joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402fb0
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push 0x4358c8
push str.MacDialog
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x403010
lea eax, [esp + 4]
push eax
push esi
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 4]
test eax, eax
je 0x403010
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 4]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x403010
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ecx
ret

Function at 0x403350
Capabilities:
Get file version info

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
push esi
push edi
je 0x403363
mov dword [ebp], 0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x403371
mov dword [eax], 0
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x14]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x4033dc
push ebx
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4033d4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x4356d4
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4033d4
test ebp, ebp
mov eax, dword [esp + 0x1c]
je 0x4033c7
mov ecx, dword [eax + 8]
mov dword [ebp], ecx
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x4033d4
mov edx, dword [eax + 0xc]
mov dword [ecx], edx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
Function at 0x4033f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push ebx
lea eax, [esp + 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x4352c8
push 0x80000002
mov dword [esp + 0x18], ebx
call fcn.004051f0
add esp, 0x14
test eax, eax
jne 0x4034d2
mov edx, dword [esp + 4]
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x4034c7
mov eax, dword [esp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x20]
push ecx
dec eax
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
push eax
call esi
test eax, eax
jne 0x4034c6
cmp dword [esp + 0x10], ebx
jbe 0x403494
push 0x1b
lea ecx, [esp + 0x18]
push str.QuickTime_Update_Completion
push ecx
call fcn.00431af2
add esp, 0xc
test eax, eax
je 0x4034c1
mov eax, dword [esp + 0xc]
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
dec eax
push ecx
push eax
push edx
mov dword [esp + 0x30], 0x104
mov dword [esp + 0x2c], eax
call esi
test eax, eax
je 0x403476
jmp 0x4034c6
mov ebx, 1
pop esi
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
add esp, 0x110
ret

Function at 0x403560
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareApple_Computer__Inc.QuickTime
push 0x80000002
mov dword [esp + 0x18], 0
mov byte [esi], 0
call fcn.004051f0
add esp, 0x14
test eax, eax
jne 0x4035d3
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push esi
push eax
push eax
mov eax, dword [esp + 0x14]
push str.InstallDir
push eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4035c8
push eax
push esi
call fcn.004256b8
add esp, 8
test eax, eax
je 0x4035c8
mov byte [esi], 0
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esi], 0
je 0x403613
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4035e0
sub eax, edx
mov al, byte [eax + esi - 1]
cmp al, 0x5c
je 0x403613
cmp al, 0x2f
je 0x403613
push edi
mov edi, esi
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403600
mov dx, word [0x4356d4]
mov word [edi], dx
pop edi
mov cl, byte [esi]
xor eax, eax
test cl, cl
setne al
pop esi
pop ecx
ret
Function at 0x4038e0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
push esi
lea eax, [esp + 4]
push 0x104
push eax
mov esi, ecx
call fcn.00403560
add esp, 8
cmp eax, 1
jne 0x40393d
push str.PictureViewer.exe
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x110]
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esi + 4]
add esp, 0x10
push 1
push 0
push 0
lea eax, [esp + 0x114]
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop esi
add esp, 0x208
ret

Function at 0x403950
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
push esi
lea eax, [esp + 4]
push 0x104
push eax
mov esi, ecx
call fcn.00403560
add esp, 8
cmp eax, 1
jne 0x4039ad
push str.QTInfo.exe
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x110]
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esi + 4]
add esp, 0x10
push 1
push 0
push 0
lea eax, [esp + 0x114]
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop esi
add esp, 0x208
ret
Function at 0x404bc0
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x484]
mov eax, 1
cmp ecx, eax
jne 0x404c51
cmp dword [esi + 8], 0x4000000
jl 0x404c13
push 0
mov ecx, esi
call fcn.00404970
cmp dword [esi + 8], 0x4100000
jge 0x404bf4
mov ecx, esi
call fcn.00402fb0
push 0x73617373
call fcn.00417ec0
mov eax, dword [esi + 8]
add esp, 4
cmp eax, 0x5500000
jge 0x404c51
mov ecx, esi
pop esi
jmp fcn.004047b0
cmp dword [esi + 0x478], eax
jne 0x404c49
call fcn.004041e0
test eax, eax
jne 0x404c51
push 0x10000000
call fcn.00407d30
add esp, 4
test ax, ax
jne 0x404c51
push 0x73617373
call fcn.00417ec0
add esp, 4
pop esi
jmp fcn.00407e30
mov ecx, esi
pop esi
jmp fcn.00402e70
pop esi
ret

Function at 0x405290
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
mov ebx, dword [esp + 0x118]
push esi
xor esi, esi
test ebx, ebx
mov dword [esp + 8], 0
je 0x40534b
push ebp
mov ebp, dword [esp + 0x124]
lea eax, [esp + 0xc]
push eax
push 0x2001f
push esi
push ebp
push ebx
call fcn.004051f0
add esp, 0x14
test eax, eax
jne 0x405356
mov edx, dword [esp + 0xc]
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea ecx, [esp + 0x2c]
push ecx
push eax
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40532e
mov esi, dword [esp + 0x10]
dec esi
js 0x40532e
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ecx, dword [esp + 0x10]
push 0x105
lea eax, [esp + 0x1c]
push eax
push esi
push ecx
call edi
test eax, eax
jne 0x40532a
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
call fcn.00405290
add esp, 8
dec esi
jns 0x405302
pop edi
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop ebp
pop esi
pop ebx
add esp, 0x110
ret
mov eax, esi
pop esi
pop ebx
add esp, 0x110
ret
pop ebp
mov eax, esi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x4054f0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
mov ebx, dword [esp + 0x118]
push esi
xor esi, esi
test ebx, ebx
mov dword [esp + 8], 0
je 0x4055ab
push ebp
mov ebp, dword [esp + 0x124]
lea eax, [esp + 0xc]
push eax
push 0x2001f
push esi
push ebp
push ebx
call fcn.00405450
add esp, 0x14
test eax, eax
jne 0x4055b6
mov edx, dword [esp + 0xc]
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea ecx, [esp + 0x2c]
push ecx
push eax
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40558e
mov esi, dword [esp + 0x10]
dec esi
js 0x40558e
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ecx, dword [esp + 0x10]
push 0x105
lea eax, [esp + 0x1c]
push eax
push esi
push ecx
call edi
test eax, eax
jne 0x40558a
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
call fcn.004054f0
add esp, 8
dec esi
jns 0x405562
pop edi
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop ebp
pop esi
pop ebx
add esp, 0x110
ret
mov eax, esi
pop esi
pop ebx
add esp, 0x110
ret
pop ebp
mov eax, esi
pop esi
pop ebx
add esp, 0x110
ret

Function at 0x407341
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor ebp, ebp
push edi
push esi
push ebx
sub esp, 0x10
mov dword [esp], edx
mov edx, dword [eax + 0x3c]
mov edi, dword [eax + edx + 0x78]
add edi, eax
mov edx, edi
mov edi, dword [edi + 0x1c]
mov dword [esp + 8], edi
mov edi, dword [edx + 0x24]
mov dword [esp + 0xc], edi
mov edi, dword [edx + 0x20]
add edi, eax
mov dword [esp + 4], edi
mov edi, dword [esp + 4]
mov esi, dword [edi + ebp*4]
add esi, eax
cmp byte [esi], 0
je 0x4073c1
lea esi, [esi]
xor edi, edi
add edi, 1
cmp byte [esi + edi], 0
jne 0x407383
add edi, esi
xor edx, edx
nop
mov ebx, dword [ecx + 0x84]
add esi, 1
imul edx, ebx
movsx bx, byte [esi - 1]
movzx ebx, bx
add edx, ebx
cmp edi, esi
jne 0x407391
cmp dword [esp], edx
je 0x4073c8
mov edi, dword [esp + 4]
add ebp, 1
mov esi, dword [edi + ebp*4]
add esi, eax
cmp byte [esi], 0
jne 0x407381
xor edx, edx
cmp dword [esp], edx
jne 0x4073b0
mov ecx, dword [esp + 0xc]
lea edx, [eax + ebp*2]
movzx edx, word [edx + ecx]
mov ecx, dword [esp + 8]
lea edx, [eax + edx*4]
add eax, dword [edx + ecx]
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x418a1a
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0x6d
sbb ah, byte [ebx + 0x32]
xor dword [ecx], esi
jns 0x4189dd

Function at 0x431171
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], esi
mov ebx, 0x3131e9b7
xor dword [ebp + 0x7946a6f1], esi

Function at 0x43177a
Capabilities:
Encode data using xor

Disassembly:
int1
inc eax
mov ch, 0xbb
jns 0x4316ba
jne 0x431757
push ecx
jge 0x4316c1
hlt
xor dword [esi + 0x7949a5f1], esi
mov esp, 0xcdbe7df8
push ebp
mov esp, 0xbc7a418c
mov esi, 0x3b4bcf46
xor dword [ecx - 0x42], edi
jge 0x43178f
cdq
sbb ecx, eax
invalid
out dx, eax
cmp eax, 0x7dbe7931
push ebp
cdq
sbb esp, esp
lds edi, [ecx]
xor ebp, edi
jns 0x431712
mov esi, 0x3b4bac46
xor dword [ecx - 0x42], edi
inc esi
lodsb al, byte [esi]
dec ebx
cmp esi, dword [ecx]
jns 0x431719
jge 0x4317b2
sbb dword [ecx], 0x3030fe9e
jns 0x431723
inc esi
out dx, eax
cmp eax, 0x7dbe7931
push ebp
sbb dword [ecx], 0x3139c5c1
std
std
std
std
jno 0x4316fe
jns 0x431730
sbb eax, 0x36bc7981
push 0x79313eb1
cmc
jns 0x431744
jne 0x4317e1
jns 0x431807
mov esp, 0x85ba790b
push ebp
push ecx
or edi, dword [ecx - 0x46]
test dword [ebp + 0x51], edx
jp 0x431753
inc ecx
int1
jns 0x431756
jne 0x4317f3
mov esp, 0x1959557d
mov edi, ebp
mov dl, 0x1d
mov cl, 0x31
xor dword [ecx], esi
Function at 0x43540b
Capabilities:
Encode data using xor

Disassembly:
int1
xor bh, byte [ecx - 0x44]
idiv dword [ecx - 0x44]
cdq
jns 0x435301
movsd dword es:[edi], dword [esi]
push ebp
xor byte [eax], dh
std
std
std
jno 0x4352ec
test byte [edi + 0x79877288], al
mov esi, 0x79fa559d
mov dl, 0x1d
adc dword [ecx], esi
xor dword [ecx], esi
jns 0x435335
xor dword [ecx], esi
xor dword [ecx - 0x44], edi
outsd dx, dword ss:[esi]
jne 0x4353bb
xor dword [ecx + 0x64], edi
cmc
jns 0x43533d
jbe 0x4353dd
pop eax
jp 0x435343
and dword [ebp - 0x44], edi
and edi, dword [ecx - 0x46]
test dword [ebp + 0x51], edx
mov edx, 0x79515585
mov esi, 0xbc793886
push ecx
jns 0x435350
xchg byte [eax], bh
jns 0x435352
cmp bl, byte [ecx]
adc dword [eax + 0x37], esp
xor dword [ecx - 0x44], edi
sub dword [ecx - 0x42], edi
jns 0x43535f
ja 0x4353b2
cmp dh, byte [ecx]
jns 0x435362
xor dword [ecx - 0x46], edi
jne 0x4353ff
push ecx
jns 0x4353a5
clc
jne 0x435404
pop ecx
cmp dh, byte [ecx]
xor dword [ecx], esi
xor dword [ecx - 0x42], edi
xor dword [ecx], esi
jns 0x435374
test dword [ebp + 0x51], edx
push ecx
sbb dword [edi + 0x793030c8], ebp
enter 0x3030, 0x79
mov esp, 0x7bc7909
or dword [ecx - 0x44], edi
pop es
jns 0x435384
jle 0x4353e0
sbb byte [ecx], bl
jo 0x4353e5
sbb dword [eax + 0x1a], esi
xor byte [eax], dh
sar dword [ebp - 0x44], 0xf4
jns 0x43538f
jge 0x43538c
hlt
add dword [ecx - 0x42], edi
jle 0x4353d0
sbb dword [ebx + 0x7dc13030], ebp
mov esp, 0x1bc79f8
jns 0x4353a4
sar dword [ebp - 0x44], 0xf8
clc
jns 0x43539f
add dword [ecx - 0x42], edi
mov esi, 0x6419d87e
push ds
xor byte [eax], dh
sar dword [ebp - 0x44], 0xf1
jle 0x4353c0
sbb dword [esi + ebx + 0x30], esp
xor cl, al
jge 0x4353ac
int1
jns 0x4353b1
xchg byte [eax + 0x30f37f19], bh
xor byte [ecx - 0x4c], bh
xor byte [eax], dh
jns 0x4353b0
test eax, 0x34a34149
jns 0x4353bf
mov dword [0x31bc7934], eax
xor al, 0x79
mov esp, 0x3ebe7931
cli
xor dword [ecx - 0x42], edi
jns 0x4353c4
cli
and eax, 0xba7a3139
jp 0x4353c7
aas
jp 0x4353ce
xchg dword [ecx], edi
inc eax
mov cl, dh
inc eax
inc edx
xor edi, dword [ecx - 0x46]
jne 0x435471
push ecx
div dword [ebp + 0x55]
pop ecx
xor ah, byte [ecx + esi*8 - 0x46]
jbe 0x4353d8
int1
mov edx, 0xba97b176
jbe 0x4353e0
xchg edi, eax
mov edx, 0x76b9b576
mov bh, 0x79
mov esi, 0x1951557d
jno 0x4353b8
mov ecx, 0xbe79b776
jge 0x435487
push ecx
sbb dword [ecx - 0x7e], esi
cmp dword [ecx], esi
jns 0x4353f8
push cs
sub edi, dword [ecx]
xor dword [edx - 0x46], edi
aaa
jns 0x435400
mov edx, 0x86bc7937
sar byte [ecx - 0x4c], 1
xchg al, dl
jns 0x4353fc
sub eax, dword [ecx - 0x5d]
cmp eax, 0x79f33079
mov esp, 0x1d19b87e
sal byte [eax], 0x30
or al, 0x79
xor byte [esp + ecx + 0x79], ah
mov edx, 0xf879c88e
jbe 0x435432
inc eax
xor dword [ecx], esi
xor dword [ecx - 0x43864772], edi
xchg al, dh
jns 0x435423
sub edi, dword [ecx]
mov dword [0x45be7942], eax
xchg byte [ebx], dh
xor dword [ecx], esi
xor dword [ecx - 0x44], edi
jle 0x435457
sbb ecx, esi
sal byte [eax], 0x30
jns 0x435440
mov gs, eax
invalid
call 0x31748d7c
xor dword [ecx - 0x46], edi
scasb al, byte es:[edi]
invalid
Function at 0x40141e
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x110
lea eax, [esp]
push ebp
push esi
mov esi, dword [esp + 0x124]
push edi
mov edi, dword [esp + 0x128]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or eax, 9
push eax
push dword [esp + 0x12c]
push dword [esp + 0x12c]
call fcn.004060e0
test eax, eax
jne 0x401527
xor ebp, ebp
test byte [esp + 0x128], 2
je 0x401493
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebp
push eax
lea eax, [esp + 0x28]
push eax
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x401503
push 0x105
lea eax, [esp + 0x18]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
jmp 0x4014ce
test edi, edi
jne 0x401503
push dword [esp + 0x128]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call fcn.0040141e
test eax, eax
jne 0x4014d8
push 0x105
lea eax, [esp + 0x18]
push eax
push edi
push dword [esp + 0x18]
call ebp
test eax, eax
je 0x4014a6
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.0040667b
test eax, eax
jne 0x401514
push dword [esp + 0x124]
push dword [esp + 0x124]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x401527
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x401527
push 0
push esi
push dword [esp + 0x12c]
push dword [esp + 0x12c]
call eax
pop edi
pop esi
pop ebp
add esp, 0x110
ret 0xc
Function at 0x4030d6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
test ecx, ecx
js 0x4030ff
mov eax, dword [0x424438]
push edi
add eax, ecx
push edi
push eax
push dword [0x40a014]
mov dword [0x40b50c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.00402f57
test eax, eax
js 0x4031d5
push ebx
push esi
push 4
lea eax, [ebp + 8]
push eax
push dword [0x40a014]
call fcn.004066dd
test eax, eax
je 0x4031d0
push dword [ebp + 8]
add dword [0x40b50c], 4
call fcn.00402f57
mov esi, eax
test esi, esi
js 0x4031cc
cmp dword [ebp + 0x10], edi
jne 0x4031a0
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x4031cc
mov ebx, 0x4000
mov edi, 0x4135b0
cmp ecx, ebx
mov eax, ebx
cmovl eax, ecx
push eax
push edi
push dword [0x40a014]
mov dword [ebp - 4], eax
call fcn.004066dd
test eax, eax
je 0x4031d0
push dword [ebp - 4]
push edi
push dword [ebp + 0xc]
call fcn.0040679c
test eax, eax
je 0x40319c
mov eax, dword [ebp - 4]
add esi, eax
mov ecx, dword [ebp + 8]
add dword [0x40b50c], eax
sub ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
jg 0x403158
jmp 0x4031cc
push 0xfffffffffffffffe
jmp 0x4031d2
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 8], eax
cmovl eax, dword [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4031d0
mov esi, dword [ebp - 4]
add dword [0x40b50c], esi
mov eax, esi
jmp 0x4031d3
push 0xfffffffffffffffd
pop eax
pop esi
pop ebx
pop edi
leave
ret 0x10

Function at 0x4031f8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp dword [ebp + 8], 0
je 0x40321d
mov eax, dword [0x40b520]
test eax, eax
je 0x403214
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40b520], 0
leave
ret
cmp dword [0x40b520], 0
je 0x40322f
push 0
call fcn.0040604d
leave
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x4243e0]
jbe 0x403299
cmp dword [0x423bd8], 0
je 0x403274
test byte [0x4244d4], 1
je 0x403299
call fcn.004031da
push eax
lea eax, [ebp - 0x40]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
push 0
call fcn.00405b2f
leave
ret
push 0
push 0x403553
push 0
push 0x6f
push dword [0x423bd4]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0x40b520], eax
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret
Function at 0x405c57
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x405c71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4

Function at 0x405c77
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
push 4
pop eax
mov word [ebp - 0x1e], ax
mov eax, 0x408568
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov word [ebp - 0x20], 1
mov dword [ebp - 0x10], 0x408558
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x405ce5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405cef
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
je 0x405ce9
xor eax, eax
jmp 0x405cef
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret 4
Function at 0x405fe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
lea eax, [ebp - 0x120]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
ja 0x40601a
test eax, eax
je 0x40601a
lea eax, [ebp + eax - 0x120]
cmp byte [eax - 1], 0x5c
je 0x406020
mov ecx, 0x4082a0
jmp 0x406025
lea eax, [ebp - 0x120]
mov ecx, 0x4082a1
push dword [ebp + 8]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x40607b
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x40609e
push dword [esp + 8]
push dword [esp + 8]
call fcn.0040610e
pop ecx
pop ecx
inc dword [0x4244b0]
ret 8

Function at 0x40610e
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, 0x400
mov dword [0x422a38], 0x4c554e
mov ebp, 0x422a38
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test esi, esi
je 0x40615a
push 1
push 0
push esi
call fcn.004066b0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x40623a
cmp eax, ebx
jg 0x40623a
push ebx
mov esi, 0x422638
push esi
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x40623a
cmp eax, ebx
jg 0x40623a
push esi
push ebp
push str._s_s_r_n
push 0x422238
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x4243f0]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.00405cf3
push 4
push 0xc0000000
push esi
call fcn.004066b0
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40623a
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebp + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x406233
push esi
push edi
push ebx
call fcn.004066dd
test eax, eax
je 0x406233
push str._Rename__r_n
push edi
call fcn.004068bc
test eax, eax
jne 0x40623f
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x422238
lea eax, [ecx + edi]
push eax
call fcn.0040642e
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.0040679c
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x40872c
add eax, 0xa
push eax
call fcn.004068bc
mov ecx, eax
test ecx, ecx
je 0x406204
lea edx, [edi + esi]
jmp 0x40625e
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x406258
sub ecx, edi
inc ecx
jmp 0x406206
Function at 0x406309
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00406923
mov edi, eax
cmp edi, 0xffffffff
je 0x40634c
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x40632d
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x406333
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40633c
xor eax, eax
inc eax
jmp 0x40634e
test byte [ebp + 0xc], 4
jne 0x40634c
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x4063b7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x421e38
push ebx
call fcn.004068a0
push ebx
call fcn.0040694b
mov esi, eax
test esi, esi
je 0x406427
push esi
call fcn.00406a83
test byte [0x4243ec], 0x80
je 0x4063ed
mov al, byte [esi]
test al, al
je 0x406427
cmp al, 0x5c
je 0x406427
sub esi, ebx
jmp 0x406405
call fcn.00406353
test eax, eax
je 0x4063ff
test byte [eax], 0x10
je 0x406427
push ebx
call fcn.00406a58
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
cmp eax, esi
jg 0x4063f1
call fcn.004062dc
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406427
xor eax, eax
inc eax
jmp 0x406429
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x406450
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x4219f0], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x4219f0
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40648f
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4