joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe37e00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0xe4d8f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push esi
push ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0xe37ed2
lea edx, [esp + 0x24]
push eax
push edx
call fcn.00e347a0
add esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0xe37e61
mov edx, dword [eax]
jmp 0xe37e63
xor edx, edx
xor ecx, ecx
push edi
xor eax, eax
push edx
push ecx
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 4]
push eax
push esi
push 2
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.00e36050
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, edi
mov dword [esp + 0x1c], 0xffffffff
je 0xe37ebf
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0xe37ebf
cmp esi, edi
je 0xe37ebf
mov ecx, esi
call fcn.00e2fa00
push esi
call fcn.00e3d1c8
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.00e34990
add esp, 0xc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 1
cmp eax, edi
je 0xe37ef5
mov eax, dword [eax]
jmp 0xe37ef7
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
push ebx
push esi
push eax
push ecx
push edx
call fcn.00e33640
add esp, 0x10
mov bl, al
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0xe37f25
mov eax, dword [eax]
jmp 0xe37f27
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
cmp esi, edi
je 0xe37f76
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0xe37f76
cmp esi, edi
je 0xe37f76
mov eax, dword [esi]
cmp eax, edi
je 0xe37f5d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0xe37f6d
push eax
call fcn.00e3d1c8
add esp, 4
push esi
call fcn.00e3d1c8
add esp, 4
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xe37f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0xe37ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xe38035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.00e37e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0xe37fc5
mov edi, 0xe528b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xe38035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00e37e00
add edi, 4
add esp, 0xc
cmp edi, 0xe528c0
jb 0xe38000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret
Function at 0xe38f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xe4d9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xe39002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00e3cdff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xe39002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00e346e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00e3d20b
push 0x10
call fcn.00e3d1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xe38fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00e291c0
jmp 0xe38fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00e38b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xe38ff0
mov ecx, edi
call fcn.00e292c0
push edi
call fcn.00e3d1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xe39021
inc ebx
cmp ebx, 0x20
jb 0xe38f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xe3a250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe4e808
push 0xe3e288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xe3a329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xe3a329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00e3d1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xe3a329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xe3a329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xe3a32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00e3a351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xe3b000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xe3b131
push esi
call fcn.00e3e145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00e2d080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xe3b131
push 0
push ebp
call fcn.00e2d3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00e2d260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xe3b08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00e2d2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xe3b121
push 0xe53918
push edi
call fcn.00e3c3f0
push eax
push ebx
push esi
call fcn.00e3af60
push 0xe538f8
push edi
call fcn.00e3c3f0
push eax
push ebx
push esi
call fcn.00e3af60
push 0xe538d8
push edi
call fcn.00e3c3f0
push eax
push ebx
push esi
call fcn.00e3af60
push 0xe538c0
push edi
call fcn.00e3c3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00e3af60
push 0xe538a0
push edi
call fcn.00e3c3f0
push eax
push ebx
push esi
call fcn.00e3af60
push 0xe53888
push edi
call fcn.00e3c3f0
push eax
push ebx
push esi
call fcn.00e3af60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xe3c1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00e3c140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00e3c140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00e3c140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00e3c140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xe3cbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xe3cc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xe4e87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xe3cc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xe3cc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40141d
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x214
lea eax, [esp]
push ebp
push esi
mov esi, dword [esp + 0x228]
push edi
mov edi, dword [esp + 0x22c]
and esi, 1
push eax
and edi, 0x300
mov eax, edi
or eax, 9
push eax
push dword [esp + 0x230]
push dword [esp + 0x230]
call fcn.004062db
test eax, eax
jne 0x40152f
xor ebp, ebp
test byte [esp + 0x22c], 2
je 0x401492
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebp
push eax
lea eax, [esp + 0x28]
push eax
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x40150b
push 0x105
lea eax, [esp + 0x18]
push eax
push ebp
push dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
call ebp
test eax, eax
jne 0x4014e0
test esi, esi
jne 0x40150b
push dword [esp + 0x22c]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call fcn.0040141d
test eax, eax
jne 0x4014e0
push 0x105
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x18]
call ebp
test eax, eax
je 0x4014b1
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004068eb
test eax, eax
jne 0x40151c
push dword [esp + 0x228]
push dword [esp + 0x228]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x40152f
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x40152f
push 0
push edi
push dword [esp + 0x230]
push dword [esp + 0x230]
call eax
pop edi
pop esi
pop ebp
add esp, 0x214
ret 0xc
Function at 0x403144
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x9c
mov ecx, dword [esp + 0xa0]
mov eax, 0x4189e0
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xb8]
mov ebx, 0x8000
test edi, edi
cmovne ebx, dword [esp + 0xbc]
xor esi, esi
test edi, edi
cmovne eax, edi
mov dword [esp + 0x1c], eax
test ecx, ecx
js 0x40318c
mov eax, dword [0x429578]
add eax, ecx
push eax
call fcn.0040312d
push 4
lea eax, [esp + 0x14]
push eax
push dword [0x40a010]
call fcn.0040694d
test eax, eax
je 0x403350
mov eax, dword [esp + 0x10]
test eax, eax
jns 0x4032f2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40c958
mov dword [esp + 0x14], eax
call fcn.00407c8f
mov eax, dword [esp + 0x10]
and eax, 0x7fffffff
mov ecx, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], ecx
jbe 0x4032ea
mov ebp, 0x4000
cmp ecx, ebp
cmovl ebp, ecx
push ebp
push 0x4149e0
call fcn.00403117
test eax, eax
je 0x403350
sub dword [esp + 0x10], ebp
mov dword [0x40c974], ebp
mov ebp, dword [esp + 0x1c]
mov dword [0x40c970], 0x4149e0
mov ecx, 0x40c958
mov dword [0x40c978], ebp
mov dword [0x40c97c], ebx
call fcn.00406eab
mov dword [esp + 0x28], eax
test eax, eax
js 0x4032ee
mov eax, dword [0x40c978]
sub eax, ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x429614], 1
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
je 0x4032a3
sub eax, dword [esp + 0x14]
cmp eax, 0xc8
ja 0x403267
test ecx, ecx
jne 0x4032a3
mov eax, dword [esp + 0x20]
push eax
push 0x64
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [esp + 0x30]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
push 0
call fcn.00405d55
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4032e2
test edi, edi
jne 0x4032c7
push eax
push ebp
push dword [esp + 0xbc]
call fcn.00406a10
test eax, eax
je 0x403335
mov eax, dword [esp + 0x18]
jmp 0x4032d3
mov ebp, dword [0x40c978]
sub ebx, eax
mov dword [esp + 0x1c], ebp
add esi, eax
cmp dword [esp + 0x28], 1
jne 0x403214
jmp 0x4032ea
test ecx, ecx
jg 0x4031df
mov eax, esi
jmp 0x403353
push 0xfffffffffffffffc
jmp 0x403352
test edi, edi
jne 0x403339
test eax, eax
jle 0x4032ea
mov ebp, 0x4149e0
cmp eax, ebx
mov edi, ebx
cmovl edi, eax
push edi
push ebp
call fcn.00403117
test eax, eax
je 0x403350
push edi
push ebp
push dword [esp + 0xbc]
call fcn.00406a10
test eax, eax
je 0x403335
mov eax, dword [esp + 0x10]
add esi, edi
sub eax, edi
mov dword [esp + 0x10], eax
test eax, eax
jg 0x4032ff
jmp 0x4032ea
push 0xfffffffffffffffe
jmp 0x403352
mov esi, dword [esp + 0xbc]
cmp eax, esi
cmovl esi, eax
push esi
push edi
call fcn.00403117
test eax, eax
jne 0x4032ea
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret 0x10
Function at 0x403360
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0
je 0x40337f
mov eax, dword [0x40c950]
test eax, eax
je 0x403377
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40c950], 0
ret
cmp dword [0x40c950], 0
je 0x403390
push 0
call fcn.00406212
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x429520]
jbe 0x4033c3
push 0
push 0x403626
push 0
push 0x6f
push dword [0x428514]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x40c950], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4033c4
Capabilities:
Get file size

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x400
mov esi, 0x437800
add eax, 0x3e8
push esi
push ebx
mov dword [0x429520], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 3
push 0x80000000
push esi
call fcn.00406920
mov ebp, eax
mov dword [0x40a010], ebp
cmp ebp, 0xffffffff
jne 0x40341d
mov eax, 0x4082cc
jmp 0x40361c
push esi
mov esi, 0x435800
push esi
call fcn.00406b1f
push esi
call fcn.00406d15
push eax
push 0x438000
call fcn.00406b1f
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [0x40c948], esi
test esi, esi
je 0x403549
mov ebx, dword [esp + 0x38]
cmp dword [0x429528], 0
mov eax, 0x8000
mov edi, 0x200
cmovne edi, eax
cmp esi, edi
cmovb edi, esi
push edi
push 0x40c9e0
call fcn.00403117
test eax, eax
je 0x40360f
cmp dword [0x429528], 0
jne 0x40350b
push 0x1c
push 0x40c9e0
lea eax, [esp + 0x20]
push eax
call fcn.004066b9
test dword [esp + 0x18], 0xfffffff0
jne 0x403518
cmp dword [esp + 0x1c], 0xdeadbeef
jne 0x403518
cmp dword [esp + 0x28], 0x74736e49
jne 0x403518
cmp dword [esp + 0x24], 0x74666f73
jne 0x403518
cmp dword [esp + 0x20], 0x6c6c754e
jne 0x403518
mov eax, dword [0x40c94c]
or ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
mov dword [0x429528], eax
mov eax, ebx
and eax, 2
or dword [0x429600], eax
cmp ecx, esi
ja 0x403617
mov eax, ebx
and al, 0xc
cmp al, 4
je 0x403541
inc dword [esp + 0x10]
lea esi, [ecx - 4]
cmp edi, esi
jbe 0x403518
mov edi, esi
jmp 0x403518
test bl, 2
jne 0x403518
push 0
call fcn.00403360
pop ecx
cmp esi, dword [0x40c948]
jae 0x403533
push edi
push 0x40c9e0
push dword [esp + 0x1c]
call fcn.00406e3f
mov dword [esp + 0x14], eax
add dword [0x40c94c], edi
sub esi, edi
jne 0x403457
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push 1
call fcn.00403360
cmp dword [0x429528], 0
pop ecx
je 0x403617
test ebx, ebx
je 0x403591
push dword [0x40c94c]
call fcn.0040312d
push 4
lea eax, [esp + 0x3c]
push eax
push dword [0x40a010]
call fcn.0040694d
test eax, eax
je 0x403617
cmp edi, dword [esp + 0x38]
jne 0x403617
push dword [esp + 0x2c]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [0x429528]
mov esi, eax
add ecx, 0x1c
push ecx
call fcn.0040312d
push dword [esp + 0x2c]
xor ebx, ebx
push esi
push ebx
push 0xffffffffffffffff
call fcn.00403144
cmp eax, dword [esp + 0x2c]
jne 0x403617
test byte [esp + 0x18], 1
mov dword [0x429530], esi
mov eax, dword [esi]
mov dword [0x42952c], eax
je 0x4035dd
inc dword [0x429524]
push 8
pop ecx
lea eax, [esi + 0x44]
lea eax, [eax - 8]
add dword [eax], esi
sub ecx, 1
jne 0x4035e3
push 1
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x3c], eax
lea eax, [esi + 4]
push 0x40
push eax
push 0x429540
call fcn.004066b9
xor eax, eax
jmp 0x40361c
push 1
call fcn.00403360
pop ecx
mov eax, 0x4082e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x405e39
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x405e53
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4
Function at 0x4061a7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
lea eax, [ebp - 0x23c]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
cmp eax, esi
pop esi
cmovbe ecx, eax
lea eax, [ebp - 0x23c]
lea eax, [eax + ecx*2]
test ecx, ecx
je 0x4061e5
cmp word [eax - 2], 0x5c
mov ecx, 0x4082a8
jne 0x4061ea
mov ecx, 0x4082aa
push dword [ebp + 8]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406240
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406263
push dword [esp + 8]
push dword [esp + 8]
call fcn.00406309
pop ecx
pop ecx
inc dword [0x4295f0]
ret 8

Function at 0x406309
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, 0x400
mov dword [0x426668], 0x55004e
mov ebp, 0x426668
mov dword [0x42666c], 0x4c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
je 0x40635f
push 1
push 0
push esi
call fcn.00406920
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x40643f
cmp eax, ebx
jg 0x40643f
push ebx
mov esi, 0x425e68
push esi
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x40643f
cmp eax, ebx
jg 0x40643f
push esi
push ebp
push str._ls_ls_r_n
push 0x425a68
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x429530]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.00405eb4
push 4
push 0xc0000000
push esi
call fcn.00406920
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40643f
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [esi + 0xa]
add ecx, ebp
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x406438
push esi
push edi
push ebx
call fcn.0040694d
test eax, eax
je 0x406438
push str._Rename__r_n
push edi
call fcn.00406b3b
test eax, eax
jne 0x406444
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x425a68
lea eax, [ecx + edi]
push eax
call fcn.004066b9
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.00406a10
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x408834
add eax, 0xa
push eax
call fcn.00406b3b
mov ecx, eax
test ecx, ecx
je 0x406409
lea edx, [edi + esi]
jmp 0x406463
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x40645d
sub ecx, edi
inc ecx
jmp 0x40640b
Function at 0x406588
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00406ba2
mov edi, eax
cmp edi, 0xffffffff
je 0x4065be
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x4065c5
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4065cd
test byte [ebp + 0xc], 4
jne 0x4065be
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4065aa
xor eax, eax
inc eax
jmp 0x4065c0

Function at 0x40663b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x425268
push ebx
call fcn.00406b1f
push ebx
call fcn.00406bca
mov esi, eax
test esi, esi
je 0x4066b2
push esi
call fcn.00406d42
test byte [0x42952c], 0x80
je 0x406674
movzx eax, word [esi]
test ax, ax
je 0x4066b2
cmp eax, 0x5c
je 0x4066b2
sub esi, ebx
sar esi, 1
jmp 0x40668e
call fcn.004065d2
test eax, eax
je 0x406688
test byte [eax], 0x10
je 0x4066b2
push ebx
call fcn.00406d15
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
cmp eax, esi
jg 0x40667a
call fcn.00406559
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x4066b4
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x4066db
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x424a20], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x424a20
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40671a
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4