joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401177
Capabilities:
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc eax
cmp eax, 1
sbb eax, eax
inc eax
ret

Function at 0x40127c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push esi
lea eax, [ebp + 0x10]
push edi
xor esi, esi
mov di, word [ebp + 8]
push eax
mov si, di
lea edx, [ebp - 0x800]
push dword [ebp + 0xc]
and di, 0xff
and esi, 0x1000
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
movzx eax, di
test eax, eax
je 0x4012c5
cmp eax, 1
je 0x4012e3
cmp eax, 2
je 0x401301
cmp eax, 8
jne 0x40131f
push 0x40
lea eax, [ebp - 0x800]
push 0x4063ac
push eax
push dword [0x405b44]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, eax
jmp 0x401322
push 0x10
lea eax, [ebp - 0x800]
push 0x4063ac
push eax
push dword [0x405b44]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, eax
jmp 0x401322
push 0x24
lea eax, [ebp - 0x800]
push 0x4063ac
push eax
push dword [0x405b44]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, eax
jmp 0x401322
mov edi, dword [ebp - 4]
test esi, esi
je 0x40132e
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401336
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov eax, dword [edx]
mov esi, edx
push 0
cmp eax, 1
sbb edx, edx
push pe_nt_image_headers32
add edx, 3
cmp eax, 1
sbb eax, eax
push edx
push 0
and eax, 0x40000000
push 3
sub eax, 0x80000000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov ebx, eax
je 0x401379
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi], eax
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x40137e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push esi
lea eax, [ebp - 4]
push 0
mov esi, dword [ebp + 8]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4013a0
cmp esi, dword [ebp - 4]
je 0x4013b5
push dword [ebp + 0xc]
push str.Error_reading_file__s
push 0x2001
call fcn.0040127c
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x401704
Capabilities:
Create process on windows
Get common file path
Resume thread
Set current directory
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
push ebx
lea eax, [ebp - 0x15c]
push esi
push edi
xor esi, esi
push eax
push 0x103
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x407080
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.guninst.bat
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str._echo_off_r_n:try_r_ndel_guninst.exe_r_nif_exist_guninst.exe_goto_try_r_ndel_guninst.bat_r_ncls_r_n
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 4]
lea ecx, [ebp - 0x260]
call fcn.00401336
cmp eax, 0xffffffff
mov edi, eax
je 0x4017f2
push esi
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x670]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0x670]
push ecx
push edi
mov ebx, 0x44
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
lea ecx, [ebp - 0x58]
mov edx, ebx
call fcn.00401269
mov word [ebp - 0x28], si
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x58]
push ecx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x2c], 1
push esi
push esi
push ebx
push esi
push esi
push esi
push str.command.com__c_guninst.bat
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4017f2
push 0xfffffffffffffffe
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x10]
call edi
push dword [ebp - 0x14]
call edi
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401bbf
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov eax, dword [0x40642c]
mov ebp, esp
sub esp, 0x548
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [eax + 4]
push esi
inc edi
lea ecx, [ebp - 0x208]
mov edx, edi
call fcn.0040144e
lea ecx, [ebp - 0x208]
call fcn.0040151e
mov word [ebp - 2], ax
push 1
lea ecx, [ebp - 0x108]
mov edx, edi
call fcn.0040144e
push 2
lea ecx, [ebp - 0x408]
mov edx, edi
call fcn.0040144e
push 3
lea ecx, [ebp - 0x208]
mov edx, edi
call fcn.0040144e
lea ecx, [ebp - 0x208]
call fcn.0040151e
mov word [ebp - 4], ax
lea ecx, [ebp - 0x108]
call fcn.00401b8b
lea ecx, [ebp - 0x408]
call fcn.00401b8b
lea ecx, [ebp - 0x408]
call fcn.00401115
movzx eax, word [ebp - 4]
test eax, eax
je 0x401c73
cmp eax, 1
je 0x401c7c
cmp eax, 2
je 0x401c85
cmp eax, 3
je 0x401c8e
cmp eax, 4
je 0x401c97
cmp eax, 5
je 0x401ca0
jmp 0x401ca7
mov dword [ebp - 8], 0x42
jmp 0x401ca7
mov dword [ebp - 8], 0x40
jmp 0x401ca7
mov dword [ebp - 8], 0x41
jmp 0x401ca7
mov dword [ebp - 8], 0x45
jmp 0x401ca7
mov dword [ebp - 8], 0x24
jmp 0x401ca7
mov dword [ebp - 8], 0x23
mov edi, 1
xor ebx, ebx
cmp word [ebp - 2], bx
jne 0x401d00
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x108]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x401d00
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
lea eax, [ebp - 0x108]
push pe_nt_image_headers32
push 3
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x401cf9
mov ebx, edi
jmp 0x401d00
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [ebp - 2], di
jne 0x401d27
lea eax, [ebp - 0x108]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x401d27
mov ebx, edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [ebp - 2], 2
jne 0x401d43
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x401d43
mov ebx, edi
cmp word [ebp - 2], 3
jne 0x401d62
lea eax, [ebp - 0x108]
push eax
push 0x401b1f
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x401d62
mov ebx, edi
test ebx, ebx
je 0x401db2
push dword [ebp - 8]
push 0x4063ac
lea ecx, [ebp - 0x408]
push ecx
push dword [0x405b44]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, edi
je 0x401da3
cmp eax, 2
je 0x401dad
cmp eax, 3
je 0x401dad
cmp eax, 4
je 0x401cac
cmp eax, 6
je 0x401cac
jmp 0x401db2
cmp word [ebp - 4], di
jne 0x401cac
mov esi, 1
test esi, esi
je 0x401dbe
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401dc5
Capabilities:
Terminate process

Disassembly:
push ebp
mov eax, dword [0x40642c]
mov ebp, esp
sub esp, 0x794
mov eax, dword [eax + 4]
push ebx
push esi
inc eax
push edi
mov esi, 1
push 0
mov edx, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x794]
call fcn.0040144e
push esi
lea ecx, [ebp - 0x54]
mov edx, dword [ebp - 4]
call fcn.0040144e
mov edx, str.DllUnregisterServer
lea ecx, [ebp - 0x54]
call fcn.00401000
test eax, eax
je 0x401e24
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x794]
call fcn.0040101e
jmp 0x401ffb
push 2
lea ecx, [ebp - 0x94]
mov edx, dword [ebp - 4]
call fcn.0040144e
lea ecx, [ebp - 0x94]
call fcn.0040151e
mov ebx, eax
lea eax, [ebp - 0x794]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x401fe0
mov dword [ebp - 8], 0
test ebx, ebx
je 0x401e9d
lea eax, [ebp - 0x594]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
add eax, 3
mov ecx, dword [ebp - 0x14]
push eax
call fcn.0040144e
add dword [ebp - 0x14], 0x100
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jb 0x401e7c
cmp dword [ebp - 0xc], 0
je 0x401f4e
test ebx, ebx
jne 0x401eaf
call edi
mov esi, eax
cmp ebx, 1
jne 0x401ebf
lea eax, [ebp - 0x594]
push eax
call edi
mov esi, eax
cmp ebx, 2
jne 0x401ed6
lea eax, [ebp - 0x494]
lea ecx, [ebp - 0x594]
push eax
push ecx
call edi
mov esi, eax
cmp ebx, 3
jne 0x401ef4
lea eax, [ebp - 0x394]
lea ecx, [ebp - 0x494]
push eax
lea edx, [ebp - 0x594]
push ecx
push edx
call edi
mov esi, eax
cmp ebx, 4
jne 0x401f19
lea eax, [ebp - 0x294]
lea ecx, [ebp - 0x394]
push eax
lea edx, [ebp - 0x494]
push ecx
lea eax, [ebp - 0x594]
push edx
push eax
call edi
mov esi, eax
cmp ebx, 5
jne 0x401fe0
lea eax, [ebp - 0x194]
lea ecx, [ebp - 0x294]
push eax
lea edx, [ebp - 0x394]
push ecx
lea eax, [ebp - 0x494]
push edx
lea ecx, [ebp - 0x594]
push eax
push ecx
call edi
mov esi, eax
jmp 0x401fe0
test ebx, ebx
jne 0x401f54
call edi
cmp ebx, 1
jne 0x401f62
lea eax, [ebp - 0x594]
push eax
call edi
cmp ebx, 2
jne 0x401f77
lea eax, [ebp - 0x494]
lea ecx, [ebp - 0x594]
push eax
push ecx
call edi
cmp ebx, 3
jne 0x401f93
lea eax, [ebp - 0x394]
lea ecx, [ebp - 0x494]
push eax
lea edx, [ebp - 0x594]
push ecx
push edx
call edi
cmp ebx, 4
jne 0x401fb6
lea eax, [ebp - 0x294]
lea ecx, [ebp - 0x394]
push eax
lea edx, [ebp - 0x494]
push ecx
lea eax, [ebp - 0x594]
push edx
push eax
call edi
cmp ebx, 5
jne 0x401fe0
lea eax, [ebp - 0x194]
lea ecx, [ebp - 0x294]
push eax
lea edx, [ebp - 0x394]
push ecx
lea eax, [ebp - 0x494]
push edx
lea ecx, [ebp - 0x594]
push eax
push ecx
call edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0xc], 0
je 0x401ffb
test esi, esi
jne 0x401ffb
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402002
Capabilities:
Create process on windows

Disassembly:
push ebp
mov eax, dword [0x40642c]
mov ebp, esp
sub esp, 0x654
mov edx, dword [eax + 4]
push esi
push edi
inc edx
xor esi, esi
lea ecx, [ebp - 0x254]
push esi
mov edi, 0x44
call fcn.0040144e
lea ecx, [ebp - 0x54]
mov edx, edi
call fcn.00401269
cmp byte [ebp - 0x254], 0x22
mov dword [ebp - 0x54], edi
jne 0x4020a1
lea eax, [ebp - 0x254]
lea ecx, [ebp - 0x454]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
inc esi
cmp byte [ebp + esi - 0x454], 0x22
jne 0x402053
push esi
lea eax, [ebp - 0x453]
push eax
lea ecx, [ebp - 0x654]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x200
lea ecx, [ebp - 0x254]
push ecx
lea edx, [ebp - 0x654]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea ecx, [ebp + esi - 0x453]
lea edx, [ebp - 0x254]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x54]
push eax
push ecx
xor eax, eax
lea edx, [ebp - 0x254]
push eax
push eax
push 0x4000020
push 1
push eax
push eax
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4020e5
push 0xffffffffffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4020eb
Capabilities:
Read .ini file

Disassembly:
push ebp
mov eax, dword [0x40642c]
mov ebp, esp
sub esp, 0x500
push esi
lea ecx, [ebp - 0x300]
push edi
xor esi, esi
mov edi, dword [eax + 4]
push esi
inc edi
mov edx, edi
call fcn.0040144e
push 1
lea ecx, [ebp - 0x500]
mov edx, edi
call fcn.0040144e
push 2
lea ecx, [ebp - 0x100]
mov edx, edi
call fcn.0040144e
lea ecx, [ebp - 0x300]
call fcn.00401177
test eax, eax
je 0x4021ce
lea eax, [ebp - 0x300]
lea ecx, [ebp - 0x100]
push eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push ecx
call edi
lea ecx, [ebp - 0x100]
cmp eax, 1
mov eax, 0
adc eax, 0xffffffff
and eax, ecx
lea ecx, [ebp - 0x500]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0x100]
push ecx
call edi
test eax, eax
je 0x4021ce
lea eax, [ebp - 0x300]
lea ecx, [ebp - 0x100]
push eax
lea edx, [ebp - 0x500]
push 0xc8
push ecx
push 0x405170
push esi
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x100]
push ecx
call edi
test eax, eax
jne 0x4021ce
lea eax, [ebp - 0x300]
lea ecx, [ebp - 0x500]
push eax
push esi
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4021d4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov dword [ebp - 8], pe_nt_image_headers32
push ebx
lea eax, [ebp - 4]
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov edi, edx
push eax
push 0x2001f
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4022ae
lea eax, [ebp - 0x10]
lea ecx, [ebp - 8]
push eax
lea edx, [ebp - 0x90]
push ebx
push ebx
push ebx
push ecx
push edx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4022a5
push edi
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [edi + eax - 1], 0x5c
je 0x402255
push 0x405174
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x290]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x290]
mov ecx, esi
call fcn.004021d4
test eax, eax
je 0x40227b
inc ebx
lea eax, [ebp - 0x10]
lea ecx, [ebp - 8]
push eax
lea edx, [ebp - 0x90]
mov dword [ebp - 8], pe_nt_image_headers32
push 0
push 0
push 0
push ecx
push edx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x402227
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4022bd
Capabilities:
Delete registry value

Disassembly:
push ebp
mov eax, dword [0x40642c]
mov ebp, esp
sub esp, 0x284
push esi
lea ecx, [ebp - 0x284]
push edi
push 0
mov edi, dword [eax + 4]
inc edi
mov edx, edi
call fcn.0040144e
lea ecx, [ebp - 0x284]
call fcn.0040151e
movzx eax, al
test eax, eax
je 0x402342
cmp eax, 1
je 0x402349
cmp eax, 2
je 0x402350
cmp eax, 3
je 0x402357
mov esi, dword [ebp - 4]
push 1
lea ecx, [ebp - 0x284]
mov edx, edi
call fcn.0040144e
push 2
lea ecx, [ebp - 0x84]
mov edx, edi
call fcn.0040144e
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x40235e
lea edx, [ebp - 0x284]
mov ecx, esi
call fcn.004021d4
jmp 0x4023af
mov esi, 0x80000000
jmp 0x402304
mov esi, 0x80000001
jmp 0x402304
mov esi, 0x80000002
jmp 0x402304
mov esi, 0x80000003
jmp 0x402304
lea eax, [ebp - 4]
lea ecx, [ebp - 0x284]
push eax
push 0x20006
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4023af
mov edx, str.default
lea ecx, [ebp - 0x84]
call fcn.00401000
test eax, eax
je 0x402396
push 0x405170
jmp 0x40239d
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4023b5
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov eax, dword [0x40642c]
mov ebp, esp
sub esp, 0x210
push esi
push edi
mov edi, dword [eax + 4]
xor esi, esi
inc edi
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 4
push eax
push 0xf003f
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionSharedDLLs
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402487
push esi
lea ecx, [ebp - 0x210]
mov edx, edi
call fcn.0040144e
lea eax, [ebp - 0x10]
lea ecx, [ebp - 8]
push eax
lea edx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0x210]
push edx
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40247e
dec dword [ebp - 8]
je 0x402444
push 4
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x210]
push dword [ebp - 0xc]
push esi
push edx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x40247e
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0x180
push 0x3ea
push dword [0x405b44]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
lea ecx, [ebp - 0x210]
call fcn.0040368e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4027e2
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebx
push esi
mov bl, dl
mov esi, ecx
call fcn.00401177
test eax, eax
je 0x402892
mov ecx, esi
call fcn.0040368e
test eax, eax
je 0x402892
cmp bl, 1
jne 0x402826
push esi
mov ecx, 0x33
call fcn.004014ef
push eax
push 2
call fcn.0040127c
add esp, 0xc
cmp eax, 6
jne 0x402826
xor bl, bl
test bl, bl
jne 0x402874
push pe_nt_image_headers32
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, str..ttf
lea ecx, [esi + eax - 4]
call fcn.00401000
test eax, eax
je 0x402867
push esi
call dword [sym.imp.GDI32.dll_RemoveFontResourceA]
push 0
push 0
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x402874
mov bl, 2
cmp bl, 2
jne 0x402892
push esi
mov eax, dword [0x405b44]
push 0
push 0x180
push 0x3ea
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
pop esi
pop ebx
ret
Function at 0x4028e6
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4c
push ebx
mov dword [ebp - 8], edx
push esi
mov ebx, ecx
push edi
xor esi, esi
xor edi, edi
push ebx
lea eax, [ebp - 0x74c]
mov dword [ebp - 0xc], esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x74c]
call fcn.004014a6
lea edx, [ebp - 0x34c]
mov ecx, ebx
call fcn.0040113f
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x84c]
lea edx, [ebp - 0x94c]
push eax
lea ecx, [ebp - 0x34c]
call fcn.00402895
cmp byte [ebp - 0x34c], 0x2a
jne 0x402957
mov edi, 1
test eax, eax
jl 0x402965
cmp byte [ebp + eax - 0x34b], 0x2a
jne 0x40296c
mov dword [ebp - 0xc], 1
test edi, edi
jne 0x40297e
test eax, eax
jl 0x402983
cmp byte [ebp + eax - 0x34b], 0x2a
jne 0x402983
mov esi, 1
lea eax, [ebp - 0x74c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 2
jne 0x4029b0
cmp byte [ebp - 0x74b], 0x3a
jne 0x4029b0
push 0x405174
lea eax, [ebp - 0x74c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
test esi, esi
je 0x4029e2
lea eax, [ebp - 0x74c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
jle 0x402b60
push 0x4052dc
lea edx, [ebp - 0x74c]
lea ecx, [ebp - 0xb4c]
call fcn.00401186
jmp 0x4029f0
push ebx
lea eax, [ebp - 0xb4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x14c]
lea ecx, [ebp - 0xb4c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x402b60
xor ebx, ebx
test esi, esi
je 0x402a69
lea eax, [ebp - 0x54c]
lea edx, [ebp - 0x34c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00402895
test edi, edi
jne 0x402a47
lea edx, [ebp - 0x94c]
lea ecx, [ebp - 0x34c]
call fcn.00401000
test eax, eax
je 0x402a69
cmp dword [ebp - 0xc], 0
mov ebx, 1
jne 0x402a69
lea edx, [ebp - 0x84c]
lea ecx, [ebp - 0x54c]
call fcn.00401000
test eax, eax
jne 0x402a69
xor ebx, ebx
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x74c]
push eax
lea ecx, [ebp - 0x54c]
call fcn.00401186
test esi, esi
je 0x402a8d
test ebx, ebx
je 0x402b3f
test byte [ebp - 0x14c], 0x10
je 0x402b08
cmp dword [ebp - 8], 0
je 0x402b3f
mov edx, 0x4052d8
lea ecx, [ebp - 0x120]
call fcn.00401000
test eax, eax
jne 0x402b3f
mov edx, 0x4052d4
lea ecx, [ebp - 0x120]
call fcn.00401000
test eax, eax
jne 0x402b3f
push str..
lea edx, [ebp - 0x54c]
lea ecx, [ebp - 0x34c]
call fcn.00401186
cmp byte [ebp + 8], 2
je 0x402af9
lea ecx, [ebp - 0x34c]
mov edx, dword [ebp - 8]
push dword [ebp + 8]
call fcn.004028e6
lea eax, [ebp - 0x54c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x402b3f
cmp dword [ebp - 8], 0
jne 0x402b19
lea ecx, [ebp - 0x54c]
mov edx, dword [ebp + 8]
jmp 0x402b3a
cmp byte [ebp + 8], 0
jne 0x402b2c
lea ecx, [ebp - 0x54c]
mov edx, 2
jmp 0x402b3a
cmp byte [ebp + 8], 1
jne 0x402b3f
lea ecx, [ebp - 0x54c]
xor edx, edx
call fcn.004027e2
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402a10
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x402c26
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebx
cmp ecx, 0xffffffff
push esi
push edi
je 0x402d79
mov edi, ecx
mov ebx, 0x405730
push ebx
mov eax, dword [0x405b44]
push edi
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0x189
push 0x3ea
push eax
call esi
mov ecx, ebx
call fcn.00401177
test eax, eax
je 0x402d04
push pe_nt_image_headers32
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [eax + 0x40572c]
mov edx, str..ttf
call fcn.00401000
test eax, eax
je 0x402ca1
push ebx
call dword [sym.imp.GDI32.dll_RemoveFontResourceA]
push 0
push 0
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x405730
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x402cdb
mov ebx, 0x405730
push ebx
mov ecx, 0x34
call fcn.004014ef
push eax
push 2
call fcn.0040127c
add esp, 0xc
cmp eax, 6
jne 0x402d04
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x402cb5
mov ebx, 0x405730
mov ecx, ebx
call fcn.004014a6
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x402d04
mov ecx, ebx
call fcn.004014a6
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x402cf2
xor ebx, ebx
mov eax, dword [0x405b44]
push ebx
push edi
push 0x182
mov edi, 0x3ea
push edi
push eax
call esi
push ebx
mov eax, dword [0x405b44]
push ebx
push 0x18b
push edi
push eax
call esi
test eax, eax
jne 0x402d63
push ebx
mov eax, dword [0x405b44]
push 0x3eb
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push ebx
mov eax, dword [0x405b44]
push 0x3ec
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x402d79
push 0
mov eax, dword [0x405b44]
push 0
push 0x186
push 0x3ea
push eax
call esi
pop edi
pop esi
pop ebx
ret
Function at 0x40121c
Capabilities:
Delete directory
Delete file

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.0040127d
mov ecx, esi
call fcn.00401292
mov edi, eax
test edi, edi
jne 0x401255
mov ecx, esi
call fcn.004013e3
mov edi, eax
test edi, edi
jne 0x401255
mov ecx, esi
call fcn.00401690
mov edi, eax
test edi, edi
jne 0x401255
mov ecx, esi
call fcn.0040180a
mov edi, eax
cmp dword [0x409c08], 0
jne 0x401278
lea eax, [esi + 0x1210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 0x1314
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, edi
pop edi
pop esi
ret