx
call fcn.004153e0
mov esi, eax
test esi, esi
jle 0x41169c
push 0
lea eax, [ebp - 0xc54]
push eax
push esi
lea ecx, [ebp - 0xa18]
push ecx
push ebx
mov dword [ebp - 0xc54], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x411699
cmp dword [ebp - 0xc54], esi
je 0x411650
or esi, 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [edi + 4]
push edx
call fcn.004155e0
test esi, esi
jne 0x4116c1
mov ecx, dword [ebp - 0xa38]
lea eax, [ebp - 0x110]
call fcn.004117d0
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.0051ac68
mov esp, ebp
pop ebp
ret

Function at 0x4116e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x411784
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x411784
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x411716
and al, 0x10
xor ecx, ecx
cmp al, 0x10
sete al
pop esi
pop ebp
ret
push ebx
push edi
push esi
call fcn.0051ca76
mov edi, eax
push 0x5c
push edi
call fcn.0051c2f0
mov ecx, esi
add esp, 0xc
lea ebx, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x411730
sub ecx, ebx
cmp byte [ecx + esi - 1], 0x5c
sete bl
test eax, eax
je 0x41177d
push edi
mov byte [eax], dl
call fcn.004116e0
add esp, 4
push edi
test al, al
jne 0x411764
call fcn.0051bf76
add esp, 4
pop edi
pop ebx
xor al, al
pop esi
pop ebp
ret
call fcn.0051bf76
add esp, 4
test bl, bl
jne 0x41177d
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41175d
pop edi
pop ebx
mov al, 1
pop esi
pop ebp
ret
xor al, al
pop esi
pop ebp
ret
Function at 0x4117d0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
jne 0x411800
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp eax, 1
sete bl
test bl, bl
je 0x411866
lea ecx, [ebp - 0x10]
push ecx
push esi
shr esi, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
cmp eax, 1
sete bl
test bl, bl
je 0x411866
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
cmp eax, 1
sete bl
test bl, bl
je 0x411866
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x18]
push edx
mov eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp eax, 1
sete bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411880
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x5960c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00521f30
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x110]
push esi
push ecx
call fcn.0051cda6
lea edx, [ebp - 0x110]
add esp, 0xc
push edx
call fcn.00411ad0
add esp, 4
cmp eax, 1
jne 0x4118f4
push 0x10000000
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051ac68
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov word [ebp - 0x114], ax
lea edx, [ebp - 0x130]
lea eax, [ebp - 0x110]
mov ecx, 0x294
push edx
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], 3
mov word [ebp - 0x120], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0051ac68
mov esp, ebp
pop ebp
ret
Function at 0x411970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x5960c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x213]
push 0
push eax
mov byte [ebp - 0x214], 0
call fcn.00521f30
push 0x104
lea ecx, [ebp - 0x214]
push esi
push ecx
call fcn.0051cda6
xor eax, eax
push 0x104
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
mov word [ebp - 0x218], ax
lea ecx, [ebp - 0x10b]
lea edx, [ebp - 0x214]
mov eax, 0x214
or word [ebp - 0x224], ax
push 0
push ecx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x230], 3
mov byte [ebp - 0x10c], 0
call fcn.00521f30
add esp, 0x24
lea edx, [ebp - 0x10c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push edi
jmp 0x411a40
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
call fcn.00411e80
add esp, 4
test eax, eax
jne 0x411a68
lea edi, [ebp - 0x10c]
call fcn.00411cd0
test eax, eax
jne 0x411a40
lea ecx, [ebp - 0x234]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
pop edi
call fcn.0051ac68
mov esp, ebp
pop ebp
ret
Function at 0x411ad0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5434f0
mov eax, dword fs:[0]
push eax
sub esp, 0x170
mov eax, dword [0x5960c0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
push 0x140
xor esi, esi
lea ecx, [ebp - 0x15c]
push esi
push ecx
mov dword [ebp - 0x178], eax
call fcn.00521f30
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0xc
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x164], esi
mov dword [ebp - 0x160], esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov esi, eax
test esi, esi
je 0x411b5e
lea edx, [ebp - 0x160]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x160], 0
je 0x411b7f
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call edi
push eax
call ebx
lea ecx, [ebp - 0x164]
push ecx
call eax
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x15c]
push edx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x411bc0
xor eax, eax
push 0x58a844
lea ecx, [ebp - 0x168]
push ecx
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x168], eax
call fcn.005222e2
mov eax, dword [ebp - 0x15c]
mov edx, eax
or edx, 0x10
cmp eax, edx
jne 0x411c43
nop
lea eax, [ebp - 0x15c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x411c1a
mov eax, dword [ebp - 0x15c]
mov ecx, eax
or ecx, 0x10
cmp eax, ecx
je 0x411bd0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 2
push 0x58a844
lea edx, [ebp - 0x174]
push edx
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x174], eax
call fcn.005222e2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x16c], eax
push 0x58a844
lea eax, [ebp - 0x16c]
push eax
call fcn.005222e2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 2
push 0x58a844
lea ecx, [ebp - 0x170]
push ecx
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x170], eax
call fcn.005222e2
mov dword [ebp - 4], 0xffffffff
mov eax, 0x411c79
ret
Function at 0x411cd0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x5960c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.00521f30
add esp, 0xc
lea ecx, [ebp - 0x10c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
jmp 0x411d20
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411d20
sub eax, edx
push esi
mov esi, eax
lea edx, [esi - 2]
cmp edx, 1
ja 0x411d7e
movsx eax, byte [ebp - 0x10c]
push eax
call fcn.0051ced6
add esp, 4
cmp eax, 0x41
jl 0x411d7e
movsx ecx, byte [ebp - 0x10c]
push ecx
call fcn.0051ced6
add esp, 4
cmp eax, 0x5a
jg 0x411d7e
cmp byte [ebp - 0x10b], 0x3a
jne 0x411d7e
cmp esi, 3
jne 0x411d75
cmp byte [ebp - 0x10a], 0x5c
jne 0x411d7e
cmp byte [ebp - 0x10c], 0
jne 0x411dba
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411d87
sub eax, edx
dec eax
js 0x411da0
cmp byte [ebp + eax - 0x10c], 0x5c
je 0x411dcb
dec eax
jns 0x411d93
test edi, edi
je 0x411dba
lea eax, [ebp - 0x10c]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411db0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051ac68
mov esp, ebp
pop ebp
ret
mov byte [ebp + eax - 0x10c], 0
test edi, edi
je 0x411ded
lea eax, [ebp - 0x10c]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411de3
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411df6
sub eax, edx
mov esi, eax
lea edx, [esi - 2]
cmp edx, 1
ja 0x411e57
movsx eax, byte [ebp - 0x10c]
push eax
call fcn.0051ced6
add esp, 4
cmp eax, 0x41
jl 0x411e57
movsx ecx, byte [ebp - 0x10c]
push ecx
call fcn.0051ced6
add esp, 4
cmp eax, 0x5a
jg 0x411e57
cmp byte [ebp - 0x10b], 0x3a
jne 0x411e57
cmp esi, 3
jne 0x411e4a
cmp byte [ebp - 0x10a], 0x5c
jne 0x411e57
cmp byte [ebp - 0x10c], 0
jne 0x411dba
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0051ac68
mov esp, ebp
pop ebp
ret

Function at 0x412170
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412176
sub eax, edx
inc eax
push eax
mov eax, dword [esi + 0x10]
push edi
push 1
push 0
push str.IBKCNAssist
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, edi
mov dword [esi + 4], eax
lea edi, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4121a0
sub ecx, edi
inc ecx
mov dword [esi + 0xc], ecx
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 8], 1
pop edi
mov eax, ecx
ret