joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402540
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0xa60
mov eax, dword [0x43217c]
xor eax, esp
mov dword [esp + 0xa58], eax
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x4026a4
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402566
sub eax, edx
sar eax, 1
je 0x4026a4
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4026a4
push 0x800
lea eax, [esp + 0x264]
push 0
push eax
call fcn.00409180
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4025a6
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 - 2], 0x5c
push esi
jne 0x4025d2
push 0x42a328
push 0x400
lea ecx, [esp + 0x26c]
push ecx
jmp 0x4025e4
push 0x429de4
push 0x400
lea edx, [esp + 0x26c]
push edx
call fcn.004083b0
add esp, 0x10
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4026a4
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov bl, 1
lea edx, [esp + 0x3c]
push 0x42a334
push edx
call fcn.004081b2
add esp, 8
test eax, eax
je 0x402654
lea eax, [esp + 0x3c]
push 0x42a338
push eax
call fcn.004081b2
add esp, 8
test eax, eax
je 0x402654
lea ecx, [esp + 0x3c]
push str.Desktop.ini
push ecx
call fcn.004081b2
add esp, 8
test eax, eax
jne 0x402681
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x402612
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa58]
xor ecx, esp
call fcn.0040800b
add esp, 0xa60
ret
push esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa58]
xor ecx, esp
call fcn.0040800b
add esp, 0xa60
ret
mov ecx, dword [esp + 0xa64]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.0040800b
add esp, 0xa60
ret
Function at 0x402850
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427840
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x43217c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
cmp ebx, edi
je 0x40292d
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402895
sub eax, edx
sar eax, 1
je 0x40292d
push edi
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jbe 0x402911
push esi
call fcn.00407d74
add esp, 4
mov edi, eax
test edi, edi
je 0x402911
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, 1
jne 0x402908
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0x42a2d8
push edi
call sub.VERSION.dll_VerQueryValueW
cmp eax, 1
jne 0x402908
push 0x34
mov edx, dword [ebp - 0x1c]
push edx
push 0x34
mov eax, dword [ebp + 8]
push eax
call fcn.004083ce
add esp, 0x10
mov dword [ebp - 0x14], 1
push edi
call fcn.0040844b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4029c0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1804]
mov eax, 0x1804
call fcn.0040fae0
push 0xffffffffffffffff
push 0x427ad0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x43217c]
xor eax, ebp
mov dword [ebp + 0x1800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push 0x800
xor ebx, ebx
push ebx
lea eax, [ebp + 0x800]
push eax
call fcn.00409180
push 0x800
push ebx
lea ecx, [ebp + 0x1000]
push ecx
call fcn.00409180
push 0x800
push ebx
lea edx, [ebp]
push edx
call fcn.00409180
add esp, 0x24
mov dword [ebp - 4], ebx
cmp dword [esi], ebx
je 0x402a48
mov al, 1
jmp 0x402b20
push 0x800
lea eax, [ebp + 0x800]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x402a70
mov byte [ebp - 0x12], bl
push 0x42fd8c
lea ecx, [ebp - 0x12]
push ecx
call fcn.0040a7d8
push 0x5c
lea edx, [ebp + 0x800]
push edx
call fcn.00408245
add esp, 8
mov edi, eax
cmp edi, ebx
je 0x402a8c
add edi, 2
jmp 0x402a91
mov edi, str.SSLog
lea eax, [ebp + 0x1000]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea ecx, [ebp + 0x1000]
push ecx
push str._s_s.log
lea edx, [ebp]
call fcn.00402980
add esp, 0xc
push ebx
push 0x80
push 4
push ebx
mov ebx, 1
push ebx
push 0xc0000000
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
setne al
mov byte [ebp - 0x11], al
mov byte [esi + 0x204], bl
push str.Silent_Installer
push 0x100
lea ecx, [esi + 4]
push ecx
call fcn.00408456
add esp, 0xc
mov ecx, esi
call fcn.00402e80
lea edx, [ebp]
push edx
call fcn.004053b0
add esp, 4
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1800]
xor ecx, ebp
call fcn.0040800b
add ebp, 0x1804
mov esp, ebp
pop ebp
ret
Function at 0x402b70
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427810
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x4008
call fcn.0040fae0
mov eax, dword [0x43217c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov esi, edx
cmp dword [esi], 0
je 0x402c7c
mov dword [ebp - 4], 0
push 0x2000
push 0
lea eax, [ebp - 0x2014]
push eax
call fcn.00409180
push 0x2000
push 0
lea ecx, [ebp - 0x4014]
push ecx
call fcn.00409180
lea edx, [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x1000
lea ecx, [ebp - 0x2014]
push ecx
call fcn.0040871b
add esp, 0x28
test edi, edi
je 0x402c4e
push 0
push 0
lea edx, [ebp - 0x4018]
push edx
push 0x409
push edi
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp - 0x4018]
test eax, eax
je 0x402c4e
push eax
push edi
lea eax, [esi + 4]
push eax
push str.___s___Error_Code___d_:_s
lea edx, [ebp - 0x4014]
call fcn.00403200
add esp, 0x10
mov ecx, dword [ebp - 0x4018]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea edx, [ebp - 0x2014]
mov ecx, esi
call fcn.00402d90
test edi, edi
je 0x402c75
lea edx, [ebp - 0x4014]
mov ecx, esi
call fcn.00402d90
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040800b
mov esp, ebp
pop ebp
ret

Function at 0x403140
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427790
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x43217c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov esi, edx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4031e1
cmp eax, ebx
je 0x4031e1
mov dword [ebp - 4], ebx
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x403193
sub eax, edx
sar eax, 1
push ebx
lea ecx, [ebp - 0x18]
push ecx
lea edx, [eax + eax]
push edx
push edi
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404900
Capabilities:
Get common file path

Disassembly:
mov eax, 0x500c
call fcn.0040fae0
mov eax, dword [0x43217c]
xor eax, esp
mov dword [esp + 0x5008], eax
push str.Run_
mov ecx, 0x434070
mov dword [esp + 8], 1
call fcn.00402cb0
push 0x800
lea eax, [esp + 0x810]
push 0
push eax
mov dword [esp + 0x10], esi
call fcn.00409180
push 0x800
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.00409180
add esp, 0x1c
lea edx, [esp + 0x808]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x404988
push 0x800
push eax
lea eax, [esp + 0x810]
push eax
call fcn.00409180
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [esp + 0x80c]
push ecx
push str._s_04x
lea edx, [esp + 0x14]
call fcn.00402980
add esp, 0xc
lea ecx, [esp + 8]
call fcn.00401830
lea edx, [esp + 8]
lea ecx, [esp]
call fcn.00403740
mov ecx, 0x434070
test al, al
je 0x404acb
push str.Success_to_Extract
call fcn.00402cb0
push 0x2000
lea edx, [esp + 0x3010]
push 0
push edx
call fcn.00409180
push 0x2000
lea eax, [esp + 0x101c]
push 0
push eax
call fcn.00409180
add esp, 0x1c
lea ecx, [esp + 0x1008]
push ecx
push str.COMMAND
mov ecx, 0x1000
lea edx, [esp + 8]
call fcn.004043c0
test eax, eax
jne 0x404ad8
lea eax, [esp + 0x1008]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404a30
sub eax, edx
sar eax, 1
je 0x404ad8
test edi, edi
je 0x404a98
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404a50
sub eax, edx
sar eax, 1
je 0x404a98
push 0xfff
push 0x42b48c
lea edx, [esp + 0x1010]
push 0x1000
push edx
call fcn.004088f3
push 0xfff
push edi
lea eax, [esp + 0x1020]
push 0x1000
push eax
call fcn.004088f3
add esp, 0x20
lea ecx, [esp + 0x1008]
push ecx
lea edx, [esp + 0xc]
push edx
push 0x429df4
lea edx, [esp + 0x3014]
call fcn.00403200
add esp, 0xc
lea edx, [esp + 4]
lea ecx, [esp + 0x3008]
call fcn.00405520
jmp 0x404ad8
push 0x42b490
call fcn.00402cb0
add esp, 4
lea ecx, [esp + 8]
call fcn.00401830
mov ecx, dword [esp + 0x5008]
mov eax, dword [esp + 4]
xor ecx, esp
call fcn.0040800b
add esp, 0x500c
ret
Function at 0x405520
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6804]
mov eax, 0x6804
call fcn.0040fae0
push 0xffffffffffffffff
push 0x4279b0
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x43217c]
xor eax, ebp
mov dword [ebp + 0x6800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], 0
test esi, esi
je 0x405734
mov eax, esi
lea edx, [eax + 2]
jmp 0x405580
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405580
sub eax, edx
sar eax, 1
je 0x405734
push 0x44
push 0
lea eax, [ebp - 0x6c]
push eax
call fcn.00409180
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push 0x800
push eax
lea ecx, [ebp + 0x2000]
push ecx
call fcn.00409180
push 0x2000
push 0
lea edx, [ebp + 0x2800]
push edx
call fcn.00409180
push 0x2000
push 0
lea eax, [ebp]
push eax
call fcn.00409180
push 0x2000
push 0
lea ecx, [ebp + 0x4800]
push ecx
call fcn.00409180
push esi
push 0x1000
lea edx, [ebp]
push edx
call fcn.00408456
add esp, 0x48
mov ecx, 0x429cb8
lea edx, [ebp]
call fcn.00405ac0
mov ecx, 0x429cb8
lea edx, [ebp]
call fcn.00405c70
lea eax, [ebp]
push eax
push 0x1000
lea ecx, [ebp + 0x4800]
push ecx
call fcn.00408456
mov ecx, 0x42b6d8
lea edx, [ebp + 0x4800]
call fcn.00405ac0
mov ecx, 0x42b6d8
lea edx, [ebp + 0x4800]
call fcn.00405c70
push 0x1000
lea edx, [ebp + 0x4800]
push edx
call fcn.00408dc2
push str..EXE
lea eax, [ebp + 0x4800]
push eax
call fcn.00408b7c
add esp, 0x1c
test eax, eax
je 0x4056ab
xor ecx, ecx
mov word [eax], cx
push 0x5c
lea edx, [ebp + 0x4800]
push edx
call fcn.00408245
add esp, 8
test eax, eax
je 0x4056ab
xor ecx, ecx
mov word [eax], cx
lea esi, [ebp + 0x4800]
mov eax, esi
jmp 0x4056b2
xor esi, esi
mov eax, str.NULL
push eax
push 0xffffffffffffffff
lea edx, [ebp]
push edx
push str._RunExecute__Command_Line____s____wait_time___d__Working_Directory____s_
mov ecx, 0x434070
call fcn.00402cb0
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x6c]
push ecx
push esi
push 0
push 0x20
push 1
push 0
push 0
lea edx, [ebp]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4056fc
push edi
mov esi, dword [ebp - 0x24]
call fcn.00405780
add esp, 4
jmp 0x405702
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x6800]
xor ecx, ebp
call fcn.0040800b
add ebp, 0x6804
mov esp, ebp
pop ebp
ret
push str.Fail_____Invalid_Parameter_in_RunExecute____
mov ecx, 0x434070
call fcn.00402cb0
add esp, 4
mov eax, 0x57
jmp 0x40570f

Function at 0x40800b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43217c]
jne 0x408015
repz ret
jmp fcn.0040c1b2
Function at 0x41217c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040b9d2
and dword [ebp - 4], 0
cmp dword [0x433f30], 0
mov ebx, eax
jne 0x41222d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4122de
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4122de
push eax
call fcn.0040b960
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x433f30], eax
call esi
push eax
call fcn.0040b960
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x433f34], eax
call esi
push eax
call fcn.0040b960
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x433f38], eax
call esi
push eax
call fcn.0040b960
pop ecx
mov dword [0x433f40], eax
test eax, eax
je 0x41222d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040b960
pop ecx
mov dword [0x433f3c], eax
mov eax, dword [0x433f3c]
cmp eax, ebx
je 0x412285
cmp dword [0x433f40], ebx
je 0x412285
push eax
call fcn.0040b9db
push dword [0x433f40]
mov esi, eax
call fcn.0040b9db
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x412285
test edi, edi
je 0x412285
call esi
test eax, eax
je 0x41227c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41227c
test byte [ebp - 0xc], 1
jne 0x412285
or dword [ebp + 0x10], 0x200000
jmp 0x4122be
mov eax, dword [0x433f34]
cmp eax, ebx
je 0x4122be
push eax
call fcn.0040b9db
pop ecx
test eax, eax
je 0x4122be
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4122be
mov eax, dword [0x433f38]
cmp eax, ebx
je 0x4122be
push eax
call fcn.0040b9db
pop ecx
test eax, eax
je 0x4122be
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x433f30]
call fcn.0040b9db
pop ecx
test eax, eax
je 0x4122de
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4122e0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x414996
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push es
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00413a46
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004139fb
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00413a36
invalid
Function at 0x4262a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x182c
call fcn.0040fae0
mov eax, dword [0x43217c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x182c], ecx
mov byte [ebp - 0x811], 0
mov dword [ebp - 0x810], 0
mov eax, dword [0x42f1ec]
mov dword [ebp - 0x101c], eax
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x80c], 0
cmp dword [ebp + 8], 0
je 0x426303
mov ecx, dword [ebp + 8]
push ecx
call fcn.00408feb
add esp, 4
test eax, eax
jne 0x42630a
xor al, al
jmp 0x4264ac
movzx edx, byte [ebp + 0xc]
test edx, edx
jne 0x42635c
push 0x5c
mov eax, dword [ebp + 8]
push eax
call fcn.00408245
add esp, 8
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jne 0x426336
xor al, al
jmp 0x4264ac
mov ecx, dword [ebp - 0x80c]
sub ecx, dword [ebp + 8]
sar ecx, 1
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x400
lea eax, [ebp - 0x1018]
push eax
call fcn.004084c5
add esp, 0x10
jmp 0x42636a
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1018]
call fcn.00402970
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0x101c]
push edx
lea eax, [ebp - 0x1018]
push eax
call fcn.004082c2
add esp, 0xc
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 0
je 0x4264a6
mov eax, dword [ebp - 0x810]
lea ecx, [ebp - 0x808]
call fcn.00402970
mov eax, 0x42f1f0
lea ecx, [ebp - 0x808]
call fcn.004029a0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0x101c]
push edx
push 0
call fcn.004082c2
add esp, 0xc
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 0
je 0x42649f
mov eax, dword [ebp - 0x810]
push eax
call fcn.00408feb
add esp, 4
test eax, eax
je 0x42649f
mov eax, dword [ebp - 0x810]
lea ecx, [ebp - 0x808]
call fcn.004029a0
mov eax, 0x42f1f4
lea ecx, [ebp - 0x808]
call fcn.004029a0
push 0
lea ecx, [ebp - 0x808]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x426444
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x426442
xor al, al
jmp 0x4264ac
jmp 0x42647c
cmp dword [ebp + 0x10], 0
je 0x42647c
lea ecx, [ebp - 0x1828]
call fcn.00406380
lea eax, [ebp - 0x808]
lea ecx, [ebp - 0x1828]
call fcn.00402970
mov byte [ebp - 0x1028], 1
lea edx, [ebp - 0x1828]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.00406430
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0x101c]
push ecx
push 0
call fcn.004082c2
add esp, 0xc
mov dword [ebp - 0x810], eax
jmp 0x4263d9
mov byte [ebp - 0x811], 1
mov al, byte [ebp - 0x811]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040800b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x426920
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x43217c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40c], ecx
cmp dword [ebp + 8], 0
je 0x42694f
mov eax, dword [ebp + 8]
push eax
call fcn.00408feb
add esp, 4
test eax, eax
jne 0x426956
xor al, al
jmp 0x4269e9
mov ecx, dword [ebp - 0x40c]
cmp dword [ecx + 0x800], 0
je 0x42697c
push 0
mov edx, dword [ebp - 0x40c]
mov eax, dword [edx + 0x800]
push eax
call fcn.00423910
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x400
push 0
lea edx, [ebp - 0x408]
push edx
call fcn.00409180
add esp, 0xc
push 0
push 0
push 0x400
lea eax, [ebp - 0x408]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
lea edx, [ebp - 0x408]
push edx
call fcn.00423b60
add esp, 8
mov ecx, dword [ebp - 0x40c]
mov dword [ecx + 0x800], eax
mov edx, dword [ebp - 0x40c]
cmp dword [edx + 0x800], 0
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040800b
mov esp, ebp
pop ebp
ret 4
Function at 0x427490
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427d3b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x43217c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x4274f6
mov eax, dword [ebp + 8]
push eax
call fcn.00408feb
add esp, 4
test eax, eax
je 0x4274f6
cmp dword [ebp + 0xc], 0
je 0x4274f6
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00408feb
add esp, 4
test eax, eax
jne 0x4274fd
xor al, al
jmp 0x427639
mov edx, dword [ebp + 8]
push edx
call fcn.00408feb
add esp, 4
cmp eax, 0x400
jae 0x427523
mov eax, dword [ebp + 0xc]
push eax
call fcn.00408feb
add esp, 4
cmp eax, 0x400
jb 0x42752a
xor al, al
jmp 0x427639
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42753f
xor al, al
jmp 0x427639
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.00426920
movzx eax, al
test eax, eax
jne 0x427559
xor al, al
jmp 0x427639
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4275c5
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
call fcn.00402970
mov dword [ebp - 0x18], 0
mov eax, 0x5c
mov ecx, dword [ebp - 0x20]
call fcn.004029b0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x427599
xor edx, edx
mov eax, dword [ebp - 0x18]
mov word [eax], dx
jmp 0x4275ac
push 0x800
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00409180
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.00427070
movzx eax, al
test eax, eax
jne 0x4275c3
xor al, al
jmp 0x427639
jmp 0x42761c
mov dword [ebp - 0x1c], 0
push 0x5c
mov ecx, dword [ebp + 8]
push ecx
call fcn.00408245
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4275e7
xor al, al
jmp 0x427639
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp + 8]
sar edx, 1
push edx
mov eax, dword [ebp + 8]
push eax
push 0x400
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.004084c5
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.00426a00
movzx eax, al
test eax, eax
jne 0x42761c
xor al, al
jmp 0x427639
jmp 0x42762f
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push 5
push 0
push 0
push eax
push 0x4020f8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop ebp
ret 0x10