joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x425d49
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x425db6
xor ebx, ebx
test eax, 0x4000
je 0x425d8b
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_DecryptFileW]
test eax, eax
jne 0x425d8b
mov ecx, dword [ebp + 4]
mov edx, 0xd6
push 0x405004
call fcn.0040752b
jmp 0x425db8
cmp word [edi], bx
je 0x425db6
mov edx, edi
mov ecx, esi
call fcn.004255a2
mov esi, eax
test esi, esi
jns 0x425db6
mov ecx, dword [ebp + 4]
mov edx, 0xdc
push esi
push 0x405004
call fcn.0040750c
mov eax, esi
jmp 0x425db8
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x427154
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x427191
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x42718a
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x427196
add edx, 0x28
cmp edx, esi
jne 0x42717b
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x427193

Function at 0x427740
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0x42777f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42777f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42777f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42777f
cmp dword [ecx + 0x74], 0xe
jbe 0x42777f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x20332403
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x28243329
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401e20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor esi, esi
mov eax, dword [0x4328d0]
mov dword [0x43355c], 3
mov dword [0x433564], esi
mov dword [0x433570], 0x3e8
mov dword [0x433560], esi
lea ecx, [eax + 1]
mov dword [0x43356c], eax
mov dword [0x4328d0], ecx
push 0x433558
push dword [0x433574]
call edi
push 0x64
push dword [0x433578]
call ebx
cmp eax, 0x102
je 0x401e34
push dword [0x433578]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [0x43355c], 1
mov dword [0x433564], esi
mov dword [0x433570], esi
mov dword [0x433560], 5
mov dword [0x433578], esi
mov dword [0x43356c], esi
push 0x433558
push dword [0x433574]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push esi
push esi
push esi
push 0x401d70
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x401eeb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x402270
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10014
call fcn.0041ffa0
mov ecx, dword [0x43200c]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
xor ebx, ebx
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov dword [edx], ebx
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp eax, 0xffffffff
je 0x402469
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
cmp eax, 0xffffffff
je 0x40245a
xor ebx, ebx
push ebx
mov dword [ebp - 0x1001c], esi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push ebx
mov dword [ebp - 0x10018], edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp esi, 0xffffffff
je 0x402449
mov edi, esi
mov ecx, dword [ebp - 0x10018]
mov esi, dword [ebp - 0x1001c]
cmp eax, 0xffffffff
je 0x40245a
cmp edi, eax
jne 0x402457
mov dword [ebp - 0x10020], edi
shr edi, 0xf
je 0x4023ca
lea ebx, [ebp - 0x8010]
push 0
lea eax, [ebp - 0x10014]
push eax
push 0x8000
mov esi, ebx
push ebx
push dword [ebp - 0x1001c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ebx, ebx
test eax, eax
je 0x402449
cmp dword [ebp - 0x10014], 0x8000
jne 0x402449
push 0
lea eax, [ebp - 0x10014]
push eax
push 0x8000
lea eax, [ebp - 0x10010]
push eax
push dword [ebp - 0x10018]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402449
cmp dword [ebp - 0x10014], 0x8000
jne 0x402449
push 0x8000
lea eax, [ebp - 0x10010]
push eax
mov ebx, esi
push esi
call fcn.0040ee27
add esp, 0xc
test eax, eax
jne 0x402446
dec edi
jne 0x402334
mov esi, dword [ebp - 0x10020]
and esi, 0x7fff
je 0x40243d
lea edi, [ebp - 0x10014]
lea eax, [ebp - 0x8010]
push 0
push edi
push esi
push eax
push dword [ebp - 0x1001c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ebx, ebx
test eax, eax
je 0x402449
cmp dword [ebp - 0x10014], esi
jne 0x402449
lea ecx, [ebp - 0x10010]
push 0
push edi
mov edi, ecx
push esi
push ecx
push dword [ebp - 0x10018]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402449
cmp dword [ebp - 0x10014], esi
jne 0x402449
push esi
push edi
lea eax, [ebp - 0x8010]
push eax
call fcn.0040ee27
add esp, 0xc
test eax, eax
jne 0x402446
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10018]
mov esi, dword [ebp - 0x1001c]
jmp 0x40245a
xor ebx, ebx
inc ebx
mov eax, ecx
inc eax
cmp eax, 2
jb 0x402469
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
inc eax
cmp eax, 2
jb 0x402478
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040dec1
mov eax, ebx
add esp, 0x10014
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403e10
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], edx
mov ebx, ecx
mov eax, dword [0x43200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
push eax
call fcn.0040d784
add esp, 4
mov esi, eax
push eax
push edi
xor eax, eax
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x403e92
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov dword [eax], esi
push ecx
push eax
push 0x42cf90
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x403ebd
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
xor edi, edi
inc edi
movzx ecx, word [eax + 0xa]
mov dword [edx], ecx
mov ecx, dword [ebp + 8]
movzx edx, word [eax + 8]
mov dword [ecx], edx
mov ecx, dword [ebp + 0xc]
movzx edx, word [eax + 0xe]
mov dword [ecx], edx
mov ecx, dword [ebp + 0x10]
movzx eax, word [eax + 0xc]
mov dword [ecx], eax
jmp 0x403ef5
mov ecx, dword [0x432a44]
mov edx, dword fs:[0x2c]
mov eax, dword [0x43378c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x403f12
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_obtain_file_info_of_old_service.____d_
jmp 0x403ee6
mov ecx, dword [0x432a44]
mov edx, dword fs:[0x2c]
mov eax, dword [0x43378c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x403f51
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_query_file_version_info_of_old_service.____d_
push 0x433580
call fcn.0040aea0
add esp, 0xc
xor edi, edi
push esi
call fcn.0040d78d
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040dec1
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x43378c
call fcn.0040d7c7
add esp, 4
cmp dword [0x43378c], 0xffffffff
jne 0x403eaf
mov dword [0x433580], 0
push 0x401f00
call fcn.0040da3c
add esp, 4
push 0x43378c
call fcn.0040d819
add esp, 4
jmp 0x403eaf
push 0x43378c
call fcn.0040d7c7
add esp, 4
cmp dword [0x43378c], 0xffffffff
jne 0x403eda
mov dword [0x433580], 0
push 0x401f00
call fcn.0040da3c
add esp, 4
push 0x43378c
call fcn.0040d819
add esp, 4
jmp 0x403eda
Function at 0x403fa0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [0x43200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
push 0xf003f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
je 0x404055
mov esi, eax
push 0xf01ff
push str.MozillaMaintenance
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x40408f
mov edi, eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], esi
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40402c
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push dword [ebp - 0x14]
call ebx
cmp dword [ebp - 0x28], 1
je 0x40402c
mov eax, dword [ebp - 0x14]
lea esi, [esi + eax + 0xa]
cmp esi, 0xea60
ja 0x40402c
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x404003
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
test eax, eax
jne 0x404049
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x430
sete bl
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x30]
jmp 0x4040c7
mov ecx, dword [0x432a44]
mov edx, dword fs:[0x2c]
mov eax, dword [0x43378c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4040e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_service_manager.____d_
push 0x433580
call fcn.0040aea0
add esp, 0xc
xor ebx, ebx
jmp 0x4040ce
mov ecx, dword [0x432a44]
mov edx, dword fs:[0x2c]
mov eax, dword [0x43378c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x404125
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_service.____d_
push 0x433580
call fcn.0040aea0
add esp, 0xc
xor ebx, ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040dec1
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x43378c
call fcn.0040d7c7
add esp, 4
cmp dword [0x43378c], 0xffffffff
jne 0x404072
mov dword [0x433580], 0
push 0x401f00
call fcn.0040da3c
add esp, 4
push 0x43378c
call fcn.0040d819
add esp, 4
jmp 0x404072
push 0x43378c
call fcn.0040d7c7
add esp, 4
cmp dword [0x43378c], 0xffffffff
jne 0x4040ac
mov dword [0x433580], 0
push 0x401f00
call fcn.0040da3c
add esp, 4
push 0x43378c
call fcn.0040d819
add esp, 4
jmp 0x4040ac
Function at 0x4052c0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x210
mov eax, dword [0x43200c]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp word [ecx], 0
je 0x4053b0
mov esi, ecx
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x405336
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x405336
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x405336
mov ecx, dword [0x432a44]
mov edx, dword fs:[0x2c]
mov eax, dword [0x43378c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4053c4
push esi
push str.Could_not_delete_service_updater_path:__ls.
push 0x433580
call fcn.0040aea0
add esp, 0xc
lea edi, [ebp - 0x216]
push 0x20a
push 0
push edi
call fcn.0040fdd0
add esp, 0xc
push str.updater.ini
push esi
push edi
call fcn.0040b490
add esp, 0xc
test eax, eax
je 0x4053b0
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4053b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x4053b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4053b0
mov ecx, dword [0x432a44]
mov edx, dword fs:[0x2c]
mov eax, dword [0x43378c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x405407
push edi
push str.Could_not_delete_service_updater_INI_path:__ls.
push 0x433580
call fcn.0040aea0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040dec1
add esp, 0x210
pop esi
pop edi
pop ebp
ret
push 0x43378c
call fcn.0040d7c7
add esp, 4
cmp dword [0x43378c], 0xffffffff
jne 0x405323
mov dword [0x433580], 0
push 0x401f00
call fcn.0040da3c
add esp, 4
push 0x43378c
call fcn.0040d819
add esp, 4
jmp 0x405323
push 0x43378c
call fcn.0040d7c7
add esp, 4
cmp dword [0x43378c], 0xffffffff
jne 0x40539d
mov dword [0x433580], 0
push 0x401f00
call fcn.0040da3c
add esp, 4
push 0x43378c
call fcn.0040d819
add esp, 4
jmp 0x40539d
Function at 0x409340
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [0x43200c]
mov esi, ecx
mov edi, edx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 8]
lea ecx, [eax + 1]
cmp ecx, 2
jae 0x409431
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne 0x40943d
mov edx, dword [edi + 4]
test eax, eax
je 0x409447
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi + 4], eax
mov dword [esi], 2
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
jne 0x409453
xor eax, eax
push eax
push 0x2000000
push 3
push eax
push 1
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x409464
mov ebx, eax
lea edi, [ebp - 0x44]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor edx, edx
cmp dword [edi + 0x28], 1
mov ecx, 2
seta dl
test eax, eax
mov eax, ebx
cmovne ecx, edx
mov edi, 2
mov dword [esi], edi
mov ebx, dword [esi + 4]
mov edx, ebx
shr edx, 0xa
and edx, 1
cmp ebx, 0xffffffff
cmove edx, edi
xor edi, edi
test ecx, ecx
je 0x40940e
cmp edx, 1
jne 0x40946b
mov dword [esi], edi
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x40941f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040dec1
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409366
mov word [ecx], 0
jmp 0x409382
mov ecx, esi
call fcn.00409dd0
jmp 0x409397
xor ebx, ebx
test byte [esi + 4], 0x10
jne 0x4093a9
jmp 0x4093cb
mov ecx, 2
jmp 0x4093eb
cmp ecx, 1
jne 0x409410
test edx, edx
jne 0x409410
xor edi, edi
inc edi
jmp 0x40940e
Function at 0x409480
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x43200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
test byte [ecx + 4], 0x10
jne 0x4094a3
mov eax, dword [ecx + 8]
xor edi, edi
cmp eax, 0xffffffff
jne 0x4094c0
xor eax, eax
push eax
push 0x2000000
push 3
push eax
push 1
push 0x20000
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
xor ecx, ecx
lea esi, [ebp - 0x18]
lea edx, [ebp - 0x14]
mov dword [edx], ecx
mov dword [esi], ecx
push esi
push ecx
push edx
push ecx
push ecx
push 4
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
mov ecx, dword [esi]
cmp eax, 5
jne 0x409513
xor esi, esi
test ecx, ecx
je 0x4094f0
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [edi + 1]
cmp eax, 2
jb 0x4094ff
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040dec1
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
test eax, eax
mov esi, 2
jne 0x4094e5
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4094e5
mov dword [ebp - 0x24], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], 2
add edi, 0x20
mov esi, dword [edi - 0xc]
lea ecx, [ebp - 0x1c]
push ecx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetEffectiveRightsFromAclW]
test eax, eax
jne 0x40962f
mov eax, esi
mov ebx, 0xefe0fe00
mov ecx, 0x1f01ff
and eax, ebx
or eax, ecx
bt esi, 0x1c
cmovae eax, esi
mov esi, 0x1f01ff
mov ecx, eax
and ecx, 0x7fedff76
or ecx, 0x120089
test eax, eax
cmovns ecx, eax
mov edx, ecx
and edx, 0xbfedfee9
or edx, 0x120116
bt ecx, 0x1e
cmovae edx, ecx
mov ecx, dword [ebp - 0x1c]
mov eax, edx
and eax, 0xdfedff5f
or eax, 0x1200a0
bt edx, 0x1d
cmovae eax, edx
mov edx, ecx
and edx, ebx
or edx, esi
mov esi, ecx
and esi, 0x10000000
cmove edx, ecx
test edx, edx
js 0x4095c0
test esi, esi
je 0x4095d6
mov ecx, edx
and ecx, 0x7fedff76
or ecx, 0x120089
test edx, edx
cmovns ecx, edx
mov dword [ebp - 0x1c], ecx
mov edx, ecx
mov esi, ecx
and esi, 0xbfedfee9
and edx, 0x40000000
or esi, 0x120116
test edx, edx
cmove esi, ecx
mov ebx, esi
mov ecx, esi
and ecx, 0xdfedff5f
and ebx, 0x20000000
or ecx, 0x1200a0
test ebx, ebx
cmove ecx, esi
or ebx, edx
je 0x409613
mov dword [ebp - 0x1c], ecx
and ecx, eax
cmp ecx, eax
jne 0x409648
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x409653
mov eax, dword [ebp - 0x14]
add edi, 0x20
dec ecx
mov dword [ebp - 0x28], ecx
jmp 0x409536
mov edi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
cmp eax, 5
je 0x4094e3
mov esi, 2
jmp 0x4094e5
mov edi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
jmp 0x4094e3
mov edi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
xor esi, esi
inc esi
jmp 0x4094e5
Function at 0x4096f0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x43200c]
mov esi, ecx
mov edi, edx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 8]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x409719
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], 0xffffffff
mov eax, dword [edi + 4]
test al, 1
jne 0x40972c
cmp eax, 0xffffffff
jne 0x409746
mov ecx, eax
and ecx, 0xfffffffe
cmp eax, 0xffffffff
mov eax, 0x80
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edi, edi
lea ebx, [ebp - 0x18]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov eax, dword [esi]
inc eax
push dword [esi + 4]
push 0x42d082
push eax
push ebx
call fcn.00407bd0
add esp, 0x10
mov ebx, dword [ebx + 4]
lea eax, [ebp - 0x38]
mov dword [eax], edi
mov dword [eax + 4], 3
mov dword [eax + 8], ebx
mov dword [eax + 0xc], edi
mov word [eax + 0x10], 0x654
mov dword [eax + 0x1a], edi
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, 0xfffffffd
je 0x4097b2
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4097b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test ebx, ebx
mov dword [ebp - 0x14], 0
je 0x4097c6
push ebx
call fcn.0040d78d
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040dec1
mov eax, edi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409dd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x43200c]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], edx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov edi, 2
mov dword [esi + 4], eax
shr ecx, 4
and ecx, 1
cmp eax, 0xffffffff
cmovne edi, ecx
cmp edi, 2
je 0x409f50
cmp edi, 1
jne 0x409eba
push 0x20a
call fcn.0040d784
add esp, 4
mov ebx, eax
add eax, 2
xor ecx, ecx
push 0x208
push ecx
push eax
call fcn.0040fdd0
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x14], ebx
mov word [ebx], 0
mov dword [ebp - 0x18], eax
push ebx
push str.mozlock.
push dword [ebp - 0x1c]
call fcn.0040c2c0
add esp, 0xc
test eax, eax
je 0x409f2e
push ebx
call fcn.00416709
add esp, 4
lea ebx, [esi + 0xc]
lea ecx, [ebp - 0x18]
mov edx, ebx
mov dword [ecx], eax
call fcn.00409d40
test eax, eax
js 0x409f2e
xor eax, eax
cmp dword [ebx], 0
je 0x409f2e
push eax
push 0x4000000
push 4
push eax
push eax
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov eax, dword [esi + 8]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x409eb3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov bl, 1
jmp 0x409f30
xor eax, eax
push eax
push 0x80
push 3
push eax
push eax
push 0x60000
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov eax, dword [esi + 8]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x409ee8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
cmp ebx, 0xffffffff
je 0x409f50
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov edx, 2
mov dword [esi + 4], eax
shr ecx, 4
and ecx, 1
cmp eax, 0xffffffff
cmovne edx, ecx
cmp edi, edx
je 0x409f50
mov eax, dword [esi + 8]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x409f25
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
jmp 0x409f50
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], 0
test eax, eax
je 0x409f47
push eax
call fcn.0040d78d
add esp, 4
test bl, bl
je 0x409f50
mov ebx, dword [esi + 8]
jmp 0x409eeb
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040dec1
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret