joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403190
Capabilities:
Create directory

Disassembly:
push 0x22c
mov eax, 0x43fe8c
call fcn.004253f8
mov esi, ecx
push 0x44655c
mov dword [ebp - 0x238], esi
call fcn.0043d980
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push eax
lea eax, [ebp - 0x11c]
push eax
call edi
mov ebx, str.ncstudio.dat
push ebx
lea ecx, [ebp - 0x228]
call fcn.00402597
and dword [ebp - 4], 0
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402597
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x230]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00405b43
mov ecx, dword [ebp - 0x230]
add ecx, 0xfffffff0
call fcn.00401c0b
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.00401c0b
push 0x44655c
call fcn.0043d9c0
push eax
lea eax, [ebp - 0x224]
push eax
call edi
push ebx
lea ecx, [ebp - 0x230]
call fcn.00402597
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 2
call fcn.00402597
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x228]
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00405b43
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.00401c0b
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x230]
add ecx, 0xfffffff0
call fcn.00401c0b
lea edi, [esi + 0xb4]
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
test eax, 0xfffffffc
je 0x403378
mov eax, dword [0x455c10]
push dword [eax*4 + 0x452ab8]
lea ebx, [esi + 0xb0]
mov ecx, ebx
call fcn.00402367
mov ebx, dword [ebx]
push 4
push 0
push ebx
mov ecx, esi
call fcn.00412d35
cmp eax, 6
jne 0x403378
push 0x446564
mov dword [esi + 0xa4], 1
call fcn.0040230c
pop ecx
call fcn.0043d800
push eax
lea ecx, [esi + 0xa8]
call fcn.00402715
add esi, 0xac
push dword [esi]
call fcn.0043d000
pop ecx
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, dword [edi + 0xc]
lea esi, [ebp - 0x22c]
call fcn.00408047
mov ebx, dword [edi + 0x10]
lea esi, [ebp - 0x234]
call fcn.00408047
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x403346
cmp eax, dword [ebp - 0x234]
je 0x40334b
call fcn.00421c91
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0x230]
je 0x403378
lea esi, [ebp - 0x22c]
call fcn.00407ab2
mov ecx, dword [ebp - 0x238]
mov edx, eax
call fcn.0040602a
call fcn.00407ada
jmp 0x403326
call fcn.0042547b
ret
Function at 0x404fcb
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x104
lea ebp, [esp - 4]
mov eax, dword [0x450bf0]
xor eax, ebp
mov dword [ebp + 0x104], eax
push 4
mov eax, 0x43f538
call fcn.0042538f
cmp byte [0x456900], 0
mov edi, 0x456900
jne 0x405061
push 1
push 0
lea eax, [ebp]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00402597
and dword [ebp - 4], 0
mov esi, 0x104
push esi
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00402715
push 0x446690
lea ecx, [ebp - 0x10]
call fcn.00402367
push dword [ebp - 0x10]
push esi
push edi
call fcn.004226d4
mov ecx, dword [ebp - 0x10]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.00401c0b
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.00420391
add ebp, 0x108
leave
ret

Function at 0x405086
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x104
lea ebp, [esp - 4]
mov eax, dword [0x450bf0]
xor eax, ebp
mov dword [ebp + 0x104], eax
push 4
mov eax, 0x43f538
call fcn.0042538f
cmp byte [0x4567f8], 0
mov edi, 0x4567f8
jne 0x40511c
push 1
push 2
lea eax, [ebp]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00402597
and dword [ebp - 4], 0
mov esi, 0x104
push esi
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00402715
push 0x446690
lea ecx, [ebp - 0x10]
call fcn.00402367
push dword [ebp - 0x10]
push esi
push edi
call fcn.004226d4
mov ecx, dword [ebp - 0x10]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.00401c0b
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.00420391
add ebp, 0x108
leave
ret

Function at 0x405141
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa0
mov eax, dword [0x450bf0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, 0x9c
push esi
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.00424b60
add esp, 0xc
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x40518f
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call esi
test eax, eax
je 0x4051a2
mov eax, dword [ebp - 0x18]
dec eax
je 0x4051a2
dec eax
jne 0x4051a2
cmp dword [ebp - 0x24], 6
sbb al, al
inc al
jmp 0x4051a4
xor al, al
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
pop esi
call fcn.00420391
add ebp, 0x78
leave
ret
Function at 0x4051b4
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x160
mov eax, 0x43f502
call fcn.004253f8
mov eax, dword [ebp + 8]
and dword [ebp - 0x15c], 0
mov dword [ebp - 0x154], eax
mov dword [ebp - 4], 1
test byte [0x4567f0], 1
mov esi, 0x4567ec
jne 0x40520e
or dword [0x4567f0], 1
push 0x446a78
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00402597
push 0x44044f
call fcn.004208dd
pop ecx
mov byte [ebp - 4], 1
test byte [0x4567f0], 2
jne 0x405240
or dword [0x4567f0], 2
push 0x446558
mov ecx, 0x4560bc
mov byte [ebp - 4], 3
call fcn.00402597
push 0x440441
call fcn.004208dd
pop ecx
mov byte [ebp - 4], 1
push 0x4467cc
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.00407878
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x150]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [ebp - 0x164]
add ecx, 0xfffffff0
mov dword [ebp - 0x158], eax
call fcn.00401c0b
cmp dword [ebp - 0x158], 0xffffffff
je 0x405385
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x405362
lea eax, [ebp - 0x124]
push eax
push str.Next_file_name_is:__s_n
call fcn.00421ca1
test byte [ebp - 0x150], 0x10
pop ecx
pop ecx
je 0x405362
lea eax, [ebp - 0x124]
push eax
mov ecx, 0x4560bc
call fcn.00407c83
test eax, eax
je 0x405362
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp + 0x10]
call fcn.00407c83
test eax, eax
je 0x4053b3
push ecx
lea eax, [ebp + 0x10]
mov dword [ebp - 0x16c], esp
mov ecx, esp
push eax
call fcn.00408cb1
push 0x446690
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x15c]
push eax
mov byte [ebp - 4], 4
call fcn.00407878
add esp, 8
mov ecx, esp
mov dword [ebp - 0x168], esp
lea edx, [ebp - 0x124]
push edx
push eax
push ecx
mov byte [ebp - 4], 5
call fcn.00407878
add esp, 0xc
lea eax, [ebp - 0x160]
push eax
mov byte [ebp - 4], 6
call fcn.004051b4
mov ecx, dword [ebp - 0x160]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.00401c0b
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x15c]
add ecx, 0xfffffff0
call fcn.00401c0b
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x158]
call edi
test eax, eax
jne 0x405294
push dword [ebp - 0x158]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x154]
push esi
call fcn.00408cb1
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00401c0b
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00401c0b
mov eax, dword [ebp - 0x154]
call fcn.0042547b
ret
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
call fcn.00408d3c
jmp 0x405385
Function at 0x4058bd
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x450bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], 0x67452301
mov dword [ebp - 0x54], 0xefcdab89
mov dword [ebp - 0x50], 0x98badcfe
mov dword [ebp - 0x4c], 0x10325476
cmp dword [ebp + 0xc], ecx
je 0x40590b
push dword [ebp + 0xc]
lea esi, [ebp - 0x60]
push eax
call fcn.004019e7
pop ecx
pop ecx
lea ecx, [ebp - 0x60]
call fcn.00401a6d
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00420391
leave
ret
Function at 0x405921
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
push 0x37c
mov eax, 0x43f497
call fcn.004253f8
mov esi, ecx
mov dword [ebp - 0x370], esi
call fcn.0041822d
push eax
lea ecx, [ebp - 0x364]
call fcn.00401bc3
push 0x104
lea eax, [ebp - 0x118]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x364]
call fcn.00402715
push 0x446690
lea ecx, [ebp - 0x364]
call fcn.00402367
push str..sys
lea eax, [ebp - 0x388]
push esi
push eax
call fcn.00407878
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x360]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [ebp - 0x388]
add ecx, 0xfffffff0
mov dword [ebp - 0x36c], eax
call fcn.00401c0b
cmp dword [ebp - 0x36c], 0xffffffff
je 0x405b2f
mov esi, str.drivers_
lea eax, [ebp - 0x334]
push eax
lea ecx, [ebp - 0x368]
call fcn.00402597
push esi
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x380]
push eax
mov byte [ebp - 4], 1
call fcn.00407878
lea ecx, [ebp - 0x368]
push ecx
push eax
lea eax, [ebp - 0x378]
push eax
mov byte [ebp - 4], 2
call fcn.00407821
add esp, 0x18
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x378]
add ecx, 0xfffffff0
call fcn.00401c0b
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x380]
add ecx, 0xfffffff0
call fcn.00401c0b
push esi
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x374]
push eax
call fcn.00407878
lea ecx, [ebp - 0x368]
push ecx
push eax
lea eax, [ebp - 0x37c]
push eax
mov byte [ebp - 4], 3
call fcn.00407821
mov edi, eax
lea eax, [ebp - 0x368]
push eax
push dword [ebp - 0x370]
lea eax, [ebp - 0x384]
push eax
mov byte [ebp - 4], 4
call fcn.00407821
mov edi, dword [edi]
mov eax, dword [eax]
add esp, 0x24
push ebx
push ebx
push 0x40
push edi
push ebx
push eax
push ebx
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupInstallFileA]
mov ecx, dword [ebp - 0x384]
add ecx, 0xfffffff0
mov edi, eax
call fcn.00401c0b
mov ecx, dword [ebp - 0x37c]
add ecx, 0xfffffff0
call fcn.00401c0b
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x374]
add ecx, 0xfffffff0
call fcn.00401c0b
cmp edi, ebx
jne 0x405af7
push dword [ebp - 0x368]
lea eax, [ebp - 0x220]
push 0x446804
push eax
call fcn.00421ca1
add esp, 0xc
push ebx
push ebx
lea eax, [ebp - 0x220]
push eax
call fcn.00417ed4
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x368]
add ecx, 0xfffffff0
call fcn.00401c0b
lea eax, [ebp - 0x360]
push eax
push dword [ebp - 0x36c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4059cd
push dword [ebp - 0x36c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x364]
add ecx, 0xfffffff0
call fcn.00401c0b
call fcn.0042547b
ret
Function at 0x4062fc
Capabilities:
Create directory

Disassembly:
push 0xc
mov eax, 0x43f3c8
call fcn.0042538f
push dword [ebp + 8]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
call ebx
test eax, eax
jne 0x4063c1
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00402597
and dword [ebp - 4], 0
call fcn.0041822d
push eax
lea ecx, [ebp - 0x14]
call fcn.00401bc3
mov byte [ebp - 4], 1
mov edi, 0x446690
xor ecx, ecx
jmp 0x406388
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.004077e3
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00408d3c
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401c0b
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x406385
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4063ab
lea ecx, [esi + 1]
push edi
lea esi, [ebp - 0x10]
call fcn.0040761f
mov esi, eax
cmp esi, 0xffffffff
jne 0x406345
push dword [ebp - 0x10]
call ebx
test eax, eax
jne 0x4063ab
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401c0b
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401c0b
call fcn.00425467
ret
Function at 0x4071f3
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x268
mov eax, 0x43fb2c
call fcn.004253f8
mov ebx, dword [ebp + 8]
push 0x103
lea eax, [ebp - 0x11b]
push 0
push eax
mov dword [ebp - 0x26c], ecx
mov byte [ebp - 0x11c], 0
call fcn.00424b60
mov eax, ebx
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40722c
lea edi, [ebp - 0x11c]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40723e
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x11c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40725b
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x11c]
mov esi, 0x4460c8
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x264], eax
cmp eax, 0xffffffff
je 0x4073b2
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x40738f
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x260]
call fcn.00402597
and dword [ebp - 4], 0
test byte [ebp - 0x25c], 0x10
je 0x407344
push 0x446554
lea ecx, [ebp - 0x260]
call fcn.00407c83
test eax, eax
je 0x407344
push 0x446558
lea ecx, [ebp - 0x260]
call fcn.00407c83
test eax, eax
je 0x407344
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x274]
push ebx
push eax
call fcn.004078d0
add esp, 0xc
push 0x446690
push eax
lea eax, [ebp - 0x268]
push eax
mov byte [ebp - 4], 1
call fcn.00407878
add esp, 0xc
mov ecx, dword [ebp - 0x26c]
mov byte [ebp - 4], 2
push dword [eax]
call fcn.004071f3
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.00401c0b
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x274]
add ecx, 0xfffffff0
call fcn.00401c0b
test byte [ebp - 0x25c], 0x20
je 0x40737d
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x270]
push ebx
push eax
call fcn.004078d0
add esp, 0xc
mov byte [ebp - 4], 3
mov esi, dword [eax]
call fcn.004073ba
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
call fcn.00401c0b
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x260]
add ecx, 0xfffffff0
call fcn.00401c0b
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x264]
call edi
test eax, eax
jne 0x407298
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.0042547b
ret 4
Function at 0x4073ba
Capabilities:
Check if file exists
Get file attributes
Print debug messages
Set file attributes

Disassembly:
push ecx
push ebx
push ebp
push edi
xor edi, edi
push esi
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4073ec
test bl, 1
je 0x4073ec
and eax, 0xfffffffe
push eax
push esi
call ebp
mov dword [esp + 0xc], 1
push edi
push edi
push 3
push edi
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x407422
push str.CreateFile_fail__r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.0040230c
pop ecx
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x407430
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0xc], 1
jne 0x40743b
push ebx
push esi
call ebp
pop edi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40a0e2
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x43ea28
call fcn.004253f8
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x3c], edi
cmp dword [edi + 0x3c], ebx
je 0x40a1fb
cmp byte [edi + 0x41], bl
je 0x40a1fb
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x40a11a
xor al, al
jmp 0x40a1fd
lea esi, [ebp - 0x30]
call fcn.00409ee5
lea eax, [edi + 0x44]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
lea ebx, [ebp - 0x48]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.00409f61
mov esi, eax
call fcn.0040a2e7
add eax, dword [ebp - 0x34]
lea ebx, [ebp - 0x60]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.00409f61
mov esi, eax
call fcn.0040a2e7
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x38]
push esi
push dword [ebp - 0x34]
push eax
push dword [ebp - 0x40]
call dword [edx + 0x18]
xor ebx, ebx
sub eax, ebx
je 0x40a17f
dec eax
je 0x40a182
dec eax
dec eax
jne 0x40a1eb
mov bl, 1
jmp 0x40a1eb
mov byte [edi + 0x41], bl
lea ebx, [ebp - 0x58]
lea esi, [ebp - 0x30]
call fcn.00409f61
mov esi, eax
call fcn.0040a2e7
mov ecx, dword [ebp - 0x38]
sub ecx, eax
mov dword [ebp - 0x34], ecx
je 0x40a1c7
push dword [edi + 0x4c]
lea ebx, [ebp - 0x50]
push ecx
push 1
lea esi, [ebp - 0x30]
call fcn.00409f61
mov esi, eax
call fcn.0040a2e7
push eax
call fcn.00422c1f
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x40a1e9
mov ecx, dword [ebp - 0x34]
cmp byte [edi + 0x41], 0
je 0x40a17b
test ecx, ecx
jne 0x40a12b
push ecx
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.00409f1d
mov edi, dword [ebp - 0x3c]
jmp 0x40a12b
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00407ea5
mov al, bl
jmp 0x40a1fd
mov al, 1
call fcn.0042547b
ret
Function at 0x40e759
Capabilities:
Copy file

Disassembly:
push 0x13c
mov eax, 0x43f191
call fcn.0042542e
mov edi, ecx
push 0x20
xor ebx, ebx
push edi
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x128], edi
mov dword [ebp - 4], ebx
call fcn.0041aa1a
push 8
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 1
call fcn.0041a129
cmp eax, 8
jne 0x40e7d4
cmp dword [ebp - 0x130], 0x434c4646
jne 0x40e7d4
lea ecx, [ebp - 0x140]
call fcn.0040e922
cmp dword [ebp - 0x12c], eax
jne 0x40e7d4
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], bl
call fcn.0041a510
mov al, 1
jmp 0x40e871
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], bl
call fcn.0041a510
jmp 0x40e7fd
push edi
mov esi, 0x104
lea eax, [ebp - 0x124]
push esi
push eax
call fcn.004226d4
add esp, 0xc
push str..bak
lea eax, [ebp - 0x124]
push esi
push eax
call fcn.0042273c
add esp, 0xc
push 0x20
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x140]
mov dword [ebp - 4], 3
call fcn.0041aa1a
push 8
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 4
call fcn.0041a129
lea ecx, [ebp - 0x140]
cmp eax, 8
je 0x40e877
mov byte [ebp - 4], 3
call fcn.0041a510
xor al, al
call fcn.0042548a
ret
cmp dword [ebp - 0x130], 0x434c4646
jne 0x40e866
call fcn.0040e922
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x140]
cmp dword [ebp - 0x12c], eax
jne 0x40e86a
call fcn.0041a510
or dword [ebp - 4], 0xffffffff
push ebx
push edi
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40e7cd
call fcn.0041822d
push eax
lea ecx, [ebp - 0x128]
call fcn.00401bc3
mov dword [ebp - 4], 6
mov eax, dword [0x455c10]
mov esi, dword [eax*4 + 0x452004]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea eax, [ebp - 0x128]
push esi
push eax
call fcn.0040eb9a
mov esi, dword [ebp - 0x128]
add esp, 0x10
push ebx
push ebx
push esi
call fcn.00417ed4
lea ecx, [esi - 0x10]
call fcn.00401c0b
jmp 0x40e86f

Function at 0x40e922
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00429120
mov eax, dword [0x450bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov esi, ecx
mov eax, dword [esi]
push 0
push 8
mov dword [ebp - 0x1018], esi
call dword [eax + 0x28]
mov eax, dword [esi]
or dword [ebp - 0x100c], 0xffffffff
push 0x1000
lea ecx, [ebp - 0x1008]
push ecx
mov ecx, esi
call dword [eax + 0x34]
mov dword [ebp - 0x1010], eax
test eax, eax
je 0x40e9e2
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x101c], eax
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x101c]
push eax
mov ecx, dword [eax]
lea edi, [0x452018]
mov esi, dword [ebp - 0x1014]
mov ebx, dword [ebp - 0x1010]
lea edx, [esi + ebx]
xor eax, eax
mov bl, byte [esi]
mov al, cl
inc esi
xor al, bl
shr ecx, 8
mov ebx, dword [edi + eax*4]
xor ecx, ebx
cmp edx, esi
jne 0x40e9a9
pop eax
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1018]
mov eax, dword [ecx]
push 0x1000
lea edx, [ebp - 0x1008]
push edx
call dword [eax + 0x34]
mov dword [ebp - 0x1010], eax
test eax, eax
jne 0x40e98b
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x100c]
pop edi
pop esi
xor ecx, ebp
not eax
pop ebx
call fcn.00420391
leave
ret
Function at 0x40f292
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
call fcn.0040f318
and dword [0x455e34], 0
push 0x104
call fcn.0043dc80
push eax
mov ebx, 0x455d20
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40f2c2
mov esi, str.Ncstudio.string
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
push 0
movsd dword es:[edi], dword [esi]
push str.MaxIndex
push str.Attribute
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
mov dword [0x455e34], eax
pop ebx
test eax, eax
je 0x40f315
inc eax
push 4
push eax
call fcn.0042418a
push 0x446a78
mov dword [0x455e30], eax
call fcn.00423372
mov ecx, dword [0x455e30]
add esp, 0xc
mov dword [ecx], eax
mov al, 1
ret
Function at 0x411643
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x411667
cmp dword [edi + 0x54], 0
jne 0x411667
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00418c94
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00411604
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x416b27
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x416b6e
call fcn.00418c94
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x416b6e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x416b8a
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004166a1
mov esi, eax
test edi, edi
je 0x416b88
test ebx, ebx
je 0x416b88
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x420391
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x450bf0]
jne 0x42039b
repz ret
jmp fcn.0042914b

Function at 0x424df8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x424e29
call fcn.00425807
mov dword [eax], esi
call fcn.004257f4
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00421c6b
add esp, 0x14
or eax, 0xffffffff
jmp 0x424e64
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x424e46
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042581a
pop ecx
jmp 0x424e24
test byte [ebp + 0xc], 0x80
je 0x424e51
and eax, 0xfffffffe
jmp 0x424e54
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x424e37
xor eax, eax
pop esi
pop ebp
ret