joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59d1e8
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x20a
push esi
mov esi, ecx
jne 0x59d232
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x59d232
call fcn.0059caa1
test eax, eax
je 0x59d232
push dword [ebx + 0xc]
mov eax, dword [esi + 0x54]
push dword [ebx + 8]
mov ecx, dword [eax + 0xb4]
push dword [ebx + 4]
call fcn.004c6cb3
xor eax, eax
inc eax
jmp 0x59d44a
cmp dword [ebx + 4], 0x100
push edi
jne 0x59d441
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jl 0x59d32f
push 0x11
call edi
test ax, ax
jl 0x59d32f
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x59d32f
mov eax, dword [ebx + 8]
cmp eax, 0xd
je 0x59d2a2
cmp eax, 0x20
jbe 0x59d32f
cmp eax, 0x24
jbe 0x59d295
cmp eax, 0x26
je 0x59d295
cmp eax, 0x28
jne 0x59d32f
call fcn.0059caa1
test eax, eax
je 0x59d32f
mov ecx, esi
call fcn.004f971e
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
call fcn.0059caa1
test eax, eax
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
je 0x59d2d7
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.004c6cb3
jmp 0x59d43c
call fcn.004d44a5
test eax, eax
je 0x59d43c
mov eax, dword [esi + 0x54]
add eax, 0xb8
push eax
mov ecx, esi
call fcn.004d44dd
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x59d305
xor edi, edi
jmp 0x59d308
mov edi, dword [eax + 0x20]
mov esi, dword [esi + 0x54]
mov ecx, dword [esi + 0xb4]
movzx esi, word [esi + 0x20]
call fcn.004d44a5
push edi
push esi
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x59d43c
mov eax, dword [ebx + 8]
sub eax, 9
je 0x59d40b
sub eax, 0x12
je 0x59d3e3
sub eax, 0xb
je 0x59d351
dec eax
dec eax
jne 0x59d441
push 0x12
call edi
test ax, ax
jl 0x59d441
push 0x11
call edi
test ax, ax
jl 0x59d441
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x59d441
call fcn.0059caa1
test eax, eax
jne 0x59d43c
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
push 1
call fcn.0059ca1b
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
push dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.004d2e4f
test eax, eax
je 0x59d43c
mov esi, dword [esi + 0x54]
lea ebx, [esi + 0x90]
mov esi, dword [esi + 0xb4]
push dword [esi + 0x20]
call edi
push eax
call fcn.004d2e4f
push 1
push ebx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x59d43c
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x59d3f7
push 0
call fcn.0059ca1b
mov ecx, esi
call fcn.004d3f6b
test eax, eax
je 0x59d441
mov ecx, esi
call fcn.004d3f6b
jmp 0x59d435
push dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.004d2e4f
test eax, eax
je 0x59d441
push dword [esi + 0x20]
call edi
push eax
call fcn.004d2e4f
push 0
push esi
mov ecx, eax
call fcn.00541dbc
mov ecx, eax
call fcn.004f971e
xor eax, eax
inc eax
jmp 0x59d449
push ebx
mov ecx, esi
call fcn.004d0c77
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x5b2c6b
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x150]
mov edi, eax
movzx eax, word [ebp + 8]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x5b2cb0
test edi, edi
jl 0x5b2cb0
cmp ax, 0x20
je 0x5b2ca5
cmp word [ebp + 8], 0x71
jne 0x5b2cb0
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x168]
pop edi
pop esi
pop ebp
ret 8

Function at 0x5b7e8e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6656b0]
jne 0x5b7e98
repz ret
jmp fcn.005c4fa6

Function at 0x5b9c71
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x5b9ca2
call fcn.005bf45c
mov dword [eax], esi
call fcn.005bf449
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005b8d6b
add esp, 0x14
push 0x16
pop eax
jmp 0x5b9cf7
test dword [ebp + 0xc], 0xfffffff9
jne 0x5b9c7e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5b9ccf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005bf46f
pop ecx
call fcn.005bf449
mov eax, dword [eax]
jmp 0x5b9cf7
test al, 0x10
jne 0x5b9cf5
test al, 1
je 0x5b9cf5
test byte [ebp + 0xc], 2
je 0x5b9cf5
call fcn.005bf45c
mov dword [eax], 5
call fcn.005bf449
mov dword [eax], 0xd
jmp 0x5b9cc6
xor eax, eax
pop esi
pop ebp
ret
Function at 0x5d3fea
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005c490a
and dword [ebp - 4], 0
cmp dword [0x66ea58], 0
mov ebx, eax
jne 0x5d409b
push 0x61f284
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5d414c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x5d414c
push eax
call fcn.005c4898
mov dword [esp], 0x61f268
push edi
mov dword [0x66ea58], eax
call esi
push eax
call fcn.005c4898
mov dword [esp], 0x61f254
push edi
mov dword [0x66ea5c], eax
call esi
push eax
call fcn.005c4898
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x66ea60], eax
call esi
push eax
call fcn.005c4898
pop ecx
mov dword [0x66ea68], eax
test eax, eax
je 0x5d409b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005c4898
pop ecx
mov dword [0x66ea64], eax
mov eax, dword [0x66ea64]
cmp eax, ebx
je 0x5d40f3
cmp dword [0x66ea68], ebx
je 0x5d40f3
push eax
call fcn.005c4913
push dword [0x66ea68]
mov esi, eax
call fcn.005c4913
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5d40f3
test edi, edi
je 0x5d40f3
call esi
test eax, eax
je 0x5d40ea
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5d40ea
test byte [ebp - 0xc], 1
jne 0x5d40f3
or dword [ebp + 0x10], 0x200000
jmp 0x5d412c
mov eax, dword [0x66ea5c]
cmp eax, ebx
je 0x5d412c
push eax
call fcn.005c4913
pop ecx
test eax, eax
je 0x5d412c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5d412c
mov eax, dword [0x66ea60]
cmp eax, ebx
je 0x5d412c
push eax
call fcn.005c4913
pop ecx
test eax, eax
je 0x5d412c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x66ea58]
call fcn.005c4913
pop ecx
test eax, eax
je 0x5d414c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5d414e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4026f0
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x88
lea ecx, [ebp + 0x60]
call fcn.0041bc40
lea ecx, [ebp + 0x20]
call fcn.0041bc40
push 0x3c
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0042be30
add esp, 0xc
mov dword [ebp - 0x1c], 0x3c
mov ecx, dword [ebp + 0x7c]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], 0x740
mov dword [ebp], 0xa
mov edx, dword [ebp + 0x78]
and edx, 1
je 0x402750
mov dword [ebp], 0
mov eax, dword [ebp - 0x18]
or eax, 0x8000
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x78]
and ecx, 2
je 0x40275f
mov dword [ebp - 0x10], str.runas
mov edx, dword [ebp + 0x78]
and edx, 0x10000
jne 0x402775
mov eax, dword [ebp - 0x18]
or eax, 0x100
mov dword [ebp - 0x18], eax
lea ecx, [ebp + 0x60]
push ecx
mov edx, dword [ebp + 0x74]
push edx
call fcn.00406190
add esp, 8
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x5c]
push eax
lea ecx, [ebp + 0x20]
call fcn.0041bef0
mov ecx, dword [ebp + 0x64]
mov dword [ebp + 0x58], ecx
cmp dword [ebp + 0x58], 0
jne 0x4027d3
mov dword [ebp + 0x4c], 1
mov edx, dword [ebp + 0x20]
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x54]
push eax
call fcn.0042eaf0
add esp, 4
mov ecx, dword [ebp + 0x60]
mov dword [ebp + 0x50], ecx
mov edx, dword [ebp + 0x50]
push edx
call fcn.0042eaf0
add esp, 4
mov eax, dword [ebp + 0x4c]
jmp 0x402878
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x48], eax
mov ecx, dword [ebp + 0x48]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x20]
mov dword [ebp + 0x44], edx
mov eax, dword [ebp + 0x44]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40284a
mov edx, dword [ebp + 0x78]
and edx, 0x10000
jne 0x402810
push 0xffffffffffffffff
mov eax, dword [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x38], 1
mov edx, dword [ebp + 0x20]
mov dword [ebp + 0x40], edx
mov eax, dword [ebp + 0x40]
push eax
call fcn.0042eaf0
add esp, 4
mov ecx, dword [ebp + 0x60]
mov dword [ebp + 0x3c], ecx
mov edx, dword [ebp + 0x3c]
push edx
call fcn.0042eaf0
add esp, 4
mov eax, dword [ebp + 0x38]
jmp 0x402878
mov dword [ebp + 0x2c], 0
mov eax, dword [ebp + 0x20]
mov dword [ebp + 0x34], eax
mov ecx, dword [ebp + 0x34]
push ecx
call fcn.0042eaf0
add esp, 4
mov edx, dword [ebp + 0x60]
mov dword [ebp + 0x30], edx
mov eax, dword [ebp + 0x30]
push eax
call fcn.0042eaf0
add esp, 4
mov eax, dword [ebp + 0x2c]
add ebp, 0x6c
mov esp, ebp
pop ebp
ret
Function at 0x402a60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0041bef0
push 0x5c
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00401850
mov edx, dword [ebp - 8]
mov dword [0x436508], edx
mov dword [0x436510], 0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x402d30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x43650c], eax
cmp dword [0x43650c], 0
je 0x402ae2
cmp dword [0x436538], 2
je 0x402ad3
call fcn.0040b500
push 0xffffffffffffffff
mov edx, dword [0x43650c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0x4365f4], 0
cmp dword [0x436510], 0
je 0x402b66
mov eax, dword [0x436510]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x69
ja case.0x402b16.3
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + 0x402c24]
jmp dword [eax*4 + 0x402c10]
push 0x11
push 0
call fcn.0040d110
add esp, 8
jmp 0x402b5c
push 0x12
push 0
call fcn.0040d110
add esp, 8
jmp 0x402b5c
push 0x13
push 0
call fcn.0040d110
add esp, 8
jmp 0x402b5c
jmp 0x402b5c
mov ecx, dword [0x436510]
push ecx
push 0x14
push 0
call fcn.0040d110
add esp, 0xc
mov eax, 0x80004005
jmp 0x402c08
mov dword [ebp - 4], 0
cmp dword [0x4365f8], 0
jne 0x402bff
cmp dword [0x43650c], 0
je 0x402b9d
lea edx, [ebp - 4]
push edx
mov eax, dword [0x43650c]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x402b9d
cmp dword [ebp - 4], 0
je 0x402bfd
mov ecx, dword [ebp - 4]
and ecx, 0x80070000
cmp ecx, 0x80070000
je 0x402bc0
mov edx, dword [ebp - 4]
push edx
push 0x21
push 0
call fcn.0040d110
add esp, 0xc
jmp 0x402bf6
mov eax, dword [ebp - 4]
and eax, 0xffff
cmp eax, 0xe
jne 0x402bd6
cmp dword [0x43653c], 0xffffffff
je 0x402bf6
mov ecx, dword [ebp - 4]
and ecx, 0xffff
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [ebp - 4]
push edx
push 0x22
push 1
call fcn.0040d110
add esp, 0xc
mov eax, 0x80004005
jmp 0x402c08
jmp 0x402c06
mov eax, 0x80004005
jmp 0x402c08
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x403a80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x431874
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
call fcn.0041bc40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x403ad0
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00404ff0
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.004066f0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x403af0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x431874
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
jne 0x403b14
mov dword [ebp - 8], 1
jmp 0x403b1b
mov dword [ebp - 8], 0
movzx edx, byte [ebp - 8]
test edx, edx
jne 0x403b36
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0042eaf0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4048b0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea ecx, [ebp - 0x28]
call fcn.0041bc40
push 2
lea ecx, [ebp - 0x28]
call fcn.00404ff0
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
xor eax, eax
shl eax, 1
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov word [eax + ecx], dx
cmp dword [ebp - 8], 0
jbe 0x404913
mov eax, dword [ebp - 8]
add eax, 1
push eax
lea ecx, [ebp - 0x28]
call fcn.00404ff0
push eax
mov ecx, dword [ebp - 8]
add ecx, 1
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x28]
call fcn.004066f0
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
jmp 0x404931
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0xfff
jge 0x404988
mov edx, dword [ebp - 0xc]
add edx, 0xf
push edx
lea ecx, [ebp - 0x28]
call fcn.00404ff0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
lea ecx, [eax + edx*2]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.004066f0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x404986
jmp 0x404988
jmp 0x404928
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041bb70
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0042eaf0
add esp, 4
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x404a60
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
call fcn.0041bbd0
push 0x4318d4
lea ecx, [ebp - 0xc]
call fcn.0041c280
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x294]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x404ba9
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0xc]
call fcn.0041bef0
push 0x5c
lea ecx, [ebp - 0xc]
call fcn.00401850
lea edx, [ebp - 0x268]
push edx
lea ecx, [ebp - 0xc]
call fcn.0041c280
mov eax, dword [ebp - 0x294]
and eax, 0x10
je 0x404b3b
push 0x4318dc
lea ecx, [ebp - 0x268]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x404b39
push 0x4318e0
lea edx, [ebp - 0x268]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x404b39
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00404a60
add esp, 4
test eax, eax
jne 0x404b39
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0042eaf0
add esp, 4
mov eax, dword [ebp - 0x20]
jmp 0x404c14
jmp 0x404b86
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x24], ecx
push 0
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x404b65
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x404b86
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0042eaf0
add esp, 4
mov eax, dword [ebp - 0x30]
jmp 0x404c14
lea ecx, [ebp - 0x294]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404aa6
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [0x43655c]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x404bda
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x404bf8
mov dword [ebp - 0x3c], 0
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
push eax
call fcn.0042eaf0
add esp, 4
mov eax, dword [ebp - 0x3c]
jmp 0x404c14
mov dword [ebp - 0x44], 1
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x40]
push edx
call fcn.0042eaf0
add esp, 4
mov eax, dword [ebp - 0x44]
mov esp, ebp
pop ebp
ret
Function at 0x404c20
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
lea eax, [ebp - 0x254]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x404c4a
mov eax, 1
jmp 0x404c8b
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x254]
and eax, 0x10
jne 0x404c7f
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x404c7b
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x404c8b
xor eax, eax
jmp 0x404c8b
mov eax, dword [ebp + 8]
push eax
call fcn.00404a60
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x404d50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea ecx, [ebp - 0x20]
call fcn.0041bc40
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
push 1
push 1
lea ecx, [ebp - 0x20]
call fcn.00404ff0
push eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x404d9a
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0042eaf0
add esp, 4
jmp 0x404de9
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
add ecx, 1
push ecx
mov edx, dword [ebp - 4]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.00404ff0
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x20]
call fcn.004066f0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041be30
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.0042eaf0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x405e80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea ecx, [ebp - 0x14]
call fcn.0041bc40
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x405ed4
mov ecx, dword [ebp - 4]
add ecx, 1
push ecx
mov edx, dword [ebp - 4]
add edx, 1
push edx
lea ecx, [ebp - 0x14]
call fcn.00404ff0
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
xor eax, eax
mov ecx, dword [ebp - 4]
mov word [edx + ecx*2], ax
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041bb70
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0042eaf0
add esp, 4
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x406240
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 1
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x18]
call fcn.0041bc40
mov edx, dword [ebp - 4]
add edx, 2
push edx
lea ecx, [ebp - 0x18]
call fcn.00404ff0
mov eax, dword [ebp - 4]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
add ecx, 2
push ecx
lea ecx, [ebp - 0x18]
call fcn.00404ff0
push eax
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x18]
call fcn.004066f0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041bb70
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0042eaf0
add esp, 4
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x406f20
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x406f7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb7
je 0x406f56
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x406f84
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x406f7f
mov eax, dword [ebp - 8]
and eax, 0x10
jne 0x406f7f
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x406f84
mov eax, 1
mov esp, ebp
pop ebp
ret