joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4060de
Capabilities:
Terminate process

Disassembly:
push edi
mov edi, ecx
test edi, edi
je 0x4061b1
push edi
call dword [sym.imp.libav.dll_Ordinal_44297]
pop ecx
test eax, eax
je 0x4060fd
push 0xffffffffffffffff
call dword [sym.imp.MSVCR110.dll_exit]
cmp dword [edi + 0x18], 1
je 0x406115
push edi
call dword [sym.imp.libav.dll_Ordinal_44298]
pop ecx
test eax, eax
je 0x4061b1
jmp 0x4060f5
cmp dword [edi + 0x24], 0
mov dword [edi + 0x18], 2
jle 0x40613b
lea eax, [edi + 4]
push eax
call dword [sym.imp.libav.dll_Ordinal_44306]
pop ecx
test eax, eax
je 0x40613b
push edi
call dword [sym.imp.libav.dll_Ordinal_44298]
pop ecx
pop edi
ret
cmp dword [edi + 0x24], 0
push esi
jle 0x406158
lea esi, [edi + 4]
push edi
push esi
call dword [sym.imp.libav.dll_Ordinal_44311]
pop ecx
pop ecx
test eax, eax
jne 0x4061b3
cmp dword [edi + 0x24], eax
jg 0x406145
mov ecx, edi
call fcn.00405bd9
push edi
call dword [sym.imp.libav.dll_Ordinal_44298]
pop ecx
test eax, eax
jne 0x4060f5
push edi
call dword [sym.imp.libav.dll_Ordinal_44299]
mov esi, dword [sym.imp.libav.dll_Ordinal_44308]
lea eax, [edi + 0xc]
push eax
call esi
lea eax, [edi + 0x10]
push eax
call esi
lea eax, [edi + 0x14]
push eax
call esi
lea eax, [edi + 4]
push eax
call esi
lea eax, [edi + 8]
push eax
call dword [sym.imp.libav.dll_Ordinal_44314]
push dword [edi + 0x40]
mov esi, dword [sym.imp.MSVCR110.dll_free]
call esi
push dword [edi + 0x3c]
call esi
push edi
call esi
add esp, 0x24
pop esi
pop edi
ret
push edi
call dword [sym.imp.libav.dll_Ordinal_44298]
pop ecx
jmp 0x4061b0

Function at 0x406a77
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xb], 0x2e32336c
mov word [ebp - 0xd], 0x656e
mov word [ebp - 0x10], 0x654b
mov dword [ebp - 7], 0x6c6c64
mov byte [ebp - 0xe], 0x72
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
leave
ret

Function at 0x406aa7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xb], 0x6568
mov byte [ebp - 0xc], 0x53
mov word [ebp - 8], 0x336c
mov dword [ebp - 5], 0x6c6c642e
mov byte [ebp - 6], 0x32
mov byte [ebp - 9], 0x6c
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret

Function at 0x406adc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x10], 0x6441
mov dword [ebp - 0xd], 0x33697061
mov dword [ebp - 9], 0x6c642e32
mov word [ebp - 5], 0x6c
mov byte [ebp - 0xe], 0x76
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret

Function at 0x406b0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], 0x6e44
mov dword [ebp - 7], 0x6c642e69
mov word [ebp - 9], 0x7061
mov word [ebp - 3], 0x6c
mov byte [ebp - 0xa], 0x73
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret
Function at 0x406b3b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 0x14]
push eax
xor ebx, ebx
mov dword [ebp - 7], 0x68436564
mov word [ebp - 9], 0x6957
mov dword [ebp - 0xe], 0x54657479
mov dword [ebp - 0x14], 0x746c754d
mov word [ebp - 0x10], 0x4269
mov byte [ebp - 0xa], 0x6f
mov word [ebp - 2], 0x72
mov byte [ebp - 3], 0x61
call fcn.00406a77
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406b9d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push dword [ebp + 8]
push 8
push 0xfde9
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x406ba2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
call fcn.00406aa7
test eax, eax
je 0x406bf4
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 0x11], 0x6f467465
mov dword [ebp - 7], 0x416874
mov dword [ebp - 0xb], 0x61507265
mov word [ebp - 0xd], 0x646c
mov word [ebp - 0x14], 0x4853
mov byte [ebp - 0x12], 0x47
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406bf4
push dword [ebp + 0x10]
push ebx
push ebx
push 0x23
push ebx
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x406e6d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 8], 0x6d614e65
mov dword [ebp - 0xc], 0x6c694665
mov word [ebp - 0x11], 0x6f4d
mov word [ebp - 0x14], 0x6547
mov word [ebp - 0xf], 0x7564
mov word [ebp - 4], 0x4165
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 2], bl
mov byte [ebp - 0xd], 0x6c
call fcn.00406a77
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406eca
push 0x104
push 0x40e580
push ebx
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x406ecf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 0x14]
push eax
xor ebx, ebx
mov dword [ebp - 0x14], 0x65646957
mov dword [ebp - 8], 0x4269746c
mov word [ebp - 0xf], 0x6168
mov dword [ebp - 0xc], 0x754d6f54
mov dword [ebp - 4], 0x657479
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0x10], 0x43
call fcn.00406a77
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406f2a
push ebx
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push 1
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret
Function at 0x406f8f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
lea eax, [ebp - 0x20]
push eax
or esi, 0xffffffff
mov dword [ebp - 0x20], 0x47535457
mov dword [ebp - 0xb], 0x6f697373
mov dword [ebp - 0x16], 0x6f436576
mov word [ebp - 0x1c], 0x7465
mov word [ebp - 0x19], 0x7463
mov word [ebp - 0x10], 0x6c6f
mov word [ebp - 0xd], 0x6553
mov word [ebp - 0x12], 0x736e
mov dword [ebp - 7], 0x64496e
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x1a], 0x41
call fcn.00406a77
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406ff7
call eax
mov esi, eax
mov eax, esi
pop esi
leave
ret

Function at 0x406ffc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
mov esi, edx
mov edi, ecx
mov word [ebp - 0xb], 0x706f
mov word [ebp - 8], 0x6946
mov word [ebp - 5], 0x4165
mov byte [ebp - 9], 0x79
mov byte [ebp - 6], 0x6c
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 3], bl
call fcn.00406a77
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x407047
push ebx
push esi
push edi
call eax
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x407196
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 7], 0x6c6c642e
mov word [ebp - 0xc], 0x696c
mov byte [ebp - 3], 0
mov word [ebp - 9], 0x7661
mov byte [ebp - 0xa], 0x62
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret

Function at 0x407243
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 6
mov edi, str.devel_clamav_0.97_408_ge11f7cc
lea eax, [ebp - 8]
push edi
push eax
mov word [ebp - 6], 0x6576
mov word [ebp - 3], 0x2d
mov byte [ebp - 4], 0x6c
mov word [ebp - 8], 0x6564
mov dword [ebp - 0x13], 0x726f7078
mov dword [ebp - 0xf], 0x646574
mov byte [ebp - 0x14], 0x65
call dword [sym.imp.MSVCR110.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x4072a6
push 0x14
mov esi, str.devel_clamav_0.98.6
lea eax, [ebp - 0x14]
push esi
push eax
call sub.MSVCR110.dll_memcmp
add esp, 0xc
test eax, eax
mov eax, esi
jne 0x4072a8
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x4072ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call dword [sym.imp.libav.dll_Ordinal_19]
mov ecx, dword [sym.imp.libav.dll_Ordinal_1003]
xor ebx, ebx
push ebx
push ebx
push 2
push ebx
push ebx
push ebx
push dword [ecx]
mov edi, eax
call dword [sym.imp.libav.dll_Ordinal_44284]
add esp, 0x1c
mov dword [ebp - 0xc], eax
test eax, eax
je 0x407466
lea edx, [ebp - 0x20]
mov ecx, eax
mov word [ebp - 0x1f], 0x7461
mov dword [ebp - 0x12], 0x79726f
mov word [ebp - 0x17], 0x7269
mov word [ebp - 0x14], 0x7463
mov word [ebp - 0x19], 0x4465
mov byte [ebp - 0x15], 0x65
mov word [ebp - 0x1c], 0x6162
mov byte [ebp - 0x20], 0x44
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x1d], 0x61
call fcn.004071e5
mov dword [ebp - 4], eax
cmp dword [eax + 0x18], ebx
je 0x407466
mov esi, dword [eax + 8]
mov dword [ebp - 8], esi
mov edx, esi
mov ecx, edi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x407355
test al, al
je 0x40735a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x407355
add ecx, 2
add edx, 2
test al, al
jne 0x407337
jmp 0x40735a
sbb ebx, ebx
or ebx, 1
test ebx, ebx
je 0x407466
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407367
sub ecx, edx
mov edx, edi
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x407375
sub edx, esi
lea eax, [ecx + 0x1e]
add eax, edx
push eax
call dword [sym.imp.MSVCR110.dll_malloc]
push dword [ebp - 8]
mov ebx, dword [sym.imp.MSVCR110.dll_sprintf]
mov esi, eax
push str._sdaily.cvd
push esi
call ebx
push 4
push esi
call dword [sym.imp.libav.dll_Ordinal_44340]
add esp, 0x18
test eax, eax
je 0x4073be
mov eax, dword [ebp - 4]
push dword [eax + 8]
push str._sdaily.cld
push esi
call ebx
add esp, 0xc
push 4
push esi
call dword [sym.imp.libav.dll_Ordinal_44340]
pop ecx
pop ecx
test eax, eax
jne 0x40745e
push esi
call dword [sym.imp.libav.dll_Ordinal_3]
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x40745e
push edi
push str._sdaily.cvd
push esi
call ebx
push 4
push esi
call dword [sym.imp.libav.dll_Ordinal_44340]
add esp, 0x14
test eax, eax
je 0x407405
push edi
push str._sdaily.cld
push esi
call ebx
add esp, 0xc
push 4
push esi
call dword [sym.imp.libav.dll_Ordinal_44340]
pop ecx
pop ecx
test eax, eax
jne 0x407444
push esi
call dword [sym.imp.libav.dll_Ordinal_3]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x407444
push esi
call dword [sym.imp.MSVCR110.dll_free]
mov esi, dword [ebp - 8]
pop ecx
mov ecx, dword [esi + 4]
cmp ecx, dword [ebx + 4]
jbe 0x40743b
mov eax, dword [ebp - 4]
mov edi, dword [eax + 8]
push ebx
call dword [sym.imp.libav.dll_Ordinal_2]
jmp 0x407454
push esi
call dword [sym.imp.MSVCR110.dll_free]
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [eax + 8]
pop ecx
push esi
call dword [sym.imp.libav.dll_Ordinal_2]
jmp 0x407465
push esi
call dword [sym.imp.MSVCR110.dll_free]
pop ecx
push edi
call dword [sym.imp.MSVCR110.dll__strdup]
pop ecx
mov ecx, dword [ebp - 0xc]
mov esi, eax
test ecx, ecx
je 0x40747c
call fcn.004071c3
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40356a
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x403587
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x403596
mov ebx, 0x41949c
mov eax, dword [ebp + 8]
test eax, eax
jl 0x4035ab
mov ecx, dword [0x44bb58]
add ecx, eax
push ecx
call fcn.00403798
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.00403766
test eax, eax
je 0x403754
test byte [ebp + 0x17], 0x80
je 0x4036fa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x4153d0
mov dword [ebp - 0xc], eax
call fcn.00406899
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x40375c
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x4035fb
mov esi, dword [ebp + 0x14]
mov edi, 0x41549c
push esi
push edi
call fcn.00403766
test eax, eax
je 0x403754
sub dword [ebp + 0x14], esi
mov dword [0x4153e8], edi
mov dword [0x4153ec], esi
mov eax, dword [ebp - 8]
mov ecx, 0x4153d0
mov dword [0x4153f0], ebx
mov dword [0x4153f4], eax
call fcn.004068bb
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x4036f2
mov esi, dword [0x4153f0]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x40a848], 1
mov edi, eax
je 0x40369d
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x40366a
cmp dword [ebp + 0x14], 0
jne 0x40369d
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x54]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.004055b7
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x4036e7
cmp dword [ebp + 0x10], eax
jne 0x4036c6
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4036f6
cmp dword [ebp - 0x10], esi
jne 0x4036f6
add dword [ebp - 4], esi
jmp 0x4036dc
sub dword [ebp - 8], esi
add dword [ebp - 4], esi
cmp dword [ebp - 8], 1
mov ebx, dword [0x4153f0]
jl 0x40375c
cmp dword [ebp - 0x14], 1
je 0x40375c
jmp 0x40361e
cmp dword [ebp + 0x14], eax
jg 0x4035ee
jmp 0x40375c
push 0xfffffffffffffffc
jmp 0x403756
push 0xfffffffffffffffe
jmp 0x403756
test edi, edi
jne 0x403741
cmp dword [ebp + 0x14], 0
jle 0x40375c
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x40370f
mov esi, dword [ebp + 0x14]
mov edi, 0x41549c
push esi
push edi
call fcn.00403766
test eax, eax
je 0x403754
lea eax, [ebp + 0x10]
push 0
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4036f6
cmp esi, dword [ebp + 0x10]
jne 0x4036f6
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
jmp 0x4036fe
cmp dword [ebp + 0x14], esi
jge 0x403749
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00403766
test eax, eax
jne 0x403759
push 0xfffffffffffffffd
pop eax
jmp 0x40375f
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x403e70
Capabilities:
Identify system language via api

Disassembly:
cmp byte [0x47c000], 0
push ebx
push ebp
push esi
push edi
mov ebx, 0xffff
mov edi, 0x47c000
je 0x403e8f
push edi
call fcn.00406250
jmp 0x403e95
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esi, dword [0x44bb44]
mov ecx, esi
dec esi
test ecx, ecx
je 0x403ee9
mov ecx, dword [0x44bb08]
mov ecx, dword [ecx + 0x64]
mov edx, ecx
imul ecx, esi
neg edx
add ecx, dword [0x44bb40]
mov bp, word [ecx]
xor bp, ax
and ebp, ebx
test bp, bp
je 0x403ed0
mov ebp, esi
dec esi
add ecx, edx
test ebp, ebp
jne 0x403eb8
jmp 0x403ee9
mov edx, dword [ecx + 2]
mov dword [0x447ae0], edx
mov edx, dword [ecx + 6]
mov dword [0x44bba8], edx
lea edx, [ecx + 0xa]
test edx, edx
jne 0x403efb
cmp bx, 0xffff
jne 0x403ef7
mov ebx, 0x3ff
jmp 0x403e95
xor ebx, ebx
jmp 0x403e95
mov dword [0x447adc], edx
movzx eax, word [ecx]
push eax
push edi
call fcn.00406237
push 0xfffffffffffffffe
push 0x447b00
call fcn.00406309
push eax
push dword [0x4354b4]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x44bb2c]
mov esi, dword [0x44bb28]
mov ecx, eax
dec eax
test ecx, ecx
je 0x403f55
lea ebx, [esi + 0x18]
lea ebp, [eax + 1]
mov edi, 0x2018
mov eax, dword [esi]
test eax, eax
je 0x403f4e
push eax
push ebx
call fcn.00406309
add esi, edi
add ebx, edi
dec ebp
jne 0x403f41
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405b0a
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x43acd8], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x405b2e
test al, 0x10
jne 0x405b31
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x43acd8
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405b5c
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x405bdc
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00405ec1
test byte [ebp + 0xc], 8
mov dword [ebp - 4], eax
je 0x405c10
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x44bb88], eax
jmp 0x405dd9
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp + 8], ebx
je 0x405c2e
test eax, eax
je 0x405d5d
test byte [ebp + 0xc], 2
je 0x405d5d
mov esi, 0x4364d8
push edi
push esi
call fcn.004062da
test ebx, ebx
je 0x405c4b
push str..
push esi
call fcn.004062f8
jmp 0x405c51
push edi
call fcn.00405e26
push 0x40a268
push edi
call fcn.004062f8
push edi
call fcn.004062eb
mov ebx, eax
lea eax, [ebp - 0x144]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405d53
cmp byte [ebp - 0x118], 0x2e
jne 0x405ca2
cmp byte [ebp - 0x117], 0x2e
je 0x405d36
cmp byte [ebp - 0x117], 0
je 0x405d36
lea eax, [ebp - 0x118]
push eax
push ebx
call fcn.004062da
test byte [ebp - 0x144], 0x10
je 0x405ccd
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405d36
push dword [ebp + 0xc]
push edi
call fcn.00405bdc
jmp 0x405d36
push edi
push str.Delete:_DeleteFile___s__
call fcn.00406762
mov eax, dword [ebp - 0x144]
pop ecx
pop ecx
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405d2e
test byte [ebp + 0xc], 4
push edi
je 0x405d1a
push str.Delete:_DeleteFile_on_Reboot___s__
call fcn.00406762
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.004055b7
push 0
push edi
call fcn.00406023
jmp 0x405d36
push str.Delete:_DeleteFile_failed___s__
call fcn.00406762
inc dword [0x44bb88]
pop ecx
pop ecx
jmp 0x405d36
push edi
push 0xfffffffffffffff2
call fcn.004055b7
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405c7f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405d5d
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp + 8], esi
je 0x405dd9
cmp dword [ebp - 4], esi
push edi
jne 0x405d7f
push str.RMDir:_RemoveDirectory_invalid_input___s__
call fcn.00406762
inc dword [0x44bb88]
pop ecx
pop ecx
jmp 0x405dd9
call fcn.0040677e
test eax, eax
je 0x405dd9
push edi
call fcn.00405ddf
push edi
push str.RMDir:_RemoveDirectory___s__
call fcn.00406762
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405dd1
test byte [ebp + 0xc], 4
push edi
je 0x405dca
push str.RMDir:_RemoveDirectory_on_Reboot___s__
call fcn.00406762
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.004055b7
push esi
push edi
call fcn.00406023
jmp 0x405dd9
push str.RMDir:_RemoveDirectory_failed___s__
jmp 0x405d70
push edi
push 0xffffffffffffffe5
call fcn.004055b7
pop edi
pop esi
leave
ret 8
Function at 0x405ec1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x4384d8
push esi
call fcn.004062da
push esi
call fcn.00405e72
mov edi, eax
test edi, edi
jne 0x405ee2
xor eax, eax
jmp 0x405f34
push edi
call fcn.0040654a
test byte [0x44bb10], 0x80
je 0x405efb
mov al, byte [edi]
test al, al
je 0x405ede
cmp al, 0x5c
je 0x405ede
sub edi, esi
push esi
call fcn.004062eb
cmp eax, edi
push esi
jle 0x405f1e
call fcn.0040677e
test eax, eax
je 0x405f16
test byte [eax], 0x10
je 0x405ede
push esi
call fcn.00405e26
jmp 0x405efd
call fcn.00405ddf
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405fab
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405fda
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x63
pop edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40601f
mov eax, edi
dec edi
test eax, eax
jne 0x405fe5
and byte [esi], al
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x406019
Function at 0x406023
Capabilities:
Get common file path
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call fcn.004067bc
test eax, eax
mov esi, dword [esp + 0x18]
je 0x40604f
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x406193
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x43ae60], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x43ae60
je 0x406093
push 1
push 0
push esi
call fcn.00405fab
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x406199
cmp eax, edi
jg 0x406199
mov esi, 0x43a8d8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x406199
cmp eax, edi
jg 0x406199
push esi
push ebp
push str._s_s_r_n
push 0x43a4d8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebp, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call fcn.004062f8
xor edi, edi
push edi
push 0x8000080
push 4
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406193
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
lea eax, [esi + ebp + 0xa]
push eax
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x40617b
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x40616f
push str._Rename__r_n
push edi
call fcn.00405f39
test eax, eax
jne 0x4061a0
lea eax, [edi + esi]
push str._Rename__r_n
push eax
call fcn.004062da
add esi, 0xa
mov eax, esi
push ebp
add eax, edi
push 0x43a4d8
push eax
call fcn.00405f85
push edi
add esi, ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x44bb90]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x40a9fc
push eax
call fcn.00405f39
test eax, eax
je 0x406156
inc eax
lea edx, [edi + esi]
cmp eax, edx
mov ecx, eax
jae 0x4061c9
mov dl, byte [ecx]
mov byte [ecx + ebp], dl
inc ecx
lea edx, [edi + esi]
cmp ecx, edx
jb 0x4061bc
sub eax, edi
jmp 0x406158
Function at 0x4061cd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406231
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x2000
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406220
cmp dword [ebp + 0x14], 1
je 0x406222
cmp dword [ebp + 0x14], 2
je 0x406222
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10