joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ab80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x411010]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x224], 0x80004005
mov dword [ebp - 0x21c], 0x104
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 8], 0
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40ac21
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x224], eax
mov edx, dword [ebp - 0x224]
push edx
call section..text
add esp, 4
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jge 0x40ac21
mov eax, dword [ebp - 0x224]
push eax
push 0x2cc
push 0x40f58c
call fcn.0040a8b0
jmp 0x40ad23
mov dword [ebp - 8], 0
jmp 0x40ac33
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x3e8
jge 0x40acfd
cmp dword [ebp - 0x220], 0xffffffff
jne 0x40acfd
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x218]
push edx
push str._s_s_05d._s
lea eax, [ebp - 4]
push eax
call fcn.0040b4f0
add esp, 0x18
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jge 0x40ac8a
jmp 0x40ad23
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0xffffffff
jne 0x40acf8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call section..text
add esp, 4
mov dword [ebp - 0x224], eax
push 0x50
call section..text
add esp, 4
cmp eax, dword [ebp - 0x224]
jne 0x40aceb
mov dword [ebp - 0x224], 0
jmp 0x40ac2a
cmp dword [ebp - 0x224], 0
jge 0x40acf8
jmp 0x40ad23
jmp 0x40ac2a
cmp dword [ebp + 0x14], 0
je 0x40ad0e
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x220]
mov dword [edx], eax
cmp dword [ebp + 0x10], 0
je 0x40ad23
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov dword [ebp - 4], 0
cmp dword [ebp - 0x224], 0
jl 0x40ad32
cmp dword [ebp + 0x14], 0
jne 0x40ad52
cmp dword [ebp - 0x220], 0xffffffff
je 0x40ad52
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x220], 0xffffffff
cmp dword [ebp - 4], 0
je 0x40ad61
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040b3b0
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00401518
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40ad80
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
je 0x40ada3
mov eax, dword [ebp - 8]
or eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp + 0x14], 0
je 0x40adb2
mov ecx, dword [ebp - 8]
or ecx, 2
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x40add2
jmp 0x40aee3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
jne 0x40ae06
cmp dword [ebp - 4], 0x50
je 0x40adf0
cmp dword [ebp - 4], 0xb7
jne 0x40ae06
mov dword [ebp - 0xc], 1
jmp 0x40aee3
cmp dword [ebp - 4], 3
jne 0x40aed4
mov dword [ebp - 0x10], 0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
jmp 0x40ae28
mov eax, dword [ebp - 0x14]
add eax, 2
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx]
test edx, edx
je 0x40ae45
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax]
cmp ecx, 0x5c
jne 0x40ae43
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x40ae1f
cmp dword [ebp - 0x10], 0
je 0x40aec3
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov word [ecx], ax
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040dc30
mov dword [ebp - 0xc], eax
mov eax, 0x5c
mov ecx, dword [ebp - 0x10]
mov word [ecx], ax
cmp dword [ebp - 0xc], 0
jge 0x40ae76
jmp 0x40aee3
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40aec1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call section..text
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x40aec1
mov eax, dword [ebp - 0xc]
push eax
push 0x26d
push 0x40f570
call fcn.0040a8b0
jmp 0x40aee3
jmp 0x40aed2
mov ecx, dword [ebp - 4]
push ecx
call section..text
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x40aee3
mov edx, dword [ebp - 4]
push edx
call section..text
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b850
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0xa
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40b8cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
call section..text
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x40b8b2
mov dword [ebp - 8], 0x80004005
mov eax, dword [ebp - 8]
push eax
push 0xb3
push 0x40f9b8
call fcn.0040a8b0
jmp 0x40b9d6
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40b928
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call section..text
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x40b90b
mov dword [ebp - 8], 0x80004005
mov ecx, dword [ebp - 8]
push ecx
push 0xb6
push 0x40f9c8
call fcn.0040a8b0
jmp 0x40b9d6
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40b97b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call section..text
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x40b964
mov dword [ebp - 8], 0x80004005
mov edx, dword [ebp - 8]
push edx
push 0xbb
push 0x40f9d8
call fcn.0040a8b0
jmp 0x40b9d6
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jne 0x40b9ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call section..text
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x40b9b7
mov dword [ebp - 8], 0x80004005
mov ecx, dword [ebp - 8]
push ecx
push 0xbf
push 0x40f9e8
call fcn.0040a8b0
jmp 0x40b9d6
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40baa0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 8], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
call fcn.0040b850
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x40baf6
jmp 0x40bbb4
push 0
push 0x80
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40bb59
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
call section..text
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x40bb42
mov dword [ebp - 0x14], 0x80004005
mov eax, dword [ebp - 0x14]
push eax
push 0xde
push 0x40f9f8
call fcn.0040a8b0
jmp 0x40bbb4
mov dword [ebp - 8], 1
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40bbb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
call section..text
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x40bba1
mov dword [ebp - 0x14], 0x80004005
mov eax, dword [ebp - 0x14]
push eax
push 0xe4
push str.._resrutil.cpp
call fcn.0040a8b0
cmp dword [ebp - 0xc], 0xffffffff
je 0x40bbc4
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0
jge 0x40bbda
cmp dword [ebp - 8], 0
je 0x40bbda
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40bbf0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x40bc14
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [ebp - 8], ax
movzx eax, word [ebp - 8]
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 0
je 0x40bc2d
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, dword [ebp + 0xc]
sete dl
mov dword [ebp - 4], edx
jmp 0x40bcc5
movzx eax, word [ebp + 8]
and eax, 0x3ff
cmp eax, 4
jne 0x40bca7
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0xc04
ja 0x40bc67
cmp dword [ebp - 0xc], 0xc04
je 0x40bc8c
cmp dword [ebp - 0xc], 0x404
je 0x40bc88
cmp dword [ebp - 0xc], 0x804
je 0x40bc7b
jmp 0x40bc97
cmp dword [ebp - 0xc], 0x1004
je 0x40bc7f
cmp dword [ebp - 0xc], 0x1404
je 0x40bc90
jmp 0x40bc97
xor edx, edx
jne 0x40bc7b
mov dword [ebp + 8], 0x804
jmp 0x40bc97
xor eax, eax
jne 0x40bc88
xor ecx, ecx
jne 0x40bc8c
mov dword [ebp + 8], 0x404
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, dword [ebp + 0xc]
sete al
mov dword [ebp - 4], eax
jmp 0x40bcc5
movzx ecx, word [ebp + 8]
and ecx, 0x3ff
movzx edx, word [ebp + 0xc]
and edx, 0x3ff
xor eax, eax
cmp ecx, edx
sete al
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40c240
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x411010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2b4], 0
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 7
add eax, 0x1c
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x260]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x54]
or edx, 0x8000
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40c2a3
jmp 0x40c3bc
push 0x27
lea eax, [ebp - 0x2b0]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x8c
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40c2d5
jmp 0x40c3bc
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xa0]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xa0]
shr edx, 0x10
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x9c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x9c]
shr eax, 0x10
push eax
push str._d._d._d._d
push 0x24
lea ecx, [ebp - 0x50]
push ecx
call fcn.00401090
add esp, 0x1c
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40c33a
jmp 0x40c3bc
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x260]
push ecx
push str._lsApplicationsCache_lsv_ls.mst
mov edx, dword [ebp + 0x14]
push edx
call fcn.0040b4f0
add esp, 0x14
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40c370
jmp 0x40c3bc
push 1
push 1
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040ad80
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40c3bc
cmp dword [ebp + 0x10], 1
jne 0x40c3bc
mov eax, dword [ebp + 0x14]
push eax
xor ecx, ecx
cmp dword [ebp + 0x10], 0
sete cl
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040c240
add esp, 0x10
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401518
mov esp, ebp
pop ebp
ret
Function at 0x40c3d0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x411010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2b4], 0
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 7
add eax, 0x1c
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x260]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x54]
or edx, 0x8000
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40c433
jmp 0x40c54c
push 0x27
lea eax, [ebp - 0x2b0]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x8c
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40c465
jmp 0x40c54c
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xa0]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xa0]
shr edx, 0x10
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x9c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x9c]
shr eax, 0x10
push eax
push 0x40fbdc
push 0x24
lea ecx, [ebp - 0x50]
push ecx
call fcn.00401090
add esp, 0x1c
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40c4ca
jmp 0x40c54c
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x260]
push ecx
push str._lsApplicationsCache_lsv_ls.msi
mov edx, dword [ebp + 0x14]
push edx
call fcn.0040b4f0
add esp, 0x14
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40c500
jmp 0x40c54c
push 1
push 1
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040ad80
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40c54c
cmp dword [ebp + 0x10], 1
jne 0x40c54c
mov eax, dword [ebp + 0x14]
push eax
xor ecx, ecx
cmp dword [ebp + 0x10], 0
sete cl
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040c3d0
add esp, 0x10
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401518
mov esp, ebp
pop ebp
ret
Function at 0x40c770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x411010]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 4], 0x104
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040afb0
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jge 0x40c7b5
jmp 0x40c8ea
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40c7d6
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 4]
jb 0x40c818
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
push eax
call section..text
add esp, 4
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x40c7fb
mov dword [ebp - 0x64], 0x80004005
mov ecx, dword [ebp - 0x64]
push ecx
push 0x1db
push 0x40fcb8
call fcn.0040a8b0
jmp 0x40c8ea
push 0
push 0x40fcc8
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040b730
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jge 0x40c83b
jmp 0x40c8ea
push 0x27
lea eax, [ebp - 0x60]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x8c
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jge 0x40c864
jmp 0x40c8ea
push 0
lea edx, [ebp - 0x60]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040b730
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jge 0x40c880
jmp 0x40c8ea
push 0
push 0x40fccc
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040b730
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jge 0x40c89d
jmp 0x40c8ea
push 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.0040dc30
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jge 0x40c8b7
jmp 0x40c8ea
push 0
mov ecx, dword [ebp + 8]
add ecx, 0xc
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040b730
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jge 0x40c8d6
jmp 0x40c8ea
push 2
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040baa0
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00401518
mov esp, ebp
pop ebp
ret
Function at 0x40dc30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40dd44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb7
jne 0x40dc76
mov dword [ebp - 8], 0
jmp 0x40dd44
mov dword [ebp - 0xc], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
jmp 0x40dc8e
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
movzx edx, word [ecx]
test edx, edx
je 0x40dcab
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5c
jne 0x40dca9
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
jmp 0x40dc85
cmp dword [ebp - 0xc], 0
jne 0x40dcd2
push 3
call section..text
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push 0x7e
push 0x40fa3c
call fcn.0040a8b0
jmp 0x40dd44
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov word [edx], cx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040dc30
mov dword [ebp - 8], eax
mov edx, 0x5c
mov eax, dword [ebp - 0xc]
mov word [eax], dx
cmp dword [ebp - 8], 0
jge 0x40dcff
jmp 0x40dd44
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40dd3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb7
jne 0x40dd2c
mov dword [ebp - 8], 1
jmp 0x40dd3b
mov eax, dword [ebp - 4]
push eax
call section..text
add esp, 4
mov dword [ebp - 8], eax
jmp 0x40dd44
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x40dd50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x411010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x41c], 0
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x40dda4
cmp dword [ebp - 0x41c], 0x104
jb 0x40ddf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x420], eax
mov ecx, dword [ebp - 0x420]
push ecx
call section..text
add esp, 4
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jl 0x40ddd8
mov dword [ebp - 0x420], 0x80004005
mov edx, dword [ebp - 0x420]
push edx
push 0x4e
push 0x40fa1c
call fcn.0040a8b0
jmp 0x40de78
lea eax, [ebp - 0x418]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40de5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
push eax
call section..text
add esp, 4
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jl 0x40de47
mov dword [ebp - 0x420], 0x80004005
mov ecx, dword [ebp - 0x420]
push ecx
push 0x53
push 0x40fa2c
call fcn.0040a8b0
jmp 0x40de78
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401040
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401518
mov esp, ebp
pop ebp
ret 0xc
Function at 0x6905eb
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp], ecx
mov esp, dword [esp]
mov dword [esp], ecx
xor dword [esp], 0x67fa4ccb
push dword [esp]
pop eax
jmp 0x690553
add ecx, ebx
push dword [esp]
pop ebx
add esp, 4
push esi
push 4
jmp 0x69044f
pop esi
push edi
mov edi, 0x76fff03a
sub ecx, edi
pop edi
sub ecx, esi
add ecx, 0x76fff03a
pop esi
jmp 0x690356
pop esp
jmp 0x690c80
add ecx, eax
jmp 0x690866
add ecx, ebx
push eax
mov eax, 0x2fe1cc27
jmp 0x690b3b
mov dword [esp], eax
mov ebp, dword [esp]
jmp 0x69094c
add esp, 4
xor eax, 0x67fa4ccb
jmp 0x690b06
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
sub ecx, edx
jmp 0x6907ee
mov edi, 0xffffffff
add eax, edi
mov edi, dword [esp]
add esp, 4
not eax
push edi
mov edi, 0x5fa85b9e
sub edi, 1
xor edi, 0x87bf9f
xor eax, edi
mov edi, dword [esp]
add esp, 4
sub eax, 0xd71c098
sub esp, 4
jmp 0x6904f2
pop ebx
add ecx, 0x4ffd93a0
push dword [esp]
pop edx
push ebp
sub esp, 4
jmp 0x690965
add ebp, 4
xchg dword [esp], ebp
pop esp
sub ebx, 1
jne 0x6905a7
sti
mov ecx, 0x10330546
push ebp
push eax
push ebx
mov ebx, 0x7fdfdf30
mov eax, ebx
pop ebx
sub eax, 1
push edx
mov edx, 0x5dbf2b08
sub eax, edx
pop edx
push ebx
jmp 0x690b30
sub esp, 4
mov dword [esp], ebx
mov ebx, 0x7cd55ae1
sub ebx, 0x1f4d9716
sub ecx, 0x3d7972c3
jmp 0x6904e5
pop eax
jmp 0x690677
pop esp
mov ecx, ebp
mov ebp, dword [esp]
add esp, 4
sub esp, 4
mov dword [esp], ecx
jmp 0x6909f9
add esp, 4
mov eax, dword [esp]
jmp 0x690aa0
mov dword [esp], esp
add dword [esp], 4
pop ebp
push ecx
mov ecx, 4
add ebp, ecx
pop ecx
jmp 0x690745
mov ecx, 0x365a0e22
push ecx
push esp
pop ecx
push ebx
mov ebx, 0x7f2ec089
shl ebx, 1
xor ebx, 0xfe5d8116
jmp 0x690382
push 0x79bef994
mov dword [esp], ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
jmp 0x690899
push dword [esp]
pop ecx
push ecx
mov dword [esp], eax
mov eax, esp
add eax, 4
add eax, 4
jmp 0x690b48
mov dword [esp], edx
mov dword [esp], edi
jmp 0x690641
inc eax
not eax
add eax, 0x6d5b3eec
jmp 0x6904de
xchg dword [esp], eax
jmp 0x69046d
invalid
lahf
jg 0x690c71
sal byte [esi + 0x27fbab72], 0xd5
and dword [eax + 0x4e], 0x265f231d
add ebx, dword [ecx + 0x2fd11b78]
out 0x43, eax
push edx
push es
inc ebp
outsd dx, dword [esi]
invalid