joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407b3c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404bf8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x407b55
test al, 0x10
je 0x407b59
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40a548
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a581
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040487c
jmp 0x40a58a
mov eax, ebx
mov edx, esi
call fcn.004047e0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a594
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a5b6
movzx eax, byte [esp]
jmp 0x40a5b8
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ac48
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40aac0
mov eax, dword [0xc4f5a4]
cmp byte [eax], 0
je 0x40acc4
mov eax, dword [0xc4f4b8]
call fcn.0040336c
call fcn.00402efc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407d70
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40ad0c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40acfa
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0xc4f498]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0xc527f0]
call fcn.004059ec
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x411438
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov byte [esp], al
mov esi, ecx
dec esi
test esi, esi
jl 0x41147c
inc esi
xor ebx, ebx
mov ebp, edi
add ebp, ebx
mov edx, ebp
lea eax, [esp + 1]
mov ecx, 1
call fcn.0040679c
movzx eax, byte [esp]
xor byte [esp + 1], al
lea edx, [esp + 1]
mov eax, ebp
mov ecx, 1
call fcn.0040679c
inc ebx
dec esi
jne 0x41144c
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x411484
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov byte [esp], al
mov esi, ecx
dec esi
test esi, esi
jl 0x4114c8
inc esi
xor ebx, ebx
mov ebp, edi
add ebp, ebx
mov edx, ebp
lea eax, [esp + 1]
mov ecx, 1
call fcn.0040679c
movzx eax, byte [esp]
xor byte [esp + 1], al
lea edx, [esp + 1]
mov eax, ebp
mov ecx, 1
call fcn.0040679c
inc ebx
dec esi
jne 0x411498
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x411c70
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404be8
xor eax, eax
push ebp
push 0x411d72
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403440
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.00403440
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404bf8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x411d5c
mov eax, dword [ebp - 0x5c]
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x58]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x54]
mov dword [eax], edx
mov dword [edi], 0x10007
push edi
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetThreadContext
lea eax, [ebp - 8]
push eax
push 4
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [edi + 0xa4]
add eax, 8
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadProcessMemory
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
jmp 0x411d3f
cmp dword [ebp - 0x68], 0x10000
je 0x411d52
add edi, dword [ebp - 0x6c]
push 0x1c
lea eax, [ebp - 0x78]
push eax
push edi
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualQueryEx
test eax, eax
jne 0x411d33
mov eax, dword [ebp + 0xc]
sub edi, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411d79
lea eax, [ebp - 4]
call fcn.0040478c
ret
Function at 0x412238
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov byte [esp], al
mov esi, ecx
dec esi
test esi, esi
jl 0x41227c
inc esi
xor ebx, ebx
mov ebp, edi
add ebp, ebx
mov edx, ebp
lea eax, [esp + 1]
mov ecx, 1
call fcn.0040679c
movzx eax, byte [esp]
xor byte [esp + 1], al
lea edx, [esp + 1]
mov eax, ebp
mov ecx, 1
call fcn.0040679c
inc ebx
dec esi
jne 0x41224c
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x412284
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x412325
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, pe_nt_image_headers32
call fcn.00402dd4
mov ebx, eax
push ebx
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00407e90
mov eax, ebx
call fcn.00402df0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4122d1
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00404c60
mov eax, dword [ebp - 8]
mov edx, 0x41233c
call main
je 0x412300
lea eax, [ebp - 4]
mov edx, 0x41233c
call fcn.00404a34
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004047e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41232c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047b0
ret

Function at 0x41646c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x416594
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
mov dl, 1
mov eax, dword [0x410064]
call fcn.00403a0c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x416568
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, ebx
test edi, edi
je 0x4164b8
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x10]
push eax
mov ecx, 1
mov edx, edi
mov eax, ebx
call fcn.00404c60
mov eax, dword [ebp - 0x10]
mov edx, 0x4165b0
call main
je 0x4164f4
push ebx
push 0x4165b0
mov eax, dword [0xc4f480]
push dword [eax]
mov eax, esi
mov edx, 3
call fcn.00404afc
jmp 0x416505
mov ecx, dword [0xc4f480]
mov ecx, dword [ecx]
mov eax, esi
mov edx, ebx
call fcn.00404a80
mov eax, dword [esi]
call fcn.00407b3c
test al, al
je 0x41651d
mov eax, dword [esi]
call fcn.00404bf8
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [str.s__sqssswss]
movzx eax, byte [eax]
mov byte [ebp - 9], al
mov edx, dword [str.s__sqssswss]
inc edx
mov ecx, 0x7ec00
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 4]
movzx eax, byte [ebp - 9]
call fcn.00412238
mov edx, dword [esi]
mov eax, dword [ebp - 8]
call fcn.00410f3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x416576
mov eax, dword [ebp - 8]
call fcn.00403a3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41659b
lea eax, [ebp - 0x10]
call fcn.0040478c
ret
Function at 0x416c40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x416df3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x410064]
call fcn.00403a0c
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x410064]
call fcn.00403a0c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x416d44
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [str.756bL_]
movzx ebx, byte [ebx + 4]
mov edx, dword [str.756bL_]
add edx, 5
mov ecx, 0x7b6d40
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x10]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 4]
mov eax, ebx
call fcn.00411438
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004114f4
mov eax, dword [ebp - 0x10]
call fcn.00416154
test al, al
je 0x416d24
lea eax, [ebp - 4]
mov edx, 0x416e0c
call fcn.00404824
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx]
mov edx, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 4]
call fcn.00411f98
call fcn.004163f0
test al, al
jne 0x416d3a
mov ecx, 0x416e18
mov dl, 1
mov eax, dword [0x4067e8]
call fcn.0040ad10
call fcn.004041d4
jmp 0x416d3a
mov ecx, 0x416e18
mov dl, 1
mov eax, dword [0x4067e8]
call fcn.0040ad10
call fcn.004041d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x416d94
mov eax, dword [ebp - 0x10]
call fcn.00403a3c
mov eax, dword [ebp - 0xc]
call fcn.00403a3c
mov eax, dword [ebp - 8]
call fcn.00407b3c
test al, al
je 0x416dd0
mov eax, dword [ebp - 8]
call fcn.00404bf8
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00404984
mov eax, dword [ebp - 0x18]
call fcn.00404bf8
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416dfa
lea eax, [ebp - 0x18]
call fcn.0040478c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047b0
ret
Function at 0x416ff0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
xor edx, edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4170d1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403440
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x20], 1
lea edx, [ebp - 0x40]
xor eax, eax
call fcn.00403264
mov eax, dword [ebp - 0x40]
call fcn.00404bf8
mov dword [ebp - 0x2c], eax
mov eax, ebx
call fcn.00417154
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
call fcn.00407d64
mov eax, dword [ebp - 0x44]
call fcn.00404bf8
mov dword [ebp - 0x24], eax
mov eax, 0x4170e0
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
jne 0x4170ae
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x50]
call fcn.0040a4fc
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
lea eax, [ebp - 0x4c]
push eax
push 0
mov ecx, 0x4170f0
mov dl, 1
mov eax, dword [0x4067e8]
call fcn.0040ad4c
call fcn.004041d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4170d8
lea eax, [ebp - 0x50]
call fcn.0040478c
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004047b0
ret
Function at 0x401120
Capabilities:
Create directory
Create shortcut via ishelllink

Disassembly:
sub esp, 0x82c
mov eax, dword [0x434480]
xor eax, esp
mov dword [esp + 0x828], eax
mov eax, dword [esp + 0x834]
push ebx
mov ebx, dword [esp + 0x83c]
push ebp
mov ebp, dword [esp + 0x848]
push esi
mov esi, dword [esp + 0x848]
push edi
mov edi, dword [esp + 0x840]
push eax
push 0x436920
lea eax, [esp + 0x20]
push 0x42a30c
push eax
call fcn.00405500
lea eax, [esp + 0x230]
push esi
push eax
call fcn.00402460
add esp, 0x18
test eax, eax
jne 0x4011b4
push esi
push str.An_error_occurred_while_attempting_to_find_the_path_to__s._n
call fcn.00404f40
cmp byte [esi], 0x64
mov ecx, str.in_the_Start_menu
mov eax, str.on_the_desktop
cmovne eax, ecx
push eax
push edi
push str.An_error_has_occurred.__A_shortcut_to__s_will_not_be_created__s._n
call fcn.00404f40
add esp, 0x14
jmp 0x4012ec
lea eax, [esp + 0x220]
push eax
call fcn.004135c4
push edi
lea eax, [esp + 0x228]
push eax
lea eax, [esp + 0x63c]
push str._s_s.lnk
push eax
call fcn.00405500
add esp, 0x14
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x4011fd
push str.Error:__Could_not_open_the_COM_library.__Not_creating_shortcut._n
call fcn.00404f40
add esp, 4
jmp 0x4012ec
lea eax, [esp + 0x10]
push eax
push 0x42ad88
push 1
push 0
push 0x42ada8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4012de
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x42ad98
push eax
mov ecx, dword [eax]
mov eax, dword [ecx]
call eax
test eax, eax
js 0x4012cf
push 0x208
lea eax, [esp + 0x224]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x63c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [esp + 0x10]
push ebp
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x24]
call eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 0
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x44]
call eax
mov eax, dword [esp + 0x10]
push ebx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x2c]
call eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x220]
push 1
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
mov eax, 1
jmp 0x4012ee
push str.QueryInterface_Error_n
call fcn.00404f40
add esp, 4
jmp 0x4012ec
push eax
push str.CoCreateInstance_Error___hres___08x_n
call fcn.00404f40
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x838]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004060be
add esp, 0x82c
ret
Function at 0x4020c0
Capabilities:
Set current directory

Disassembly:
push ecx
push esi
push edi
push dword [0x436908]
call fcn.00404d80
push 0x428a14
call fcn.00414f25
mov edi, dword [esp + 0x18]
add esp, 8
mov esi, 0x433248
push dword [esi - 0x14]
call fcn.00405100
add esp, 4
mov dword [esi], eax
test edi, edi
jne 0x402103
push dword [esi - 0xc]
call fcn.00405100
add esp, 4
mov dword [esi + 4], eax
cmp dword [0x434f88], 0
jne 0x40215c
mov eax, dword [esi]
test eax, eax
je 0x40215c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402115
sub eax, edx
inc eax
push eax
call fcn.00411600
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4021fd
mov edx, dword [esi]
mov dword [0x434f88], ecx
nop word [eax + eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x402140
push dword [0x434f88]
call fcn.00404f70
add esp, 4
test edi, edi
je 0x402175
mov eax, dword [esi]
test eax, eax
je 0x402175
push eax
call fcn.004115f0
add esp, 4
mov dword [esi], 0
add esi, 0x228
cmp esi, 0x434388
jl 0x4020e4
mov cl, byte [0x436920]
mov eax, 0x436920
test cl, cl
je 0x4021f9
cmp byte [0x436921], 0x3a
jne 0x4021eb
mov ax, word [0x428a18]
mov word [esp + 8], ax
mov al, byte [0x428a1a]
push ebx
movsx ebx, cl
mov byte [esp + 0xe], al
lea edx, [ebx - 0x61]
lea eax, [ebx - 0x20]
cmp edx, 0x19
movzx ecx, al
movzx eax, bl
cmova ecx, eax
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x10], cl
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop ebx
test eax, eax
je 0x4021f9
cmp byte [0x436922], 0
mov eax, 0x436922
je 0x4021f9
pop edi
pop esi
add esp, 4
mov dword [esp + 4], eax
jmp fcn.00414f25
pop edi
pop esi
pop ecx
ret
push str.ERROR:_out_of_memory_n
call fcn.00404f40
add esp, 4
push 1
call fcn.00411951
int3
Function at 0x402220
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, 0x436920
push edi
mov edi, dword [ebp]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x402232
sub esi, ecx
test edi, edi
je 0x402329
push esi
push 0x436920
push edi
call fcn.004149f3
add esp, 0xc
test eax, eax
jne 0x402329
movsx eax, byte [esi + edi]
add esi, edi
push eax
push 0x428bec
call fcn.00406c20
add esp, 8
inc esi
test eax, eax
je 0x402329
push 0x5c
push esi
call fcn.00406c20
add esp, 8
test eax, eax
jne 0x402329
push 0x2f
push esi
call fcn.00406c20
add esp, 8
test eax, eax
jne 0x402329
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4022a2
sub ecx, edx
lea eax, [ecx + 1]
push eax
call fcn.00401070
add esp, 4
mov edi, eax
mov edx, esi
sub eax, esi
nop dword [eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [eax + edx - 1], cl
test cl, cl
jne 0x4022c0
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4022d2
sub ecx, edx
push 0
push edi
mov byte [ecx + edi - 1], 0x78
call fcn.00414b2b
add esp, 8
push edi
push esi
test eax, eax
je 0x40232d
call fcn.0040a013
add esp, 8
test eax, eax
jne 0x402342
push ebx
push esi
call fcn.00405100
push esi
push edi
mov ebx, eax
call fcn.0040a013
add esp, 0xc
test eax, eax
jne 0x402360
push dword [ebp]
call fcn.004115f0
push edi
call fcn.004115f0
add esp, 8
mov dword [ebp], ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push edi
push str._nERROR:__s_and__s_clash.__Remove_or_rename__s._n
call fcn.00404f40
add esp, 0x10
push 1
call fcn.00404df0
push 0
call fcn.00412ac2
push eax
push edi
push esi
push str._nERROR:_failed_to_rename__s_to__s:__s_n
call fcn.00404f40
add esp, 0x14
push 1
call fcn.00404df0
push 0
call fcn.00412ac2
push eax
push esi
push edi
push str._nERROR:_failed_to_rename__s_back_to__s:__s_n
call fcn.00404f40
add esp, 0x14
push 1
call fcn.00404df0
int3
Function at 0x4026e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x434480]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
push edi
push str.VIMRUNTIME
call fcn.00412872
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x40278a
cmp byte [ecx], 0
je 0x40278a
mov edx, ecx
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x402717
sub edx, esi
cmp edx, 0x208
jae 0x40278a
lea edx, [esp + 0x210]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x402731
lea ecx, [esp + 0x210]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402748
sub ecx, edx
lea eax, [ecx - 1]
test eax, eax
jle 0x402781
nop dword [eax + eax]
lea edx, [esp + 0x210]
mov cl, byte [edx + eax]
cmp cl, 0x2f
je 0x40277d
cmp cl, 0x5c
je 0x40277d
dec eax
test eax, eax
jg 0x402760
mov esi, edx
jmp 0x4027b1
mov byte [edx + eax], 0
lea esi, [esp + 0x210]
jmp 0x4027b1
push 0x428c80
call fcn.00412872
mov esi, eax
add esp, 4
test esi, esi
je 0x4027a2
cmp byte [esi], 0
jne 0x4027b1
mov eax, dword [0x434f8c]
mov esi, 0x4283de
test eax, eax
cmovne esi, eax
lea eax, [esp + 8]
push eax
push 0x1fc
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4027c8
sub ecx, edx
test ecx, ecx
jle 0x4027f9
mov al, byte [esp + ecx + 7]
cmp al, 0x5c
je 0x4027f9
cmp al, 0x2f
je 0x4027f9
lea edi, [esp + 8]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4027e6
mov ax, word [0x428a14]
mov word [edi], ax
lea ecx, [esp + 8]
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402800
mov eax, dword [str.vimini.ini]
mov dword [ecx], eax
mov eax, dword [0x428c88]
mov dword [ecx + 4], eax
mov ax, word [0x428c8c]
mov word [ecx + 8], ax
mov al, byte [0x428c8e]
mov byte [ecx + 0xa], al
lea eax, [esp + 8]
push 0x4289d0
push eax
call fcn.00409a71
mov edi, eax
add esp, 8
test edi, edi
je 0x40287a
push str._vimini__n
push edi
call fcn.00402380
push esi
push str.dir__s__n
push edi
call fcn.00402380
push edi
call fcn.00409628
add esp, 0x18
pop edi
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.004060be
add esp, 0x414
ret
lea eax, [esp + 8]
push eax
push str.Failed_to_open__s_n
call fcn.00404f40
add esp, 8
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x418]
pop edi
pop esi
xor ecx, esp
call fcn.004060be
add esp, 0x414
ret
Function at 0x404d80
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, dword [esp + 8]
mov al, byte [esi]
test al, al
je 0x404de7
cmp byte [esi + 1], 0x3a
jne 0x404ddc
push ebx
movsx ebx, al
mov ax, word [0x428a18]
mov word [esp + 0xc], ax
mov al, byte [0x428a1a]
mov byte [esp + 0xe], al
lea edx, [ebx - 0x61]
lea eax, [ebx - 0x20]
cmp edx, 0x19
movzx ecx, al
movzx eax, bl
cmova ecx, eax
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x10], cl
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop ebx
test eax, eax
jne 0x404dd4
or eax, 0xffffffff
pop esi
ret
add esi, 2
cmp byte [esi], 0
je 0x404de7
push esi
call fcn.00414f25
add esp, 4
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x406795
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4067d4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4067d4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4067d4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4067d4
cmp dword [ecx + 0x74], 0xe
jbe 0x4067d4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41338e
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x434480]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x42c668
push esi
call fcn.0041a9e5
pop ecx
pop ecx
test eax, eax
jne 0x4133bc
xor al, al
jmp 0x413439
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.004130b0
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x4133f6
push dword [ebp - 0x210]
call fcn.004115f0
xor al, al
jmp 0x413437
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4133fc
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x41341c
push edx
call fcn.004132c5
pop ecx
test al, al
je 0x4133e7
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x41342a
mov bl, 1
push dword [ebp - 0x210]
call fcn.004115f0
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004060be
leave
ret