joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ab0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push edi
mov dword [ebp - 4], 0
mov byte [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp + 0xc], 0
jne 0x401b1c
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00401bd0
add esp, 8
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x401b13
jmp 0x401bc3
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00401bf0
add esp, 4
mov byte [ebp - 0x310], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x30f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp + 8], 0
je 0x401b53
mov dword [ebp - 0x318], str.Global_
jmp 0x401b5d
mov dword [ebp - 0x318], 0x4175dc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x318]
push edx
push str._sPhenix__s
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x310]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0
je 0x401bb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401bb9
mov dword [ebp - 4], 1
xor edx, edx
test edx, edx
jne 0x401ada
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x402059
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
push edi
mov byte [ebp - 0x800], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x7ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.___dump_memory_leaks_start________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x808]
push eax
mov ecx, 0x4175e0
call fcn.00402200
push eax
lea ecx, [ebp - 0x804]
call fcn.00402340
jmp 0x4020ba
push 0
lea ecx, [ebp - 0x80c]
push ecx
lea ecx, [ebp - 0x804]
call fcn.00402380
lea edx, [ebp - 0x810]
push edx
mov ecx, 0x4175e0
call fcn.00402230
push eax
lea ecx, [ebp - 0x804]
call fcn.004023b0
and eax, 0xff
test eax, eax
je 0x402142
lea ecx, [ebp - 0x804]
call fcn.00402360
mov eax, dword [eax]
mov ecx, dword [eax + 0x108]
push ecx
lea ecx, [ebp - 0x804]
call fcn.00402360
mov edx, dword [eax]
mov eax, dword [edx + 0x104]
push eax
lea ecx, [ebp - 0x804]
call fcn.00402360
mov ecx, dword [eax]
push ecx
push str.__s__d___threadid:__d__n
push 0x7ff
lea edx, [ebp - 0x800]
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x18
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4020a6
push str.___dump_memory_leaks_end__________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40287b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4132fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x118], 0
cmp dword [ebp + 8], 0
je 0x4028b6
cmp dword [ebp + 0xc], 0
jne 0x4028ba
xor eax, eax
jmp 0x402934
push 0x104
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x4028f1
cmp dword [ebp - 0x118], 0x104
jbe 0x4028f5
xor eax, eax
jmp 0x402934
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x128]
call fcn.00403c50
mov dword [ebp - 4], 0
lea edx, [ebp - 0x128]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00403bf0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x128]
call fcn.00403c80
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x402bcf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413358
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push edi
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x7c], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x78]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x38], ecx
lea edx, [ebp - 0x7c]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x7c], 0x44
cmp dword [ebp + 8], 0
jne 0x402c4b
cmp dword [ebp + 0x14], 0
je 0x402c3e
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x57
xor ecx, ecx
test ecx, ecx
jne 0x402c2f
xor eax, eax
jmp 0x402d6a
cmp dword [ebp + 0x10], 0
je 0x402c57
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x38], edx
cmp dword [ebp + 0xc], 0
je 0x402c63
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0x20
xor ecx, ecx
test ecx, ecx
jne 0x402c8a
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x2c]
and eax, 1
cmp eax, 1
jne 0x402c8a
mov ecx, dword [ebp - 0x34]
or ecx, 0x8000000
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x2c]
call fcn.00403c30
mov dword [ebp - 4], 0
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402942
add esp, 8
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x30]
push edx
push 0
push 0
mov eax, dword [ebp - 0x34]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402d34
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x88]
cmp dword [eax + 4], 0
je 0x402d0b
mov ecx, dword [ebp - 0x88]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x88]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x88]
mov edx, dword [ebp - 0x38]
mov eax, dword [edx]
mov dword [ecx + 4], eax
mov dword [ebp - 0x80], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403c80
mov eax, dword [ebp - 0x80]
jmp 0x402d6a
cmp dword [ebp + 0x14], 0
je 0x402d45
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
xor edx, edx
test edx, edx
jne 0x402d34
mov dword [ebp - 0x84], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403c80
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402d7b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
push 0xc5
push 0x41672c
push 0x28
call fcn.0040101e
add esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x402dc8
cmp dword [ebp + 0xc], 0
je 0x402dbd
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 8
xor edx, edx
test edx, edx
jne 0x402dae
jmp 0x402e72
mov eax, dword [ebp - 8]
add eax, 4
push eax
push str.SeAssignPrimaryTokenPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402dea
jmp 0x402e72
mov ecx, dword [ebp - 8]
add ecx, 0x10
push ecx
push str.SeIncreaseQuotaPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402e09
jmp 0x402e72
mov edx, dword [ebp - 8]
add edx, 0x1c
push edx
push str.SeImpersonatePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402e28
jmp 0x402e72
mov eax, dword [ebp - 8]
mov dword [eax], 3
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], 2
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], 2
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], 2
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [ebp - 4], eax
xor eax, eax
test eax, eax
jne 0x402d8b
cmp dword [ebp - 4], 0
jne 0x402e9a
cmp dword [ebp + 0xc], 0
je 0x402e89
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor edx, edx
test edx, edx
jne 0x402e78
push str.AjustToken_Error_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 8], 0
je 0x402eb2
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00401019
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x404435
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x404451
mov eax, 1
jmp 0x404570
mov dword [ebp - 4], 0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 8], 0
jne 0x404477
jmp 0x404547
push str.NtQuerySystemInformation
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
jne 0x40449d
jmp 0x404547
push str.NtQueryInformationProcess
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x10], 0
jne 0x4044c3
jmp 0x404547
push str.RtlCreateQueryDebugBuffer
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x4044e6
jmp 0x404547
push str.RtlQueryProcessDebugInformation
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x14], 0
jne 0x404509
jmp 0x404547
push str.RtlDestroyQueryDebugBuffer
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x1c], 0
jne 0x40452c
jmp 0x404547
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 1
xor edx, edx
test edx, edx
jne 0x404458
cmp dword [ebp - 4], 0
jne 0x40456d
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
je 0x40456d
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x404ab9
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x404af1
jmp 0x404b58
mov dword [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x14]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x404b1f
jmp 0x404b58
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x404b4e
jmp 0x404b58
xor edx, edx
test edx, edx
jne 0x404ad0
cmp dword [ebp - 4], 0
jne 0x404b75
cmp dword [ebp + 8], 0
je 0x404b6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor edx, edx
test edx, edx
jne 0x404b5e
cmp dword [ebp - 8], 0
je 0x404b85
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x407a82
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x407aa3
xor eax, eax
jmp 0x407b92
mov edx, dword [ebp - 0x30]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x407ac6
xor eax, eax
jmp 0x407b92
cmp dword [ebp - 4], 0
jne 0x407ad3
xor eax, eax
jmp 0x407b92
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
jmp 0x407b1c
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
add eax, 0x28
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 6]
cmp dword [ebp - 0x14], edx
jae 0x407b90
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [edx + 0x10]
cmp ecx, dword [eax + 8]
jbe 0x407b4c
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x40], eax
jmp 0x407b55
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x3c]
jb 0x407b8b
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x38]
ja 0x407b8b
mov eax, dword [ebp - 0x14]
add eax, 1
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov eax, 1
jmp 0x407b92
jmp 0x407b0a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40a5c5
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4135fa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x42c
push edi
mov dword [ebp - 0x10], 0
push 0x417830
lea ecx, [ebp - 0x428]
call fcn.00403c50
mov dword [ebp - 4], 0
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp + 8]
call fcn.00403bf0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.00403c80
mov dword [ebp - 0x418], 0x400
mov byte [ebp - 0x410], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x40f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x410]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x40a674
cmp dword [ebp - 0x418], 0
jne 0x40a68d
cmp dword [ebp + 0xc], 0
je 0x40a685
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor edx, edx
test edx, edx
jne 0x40a674
jmp 0x40a6d8
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x438]
call fcn.00403c50
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x438]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403bf0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x438]
call fcn.00403c80
mov dword [ebp - 0x10], 1
xor edx, edx
test edx, edx
jne 0x40a623
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40b3cc
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push edi
mov dword [ebp - 0x148], 0xffffffff
mov byte [ebp - 0x24c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x24b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4171c8
lea edx, [ebp - 0x24c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xffffffff
jne 0x40b464
cmp dword [ebp + 0x14], 0
je 0x40b457
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
xor eax, eax
test eax, eax
jne 0x40b446
xor eax, eax
jmp 0x40b563
push 0x4171cc
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40b490
push 0x4171d0
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40b492
jmp 0x40b4fb
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_s
lea edx, [ebp - 0x24c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x144]
push edx
call fcn.0040b328
add esp, 0xc
mov eax, dword [ebp - 0x144]
and eax, 0x10
cmp eax, 0x10
jne 0x40b4fb
cmp dword [ebp + 0x10], 0
je 0x40b4fb
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x24c]
push ecx
call fcn.0040b3cc
add esp, 0x10
lea edx, [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b464
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x40b540
cmp dword [ebp + 0x14], 0
je 0x40b533
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
xor edx, edx
test edx, edx
jne 0x40b522
mov dword [ebp - 4], 0
cmp dword [ebp - 0x148], 0xffffffff
je 0x40b560
mov eax, dword [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x148], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40cd00
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp dword [eax], 0xffffffff
setne cl
push ecx
call fcn.0040c85f
add esp, 8
mov esp, ebp
pop ebp
ret 8
Function at 0x40cd8a
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040c85f
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x40cdee
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 1
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0040c85f
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x40ce29
Capabilities:
Delete directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 1
push 0x90
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0040c85f
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x401f90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x260
mov eax, dword [0x46b3ac]
push esi
mov esi, ecx
mov dword [esp + 0x260], eax
cmp dword [esi], 0
je 0x401fc5
mov eax, 1
pop esi
mov ecx, dword [esp + 0x25c]
call fcn.00431288
add esp, 0x260
ret 4
mov eax, dword [esi + 4]
test eax, eax
jne 0x401fe4
xor eax, eax
pop esi
mov ecx, dword [esp + 0x25c]
call fcn.00431288
add esp, 0x260
ret 4
push edi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x26c]
mov dword [esp + 8], eax
push ecx
mov dword [esp + 0x10], eax
lea edx, [esp + 0x60]
mov dword [esp + 0x14], eax
push 0x456ed0
push edx
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x20], eax
call fcn.00431794
add esp, 0xc
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x7c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4020a0
mov eax, dword [esp + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esp + 8]
push edx
call edi
push 0
mov dword [esi], 1
mov ecx, dword [0x46c488]
push 0x456ebc
call fcn.0040cc00
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x25c]
call fcn.00431288
add esp, 0x260
ret 4
mov ecx, dword [esp + 0x264]
pop edi
xor eax, eax
pop esi
call fcn.00431288
add esp, 0x260
ret 4