joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403ff0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov edx, 0x12345678
mov eax, 0x23456789
push ebx
sub esp, 0x14
mov ecx, dword [esp + 0x24]
mov dword [0x439200], edx
mov ebx, dword [esp + 0x20]
mov edx, 0x34567890
mov dword [0x439204], eax
mov dword [0x439208], edx
movzx edx, byte [ecx]
test dl, dl
je 0x4041e6
mov esi, dword [0x438cb8]
mov esi, esi
mov eax, dword [0x439200]
inc ecx
xor dl, al
movzx edx, dl
shr eax, 8
xor eax, dword [esi + edx*4]
mov edx, dword [0x439204]
mov dword [0x439200], eax
and eax, 0xff
add eax, edx
imul eax, eax, 0x8088405
mov edx, dword [0x439208]
inc eax
mov dword [0x439204], eax
shr eax, 0x18
xor eax, edx
and eax, 0xff
shr edx, 8
xor edx, dword [esi + eax*4]
mov dword [0x439208], edx
movzx eax, byte [ecx]
test al, al
mov dl, al
jne 0x404030
mov ecx, dword [ebx]
mov dword [esp], ecx
mov edx, dword [ebx + 4]
mov dword [esp + 4], edx
mov ecx, dword [ebx + 8]
xor ebx, ebx
mov dword [esp + 8], ecx
lea esi, [esi]
mov ecx, dword [0x439208]
movzx eax, cx
or eax, 2
mov edx, eax
xor edx, 1
imul eax, edx
movzx edx, byte [esp + ebx]
movzx eax, ah
xor dl, al
mov byte [esp + ebx], dl
mov eax, dword [0x439200]
inc ebx
xor dl, al
movzx edx, dl
shr eax, 8
xor eax, dword [esi + edx*4]
mov edx, dword [0x439204]
mov dword [0x439200], eax
and eax, 0xff
add eax, edx
imul eax, eax, 0x8088405
inc eax
mov dword [0x439204], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
mov edx, dword [esi + eax*4]
xor ecx, edx
cmp ebx, 0xb
mov dword [0x439208], ecx
jle 0x4040a0
movzx edx, byte [esp + 0xb]
mov ebx, dword [0x428cb4]
test byte [ebx + 0x18], 2
je 0x4041da
movzx eax, byte [0x438d05]
cmp edx, eax
je 0x404137
mov eax, 0xffffffff
add esp, 0x14
pop ebx
pop esi
ret
mov ebx, dword [0x438cc8]
mov eax, dword [0x428494]
cmp ebx, eax
jle 0x404148
mov ebx, eax
dec ebx
mov esi, dword [0x438cc4]
cmp ebx, 0xffffffff
je 0x4041d3
lea esi, [esi]
lea edi, [edi]
movzx ecx, word [0x439208]
dec ebx
or ecx, 2
mov eax, ecx
xor eax, 1
imul ecx, eax
movzx edx, ch
movzx ecx, byte [esi]
xor cl, dl
mov byte [esi], cl
mov eax, dword [0x439200]
inc esi
xor cl, al
movzx edx, cl
shr eax, 8
mov ecx, dword [0x438cb8]
xor eax, dword [ecx + edx*4]
mov edx, dword [0x439204]
mov dword [0x439200], eax
and eax, 0xff
add eax, edx
imul eax, eax, 0x8088405
mov edx, dword [0x439208]
inc eax
mov dword [0x439204], eax
shr eax, 0x18
xor eax, edx
and eax, 0xff
shr edx, 8
xor edx, dword [ecx + eax*4]
cmp ebx, 0xffffffff
mov dword [0x439208], edx
jne 0x404160
xor eax, eax
jmp 0x404131
movzx eax, byte [0x438d0b]
jmp 0x404128
mov esi, dword [0x438cb8]
jmp 0x404084

Function at 0x404220
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
mov edx, dword [0x439200]
mov eax, dword [esp + 8]
mov ebx, dword [0x438cb8]
mov ecx, edx
xor ecx, eax
and ecx, 0xff
shr edx, 8
xor edx, dword [ebx + ecx*4]
mov ecx, dword [0x439204]
mov dword [0x439200], edx
and edx, 0xff
add edx, ecx
imul edx, edx, 0x8088405
mov ecx, dword [0x439208]
inc edx
mov dword [0x439204], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [ebx + edx*4]
pop ebx
mov dword [0x439208], ecx
ret
Function at 0x40a230
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
test esi, esi
mov ebp, esi
je 0x40a28a
lea esi, [esi]
lea edi, [edi]
mov edx, dword [0x438cc8]
test edx, edx
jle 0x40a294
cmp edx, esi
mov ebx, edx
jbe 0x40a262
mov ebx, esi
mov dword [esp], edi
mov edx, dword [0x438cc4]
add edi, ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
add dword [0x438cc4], ebx
sub dword [0x438cc8], ebx
sub esi, ebx
jne 0x40a250
mov eax, ebp
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x2000
mov edx, dword [0x438cc0]
mov dword [esp + 4], edx
mov edx, dword [0x438ce4]
mov dword [esp], edx
call sub.msvcrt.dll__read
mov dword [0x438cc8], eax
test eax, eax
mov edx, eax
je 0x40a312
test eax, eax
js 0x40a2de
add dword [0x438cec], 0x2000
mov ecx, dword [0x438cc0]
mov dword [0x438cc4], ecx
jmp 0x40a25a
mov dword [esp], 0x409cd6
call sub.msvcrt.dll_strlen
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x401
mov dword [esp + 4], 0x409cd6
mov dword [esp], 0x4283f0
call dword [0x439258]
xor eax, eax
jmp 0x40a28c
mov eax, ebp
sub eax, esi
jmp 0x40a28c

Function at 0x40a320
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov edx, dword [0x438db8]
test edx, edx
jne 0x40a465
mov eax, dword [0x428494]
test eax, eax
jle 0x40a46f
mov edx, dword [0x438cc8]
test edx, edx
jle 0x40a3bd
mov ecx, dword [0x438cc4]
mov ebx, dword [0x428cb4]
test byte [ebx + 0x18], 1
je 0x40a3a0
lea esi, [edx - 1]
mov ebx, ecx
cmp esi, 0xffffffff
je 0x40a3a0
lea esi, [esi]
lea edi, [edi]
call fcn.00404200
xor al, byte [ebx]
dec esi
movzx ecx, al
mov byte [ebx], al
inc ebx
mov dword [esp], ecx
call fcn.00404220
cmp esi, 0xffffffff
jne 0x40a370
mov edx, dword [0x438cc8]
mov ecx, dword [0x438cc4]
mov esi, esi
lea edi, [edi]
lea ebx, [edx - 1]
lea edx, [ecx + 1]
mov dword [0x438cc8], ebx
movzx esi, byte [ecx]
mov dword [0x438cc4], edx
mov eax, esi
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp + 8], 0x2000
mov ebx, dword [0x438cc0]
mov ecx, dword [0x438ce4]
mov dword [esp + 4], ebx
mov dword [esp], ecx
call sub.msvcrt.dll__read
mov dword [0x438cc8], eax
test eax, eax
je 0x40a45d
test eax, eax
js 0x40a47a
add dword [0x438cec], 0x2000
mov ebx, dword [0x428494]
mov ecx, dword [0x438cc0]
cmp eax, ebx
mov dword [0x438cc4], ecx
jle 0x40a454
test ebx, ebx
js 0x40a448
mov esi, dword [0x438cc8]
mov dword [0x438cc8], ebx
mov ecx, dword [0x438cc4]
sub esi, ebx
mov dword [0x43926c], esi
lea edx, [ebx + ecx]
mov dword [0x439270], edx
mov edx, dword [0x438cc8]
sub ebx, edx
mov dword [0x428494], ebx
jmp 0x40a350
xor edx, edx
xor ebx, ebx
mov dword [0x428494], edx
jmp 0x40a412
xor eax, eax
mov dword [0x43926c], eax
jmp 0x40a435
xor esi, esi
mov dword [0x438cc8], esi
mov eax, 0xffffffff
jmp 0x40a3b7
lea edx, [eax - 1]
mov dword [0x428494], edx
jmp 0x40a45d
mov dword [esp], 0x409cd6
call sub.msvcrt.dll_strlen
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x401
mov dword [esp + 4], 0x409cd6
mov dword [esp], 0x4283f0
call dword [0x439258]
mov dword [esp], 3
call sub.msvcrt.dll_exit
lea esi, [esi]
lea edi, [edi]
Function at 0x40bb20
Capabilities:
Read file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [0x438cf0]
mov ecx, dword [esp + 0x20]
add eax, ecx
test eax, eax
mov edx, eax
js 0x40bc40
and edx, 0xffffe000
mov ebx, eax
sub ebx, edx
mov edx, eax
sub edx, ebx
test eax, eax
js 0x40bbf0
cmp edx, dword [0x438cec]
je 0x40bbd0
mov dword [esp + 0xc], 0
mov ecx, edx
sar ecx, 0x1f
mov dword [esp + 8], ecx
mov ecx, dword [0x438ce4]
mov dword [esp + 4], edx
mov dword [esp], ecx
call sub.msvcrt.dll__lseeki64
mov dword [0x438cec], eax
mov edx, dword [0x438cc0]
mov ecx, dword [0x438ce4]
mov dword [esp + 8], 0x2000
mov dword [esp + 4], edx
mov dword [esp], ecx
call sub.msvcrt.dll__read
mov dword [0x438cc8], eax
test eax, eax
mov edx, 0x33
jle 0x40bbc4
mov edx, dword [0x438cc0]
sub eax, ebx
mov dword [0x438cc8], eax
add ebx, edx
mov dword [0x438cc4], ebx
xor edx, edx
add esp, 0x18
mov eax, edx
pop ebx
ret
mov edx, dword [0x438cc4]
mov ecx, dword [0x438cc0]
sub edx, ecx
sub edx, ebx
add ecx, ebx
add dword [0x438cc8], edx
mov dword [0x438cc4], ecx
jmp 0x40bbc2
mov dword [esp + 0xc], 0x401470
mov edx, dword [0x438ce0]
mov dword [esp + 4], 0x4013b0
mov dword [esp], 0x428cb8
mov dword [esp + 8], edx
call sub.msvcrt.dll_sprintf
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 4], 0x428cb8
mov dword [esp], 0x4283f0
call dword [0x439258]
mov edx, 3
jmp 0x40bbc4
lea edx, [eax + 0x1fff]
jmp 0x40bb39
Function at 0x417e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push edx
push ecx
mov esi, dword [ebp + 0xc]
sub eax, eax
test esi, esi
je 0x417f20
call fcn.00403c50
mov edi, eax
mov eax, dword [ebp + 8]
sub ebx, ebx
mov ecx, dword [ebp + 0x10]
not eax
test ecx, ecx
je 0x417f1e
test esi, 3
je 0x417eb4
xor al, byte [esi]
inc esi
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x417e9e
mov edx, ecx
shr ecx, 3
je 0x417f09
nop
xor eax, dword [esi]
add esi, 4
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x417ebc
mov ecx, edx
and ecx, 7
je 0x417f1e
xor al, byte [esi]
inc esi
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x417f10
not eax
pop ecx
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4186e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ecx, 2
push edi
mov edi, 0x4186c5
push esi
push ebx
sub esp, 0x25c
mov ebx, dword [esp + 0x270]
cld
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x418712
mov esi, ebx
mov edi, 0x4186c8
mov ecx, 2
repe cmpsb byte [esi], byte es:[edi]
jne 0x418740
movzx eax, byte [ebx + 2]
test al, al
je 0x418740
cmp al, 0x2f
je 0x418740
xor edx, edx
cmp al, 0x5c
je 0x418740
lea esi, [esi]
lea edi, [edi]
add esp, 0x25c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, byte [ebx]
mov ecx, dword [sym.imp.msvcrt.dll___mb_cur_max]
cmp dword [ecx], 1
je 0x4188c0
mov dword [esp + 4], 0x103
mov dword [esp], edx
call sub.msvcrt.dll__isctype
test eax, eax
je 0x418770
cmp byte [ebx + 1], 0x3a
je 0x4188b1
mov dword [esp + 4], 0x104
lea edx, [esp + 0x2c]
lea esi, [esp + 0x140]
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFullPathNameA
sub esp, 0x10
xor edx, edx
test eax, eax
je 0x418730
mov dword [esp + 0x2c], esi
mov dword [esp + 8], 2
mov ebx, dword [esp + 0x2c]
mov dword [esp], 0x439290
mov dword [esp + 4], ebx
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x4187d0
mov edx, 1
jmp 0x418730
mov dword [esp + 8], 2
mov edx, dword [esp + 0x2c]
lea ebx, [esp + 0x30]
mov dword [esp], 0x439290
lea esi, [esp + 0x28]
lea ebp, [esp + 0x20]
mov dword [esp + 4], edx
lea edi, [esp + 0x140]
call sub.msvcrt.dll_strncpy
mov byte [0x439292], 0x2f
lea ecx, [esp + 0x24]
mov byte [0x439293], 0
mov dword [esp + 0x1c], 0x104
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], 0x439290
call sub.KERNEL32.dll_GetVolumeInformationA
sub esp, 0x20
test eax, eax
jne 0x418856
mov byte [0x439290], 0
xor edx, edx
jmp 0x418730
mov dword [esp], ebx
xor ecx, ecx
mov edi, 0x4186cb
cmp dword [esp + 0x24], 0xc
setbe cl
xor ebp, ebp
mov dword [0x439294], ecx
call sub.msvcrt.dll__strupr
cld
mov esi, eax
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
je 0x4188a1
mov edi, 0x4186d0
mov ecx, 4
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x4188a1
mov edi, 0x4186d5
mov ecx, 3
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4188a6
mov ebp, 1
mov dword [0x439298], ebp
jmp 0x4187c0
mov dword [esp + 0x2c], ebx
jmp 0x4187a0
mov esi, dword [sym.imp.msvcrt.dll__pctype]
mov ecx, dword [esi]
movzx eax, word [ecx + edx*2]
and eax, 0x103
jmp 0x418762
Function at 0x41acd0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x1c
lea edx, [esp + 0x1a]
mov dword [esp + 0xc], 2
mov dword [esp + 8], edx
mov dword [esp + 4], 0x21
mov dword [esp], 0x400
call sub.KERNEL32.dll_GetLocaleInfoA
sub esp, 0x10
test eax, eax
je 0x41ad19
movsx edx, byte [esp + 0x1a]
mov eax, 1
cmp edx, 0x31
je 0x41ad1b
cmp edx, 0x31
jg 0x41ad20
xor eax, eax
cmp edx, 0x30
je 0x41ad1b
xor eax, eax
add esp, 0x1c
ret
mov eax, 2
cmp edx, 0x32
jmp 0x41ad17

Function at 0x41ad30
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x1c
lea edx, [esp + 0x1a]
mov dword [esp + 0xc], 2
mov dword [esp + 8], edx
mov dword [esp + 4], 0x1d
mov dword [esp], 0x400
call sub.KERNEL32.dll_GetLocaleInfoA
sub esp, 0x10
test eax, eax
je 0x41ad6a
movzx ecx, byte [esp + 0x1a]
test cl, cl
movsx edx, cl
jne 0x41ad6f
mov edx, 0x2d
mov eax, edx
add esp, 0x1c
ret

Function at 0x41aec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, 0xffffffff
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc0000000
mov dword [esp], 0x41aeb9
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
sub esp, 0x1c
cmp ebx, 0xffffffff
mov eax, 0xffffffff
je 0x41af95
mov dword [esp], ebx
lea edx, [esp + 0x28]
mov dword [esp + 4], edx
call sub.KERNEL32.dll_GetConsoleMode
sub esp, 8
test eax, eax
jne 0x41afe0
mov dword [esp + 0x10], 0
lea edi, [esp + 0x24]
lea esi, [esp + 0x22]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
je 0x41af70
cmp dword [esp + 0x24], 1
je 0x41afa0
mov eax, dword [esp + 0x28]
cmp eax, 0xffffffff
je 0x41af88
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_SetConsoleMode
sub esp, 8
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, ebp
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebp, byte [esp + 0x22]
cmp ebp, 0xa
jne 0x41af70
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
je 0x41af70
cmp dword [esp + 0x24], 1
jne 0x41af70
movzx ebp, byte [esp + 0x22]
jmp 0x41af70
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.KERNEL32.dll_SetConsoleMode
sub esp, 8
jmp 0x41af3a
Function at 0x41cb30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [0x428020]
test eax, eax
jne 0x41cbd5
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x41cbcb
mov dword [esp + 4], eax
mov dword [esp], 0x428024
call sub.KERNEL32.dll_InterlockedExchange
sub esp, 8
mov esi, eax
test eax, eax
je 0x41ccea
mov dword [esp + 4], eax
mov dword [esp], 0x428024
call sub.KERNEL32.dll_InterlockedExchange
sub esp, 8
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
mov dword [esp], esi
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [0x428020]
sub esp, 4
test eax, eax
jne 0x41cbd5
xor eax, eax
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [esp + 0x20]
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
lea ebp, [eax + 1]
mov edx, dword [esp + 0x28]
mov dword [esp], edx
call sub.ADVAPI32.DLL_GetSecurityDescriptorLength
sub esp, 4
lea edi, [ebp + eax + 0x134]
mov esi, eax
call sub.KERNEL32.dll_GetProcessHeap
mov dword [esp], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
call sub.KERNEL32.dll_HeapAlloc
mov ebx, eax
sub esp, 0xc
xor eax, eax
test ebx, ebx
je 0x41cbcd
mov dword [ebx], 0
lea ecx, [ebx + 0x10]
lea edi, [esi + ecx]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edi
add edi, 0x124
mov dword [ebx + 0xc], edi
mov dword [esp + 8], esi
mov esi, dword [esp + 0x28]
mov dword [esp], ecx
mov dword [esp + 4], esi
call sub.msvcrt.dll_memcpy
mov edi, dword [ebx + 8]
mov eax, 0x124
mov esi, dword [esp + 0x24]
test edi, 4
je 0x41cc75
mov edx, dword [esi]
mov eax, 0x120
add esi, 4
mov dword [edi], edx
add edi, 4
cld
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
mov eax, dword [esp + 0x20]
mov dword [esi + 4], 1
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
mov dword [esp], ecx
call sub.msvcrt.dll_memcpy
mov dword [esp], 0x4396e0
call sub.KERNEL32.dll_EnterCriticalSection
mov ebp, dword [0x428030]
sub esp, 4
test ebp, ebp
jne 0x41cce0
mov dword [0x428030], ebx
mov dword [0x4396d0], ebx
mov dword [esp], 0x4396e0
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
mov eax, 1
jmp 0x41cbcd
mov edi, dword [0x4396d0]
mov dword [edi], ebx
jmp 0x41ccbd
mov dword [esp], 0x4396e0
mov edi, 0x439700
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
mov dword [esp], 0x439830
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
mov eax, 0x124
test edi, 4
je 0x41cd2b
xor eax, eax
mov edi, 0x439704
mov dword [0x439700], eax
mov eax, 0x120
cld
mov ecx, eax
shr ecx, 2
mov eax, esi
rep stosd dword es:[edi], eax
call fcn.0041c9d0
mov dword [esp], ebx
mov ecx, 1
mov dword [0x428020], ecx
call sub.KERNEL32.dll_ReleaseMutex
sub esp, 4
mov eax, 1
jmp 0x41cbc7
Function at 0x41d7e0
Capabilities:
Check os version

Disassembly:
sub esp, 0xbc
mov edx, dword [0x4280f0]
test edx, edx
je 0x41d800
mov edx, 1
mov eax, edx
add esp, 0xbc
ret
mov dword [esp], 0x428050
mov edx, 0x9c
mov dword [0x428050], edx
call sub.KERNEL32.dll_GetVersionExA
sub esp, 4
test eax, eax
je 0x41d9c2
movzx edx, word [0x42805c]
mov eax, dword [0x428060]
cmp eax, 1
mov dword [0x42805c], edx
je 0x41d904
cmp eax, 1
jb 0x41d8f4
cmp eax, 2
je 0x41d86a
cmp eax, 3
je 0x41d85d
mov edx, 1
mov dword [0x4280f0], edx
jmp 0x41d7f0
mov ecx, 0x17
mov dword [0x428040], ecx
jmp 0x41d850
mov eax, dword [0x428054]
cmp eax, 3
je 0x41d8e4
cmp eax, 4
je 0x41d8d3
cmp eax, 4
ja 0x41d8a1
mov edx, dword [0x428058]
test edx, edx
jne 0x41d8a1
mov eax, 0x1e
mov dword [0x428040], eax
movzx ecx, word [0x4280e4]
add dword [0x428040], ecx
jmp 0x41d850
cmp eax, 5
jne 0x41d892
mov eax, dword [0x428058]
cmp eax, 2
je 0x41d8b9
cmp eax, 1
je 0x41d8c6
test eax, eax
jne 0x41d892
mov edx, 0x32
mov dword [0x428040], edx
jmp 0x41d892
mov ecx, 0x3c
mov dword [0x428040], ecx
jmp 0x41d892
mov ecx, dword [0x428058]
test ecx, ecx
jne 0x41d879
mov edx, 0x28
jmp 0x41d8be
cmp dword [0x428058], 0x33
jne 0x41d874
mov eax, 0x23
jmp 0x41d88d
mov edx, 2
mov dword [0x428040], edx
jmp 0x41d850
mov ecx, dword [0x428054]
cmp ecx, 4
jne 0x41d850
mov eax, dword [0x428058]
test eax, eax
jne 0x41d93e
mov eax, 0xa
mov dword [0x428040], eax
lea eax, [edx - 0x3b7]
cmp eax, 0x81
ja 0x41d9b0
mov edx, 0xb
mov dword [0x428040], edx
cmp ecx, 4
jne 0x41d850
cmp dword [0x428058], 0xa
je 0x41d970
cmp ecx, 4
jne 0x41d850
cmp dword [0x428058], 0x5a
jne 0x41d850
mov ecx, 0x12
jmp 0x41d862
mov edx, dword [0x42805c]
mov eax, 0xe
mov dword [0x428040], eax
lea eax, [edx - 0x7cf]
cmp eax, 0xb7
ja 0x41d99a
mov edx, 0xf
mov dword [0x428040], edx
jmp 0x41d950
cmp edx, 0x886
jbe 0x41d950
mov edx, 0x10
jmp 0x41d992
cmp edx, 0x438
jbe 0x41d93e
mov edx, 0xc
jmp 0x41d938
mov dword [esp + 0x10], 0x94
xor edx, edx
lea ecx, [esp + 0x10]
mov dword [0x427160], edx
mov dword [esp], ecx
call sub.KERNEL32.dll_GetVersionExA
sub esp, 4
xor edx, edx
test eax, eax
je 0x41d7f5
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [0x428054], edx
mov edx, dword [esp + 0x1c]
mov dword [0x428058], ecx
mov ecx, dword [esp + 0x20]
mov dword [0x42805c], edx
mov dword [0x428060], ecx
jmp 0x41d822

Function at 0x41dd90
Capabilities:
Move file

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x24]
test esi, esi
je 0x41de01
test ebx, ebx
je 0x41de01
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.0041ea10
test eax, eax
je 0x41ddf7
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.KERNEL32.dll_MoveFileA
sub esp, 8
xor edx, edx
test eax, eax
je 0x41dde2
mov ebx, dword [esp + 0x14]
mov eax, edx
mov esi, dword [esp + 0x18]
add esp, 0x1c
ret
call fcn.0041e9f0
mov esi, eax
call sub.msvcrt.dll__errno
mov dword [eax], esi
mov edx, 0xffffffff
jmp 0x41ddd4
mov dword [esp], ebx
call fcn.0041de10
jmp 0x41ddbf
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
jmp 0x41ddf0
Function at 0x41de10
Capabilities:
Delete file

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], esi
test ebx, ebx
je 0x41deb2
call sub.msvcrt.dll__errno
mov esi, dword [eax]
mov dword [esp + 4], 2
mov dword [esp], ebx
call fcn.0041ea10
test eax, eax
jne 0x41dea0
mov dword [esp + 4], 0x10
mov dword [esp], ebx
call fcn.0041ea10
test eax, eax
je 0x41de91
call sub.msvcrt.dll__errno
mov dword [eax], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
xor edx, edx
test eax, eax
je 0x41de7c
mov ebx, dword [esp + 0x14]
mov eax, edx
mov esi, dword [esp + 0x18]
add esp, 0x1c
ret
call fcn.0041e9f0
mov esi, eax
call sub.msvcrt.dll__errno
mov dword [eax], esi
mov edx, 0xffffffff
jmp 0x41de6e
call sub.msvcrt.dll__errno
mov dword [eax], 0x15
jmp 0x41de8a
mov dword [esp + 4], 0x180
mov dword [esp], ebx
call sub.msvcrt.dll__chmod_1
jmp 0x41de42
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
jmp 0x41de8a

Function at 0x41def0
Capabilities:
Create directory

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x24]
test ebx, ebx
je 0x41df55
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.KERNEL32.dll_CreateDirectoryA
sub esp, 8
test eax, eax
je 0x41df36
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x14]
add esp, 0x1c
jmp sub.msvcrt.dll__chmod
call fcn.0041e9f0
mov esi, eax
call sub.msvcrt.dll__errno
mov dword [eax], esi
mov ebx, dword [esp + 0x14]
mov eax, 0xffffffff
mov esi, dword [esp + 0x18]
add esp, 0x1c
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
jmp 0x41df44