joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4abd10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00494340
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x4abddb
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x4abddb
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x4abd8e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x4abd99
or bh, 8
and edi, 0x8000000
je 0x4abdb4
mov eax, dword [0x508cbc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x4abddb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ac1b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4ac1db
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4ac1ff
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x4ac21a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x4b104f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b1087
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b44ff
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b44d6
jmp 0x4b1093
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x4b2990
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b29d2
call fcn.004c30cb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x4b29d2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b29c9
xor eax, eax
jmp 0x4b29da
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b29e0
pop edi
pop esi
pop ebx
ret 4
Function at 0x40f862
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call dword [0x425090]
mov ecx, dword [ebp + 8]
mov esi, eax
xor ebx, ebx
add esi, esi
or edx, 0xffffffff
cmp dword [0x42ed08], ebx
jne 0x40f8c2
mov dword [0x42ed08], 1
mov ecx, ebx
push 8
mov eax, ecx
pop edi
test al, 1
je 0x40f8a8
shr eax, 1
xor eax, 0xedb88320
jmp 0x40f8aa
shr eax, 1
dec edi
test edi, edi
jg 0x40f89b
mov dword [ecx*4 + 0x42e908], eax
inc ecx
cmp ecx, 0xff
jle 0x40f896
mov ecx, dword [ebp + 8]
test esi, esi
je 0x40f8de
movzx eax, byte [ecx]
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x42e908]
inc ecx
sub esi, 1
jne 0x40f8c6
mov ecx, dword [ebp - 4]
not edx
mov eax, edx
mov dword [ebp - 8], ebx
xor edx, edx
div dword [ecx + 0xc]
mov esi, edx
cmp dword [ecx + 0xc], ebx
jbe 0x40f920
imul edi, esi, 0xc
add edi, dword [ecx + 8]
cmp dword [ebp + 0xc], ebx
je 0x40f92e
cmp dword [edi + 4], ebx
je 0x40f91c
push dword [ebp + 8]
push dword [edi + 4]
call dword [0x42508c]
test eax, eax
je 0x40f95d
mov ecx, dword [ebp - 4]
cmp dword [edi + 4], ebx
jne 0x40f946
cmp dword [edi], ebx
jne 0x40f946
xor ebx, ebx
inc ebx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [edi + 4], ebx
je 0x40f95d
push dword [ebp + 8]
push dword [edi + 4]
call dword [0x42508c]
test eax, eax
je 0x40f95d
mov ecx, dword [ebp - 4]
inc esi
cmp esi, dword [ecx + 0xc]
jb 0x40f94f
sub esi, dword [ecx + 0xc]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ecx + 0xc]
jb 0x40f8f4
jmp 0x40f920
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
jmp 0x40f923

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6a
sub eax, 0x403d10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x10017648
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10017657
pop dword [ebp - 0x38]
mov eax, 0x4cfb6f12
sub eax, 0x3cf9f8bb
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xf56f02ea
sub dword [ebp - 0x48], 0xa71cbd9f
mov dword [ebp - 0x44], 0x588c231d
sub dword [ebp - 0x44], 0x2658d6d8
mov dword [ebp - 0x40], 0x486c268d
add dword [ebp - 0x40], 0x3e01da1
mov dword [ebp - 0x3c], 0x64dcdcc3
sub dword [ebp - 0x3c], 0x64dcdcc3
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xc7f78472
sub dword [ebp - 0x48], 0x53851b1c
mov dword [ebp - 0x44], 0x559c6230
add dword [ebp - 0x44], 0xebcfff45
mov dword [ebp - 0x40], 0xcd860352
sub dword [ebp - 0x40], 0x6a1696e6
mov dword [ebp - 0x3c], 0x2dc21b30
sub dword [ebp - 0x3c], 0x2dc21b30
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x3995aff1
sub eax, 0x2993cf6d
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3df0a
push 0
call eax
mov ecx, 0xb3fc5d36
sub ecx, 0xb3fc16f5
mov ebx, eax
mov esi, 0x10035800
add esi, dword [ebp - 0x38]
mov edi, 0x18de310a
sub dword [ebp - 0x20], edx
mov edx, dword [esi]
xor dword [ebp - 0x14], ecx
xor edx, edi
xor dword [ebp - 0x10], 0x4f469f62
mov dword [ebx], edx
add dword [ebp - 8], 0x99bcc4e0
add ebx, 0x50dffc41
add ebx, 0xaf2003c3
add esi, 0xe7dfce6b
sub esi, 0xe7dfce67
loop 0x10017768
add eax, 0xc49b421e
add eax, 0x3b65c9b9
xor ebx, ebx
add ebx, eax
add eax, 0x7fe7ed7d
sub eax, 0x7fe7ed78
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x4012b6
Capabilities:
Hide graphical window

Disassembly:
push ebp
push 0x10000
push 0x1000
push 1
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x403eb4], eax
push 0x64
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 0x30
push eax
mov dword [eax], ecx
add eax, 0x4c
mov ebp, eax
mov eax, 0x400000
mov dword [0x403eb0], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x401191
mov dword [ebp - 0x24], str.resiliency
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor eax, eax
push eax
push dword [0x403eb0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.abasement
push str.resiliency
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403eb8], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401380
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401367
mov eax, dword [0x403eb4]
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
pop ebp
ret 0x10
Function at 0x40379d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
mov eax, dword [esp + 0x28]
mov dword [0x44205c], eax
mov edx, dword [esp + 0x20]
lea ecx, [esp]
call fcn.00404000
mov edx, dword [esp + 0x24]
lea ecx, [esp + 4]
call fcn.00404000
mov dword [esp + 8], 0
push dword [0x44205c]
push dword [0x44205c]
push 0xff
call fcn.004274e0
lea eax, [esp + 0x10]
push eax
call fcn.00429ce0
mov dword [esp + 0x10], 0xff
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push dword [esp + 0xc]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegOpenKeyExW
and eax, eax
je 0x403827
mov edx, str.Error_Opening_Key
lea ecx, [esp + 0xc]
call fcn.00404008
jmp 0x40388a
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x1c]
call sub.ADVAPI32.dll_RegQueryValueExW
and eax, eax
je 0x40385c
mov edx, str.Error_Reading_Key
lea ecx, [esp + 0xc]
call fcn.00404008
jmp 0x403881
push dword [0x44205c]
push dword [0x44205c]
mov ebx, dword [esp + 0x18]
dec ebx
push ebx
push dword [esp + 0x18]
call fcn.00426ea0
lea eax, [esp + 0x10]
push eax
call fcn.00429ce0
push dword [esp + 8]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0xc]
push dword [0x44205c]
push edx
call fcn.00429d60
pop eax
add eax, dword [0x4407c4]
jmp 0x4038b3
push dword [esp + 0xc]
call fcn.00429dc0
push dword [esp]
call fcn.00429dc0
push dword [esp + 4]
call fcn.00429dc0
add esp, 0x14
pop ebx
ret 0xc
Function at 0x4208b3
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x4420b0]
call fcn.00429548
mov ebx, eax
test ebx, ebx
je 0x420917
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x4208dc
push dword [esp + 0xc]
push ebx
call eax
jmp 0x420917
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.0042a160
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.0042a250
pop edi
pop esi
pop ebx
ret 8

Function at 0x4228f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, eax
test ebx, ebx
je 0x422987
push 9
call esi
test al, al
jns 0x422987
push 0x11
call esi
test al, al
js 0x422987
push 0x10
call esi
test al, al
js 0x422987
push 0x12
call esi
test al, al
js 0x422987
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
push 5
lea eax, [ebp - 0x24]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x422969
push 4
lea eax, [ebp - 0x24]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x422987
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
jne 0x422987
xor eax, eax
jmp 0x422a08
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4229af
push 0x11
call esi
test al, al
js 0x4229a7
push 0x10
call esi
test al, al
js 0x4229a7
push 0x12
call esi
test al, al
jns 0x4229af
push 1
push edi
call fcn.00422a10
mov esi, dword [sym.imp.USER32.dll_GetPropW]
test ebx, ebx
je 0x4229c5
push str.PB_Hotkey
push ebx
call esi
test eax, eax
jne 0x422a05
push str.PB_WindowID
push edi
call esi
mov esi, eax
test esi, esi
je 0x422a05
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x422a05
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x422a05
lea eax, [esi - 1]
push eax
push dword [0x4420bc]
call fcn.00429548
test eax, eax
je 0x422a05
mov eax, dword [eax + 8]
jmp 0x422a07
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x423629
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x441f54], eax
test eax, eax
je 0x423657
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x441f50], eax
lea eax, [ebp - 0x114]
mov dword [0x441f58], 1
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4236b9
cmp dword [ebp - 0x104], 1
jne 0x42368e
and dword [0x441f58], 0
jmp 0x4236d1
cmp dword [ebp - 0x104], 2
jne 0x4236b9
cmp dword [ebp - 0x110], 5
jb 0x423685
jne 0x4236b9
mov eax, dword [ebp - 0x10c]
neg eax
sbb eax, eax
and eax, dword [0x441f58]
mov dword [0x441f58], eax
jmp 0x4236be
mov eax, dword [0x441f58]
test eax, eax
je 0x4236d1
call fcn.0042332c
neg eax
sbb eax, eax
and dword [0x441f58], eax
mov esp, ebp
pop ebp
ret

Function at 0x424c30
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x424c62
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x424c5d
cmp dword [esp + 0xc], esi
je 0x424c79
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x42784c
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0x441ff0]
push esi
test eax, eax
jne 0x427871
push fcn.00427979
push 0x10
push 0x258
call fcn.004295f1
mov dword [0x441ff0], eax
push dword [esp + 0xc]
push eax
call fcn.00429570
mov esi, eax
test esi, esi
je 0x427972
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x427893
mov edi, section..rdata
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x4278a3
xor eax, eax
cmp word [ebx], ax
jne 0x4278a8
mov ebx, 0x43f5fc
push edi
call sub.MSVCRT.dll_wcslen
push ebx
mov dword [esp + 0x24], eax
call sub.MSVCRT.dll_wcslen
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x441bc0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x427959
push edi
push eax
call sub.MSVCRT.dll_wcscpy
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x427909
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x42790d
push 0x43f604
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
jmp 0x42790d
mov edi, dword [esp + 0x18]
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x427931
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x427947
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x427945
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0x441bc0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x427970
cmp dword [esp + 0x14], 0xffffffff
je 0x427964
mov esi, dword [esp + 0x14]
push esi
push dword [0x441ff0]
call fcn.0042950e
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc

Function at 0x4279ef
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x427a67
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x427a48
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x427a45
cmp ecx, 0x5c
je 0x427a45
cmp ecx, 0x2f
jne 0x427a52
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x427a32
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x427a69
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x427b2c
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x427c74
xor ecx, ecx
cmp word [eax], cx
je 0x427c74
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x427b85
cmp eax, 3
jne 0x427bbf
cmp word [esp + 0xa], 0x3a
jne 0x427bbf
cmp eax, 2
jne 0x427ba3
lea eax, [esp + 8]
push 0x43f604
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x427c74
push 0xfffffffffffffffe
pop edi
jmp 0x427c74
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x427bd4
cmp ax, bx
jne 0x427bde
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x427bc7
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x427c1d
test byte [esp + 0x21c], 0x10
je 0x427c04
push 0xfffffffffffffffe
pop edi
jmp 0x427c14
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x427c72
cmp word [esp + 0x10], bp
jne 0x427c2b
cmp word [esp + 0x12], bp
je 0x427c4a
cmp word [esp + 0x10], bx
jne 0x427c39
cmp word [esp + 0x12], bx
je 0x427c4a
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x427c72
cmp word [esp + 0x12], ax
jne 0x427c72
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x427c5f
test al, 0x10
je 0x427c72
jmp 0x427c6f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x427c72
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x427c83
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x427cac
test byte [esp + 8], 2
je 0x427ca0
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x427cae
xor eax, eax
ret 8

Function at 0x427d40
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x427d7c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4