joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448430
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
jne 0x448483
cmp dword [esi + 4], 0
jne 0x44848c
call fcn.00435458
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call fcn.00433e27
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x448487
mov edx, dword [esi + 0x40]
push edx
mov dword [esi + 0x3c], 1
call fcn.0044cec4
add esp, 4
test eax, eax
je 0x448483
mov dword [esi + 0x38], 0xffffffff
or eax, 0xffffffff
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
dec dword [esi + 4]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
ret

Function at 0x4484a0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, eax
push edi
mov edi, dword [esi + 4]
cmp edi, 2
jae 0x448515
test edi, edi
je 0x4484b9
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov dl, byte [eax]
mov byte [ecx], dl
call fcn.00435458
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, edi
push eax
mov eax, dword [esi + 0x44]
mov edx, 0x4000
sar edx, cl
add eax, edi
push edx
push 1
push eax
call fcn.00433e27
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4484ff
mov ecx, dword [esi + 0x40]
push ecx
call fcn.0044cec4
add esp, 4
test eax, eax
je 0x4484ff
mov dword [esi + 0x38], 0xffffffff
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov edx, dword [esi + 0x44]
mov dword [esi], edx
cmp eax, 2
jae 0x448515
pop edi
mov dword [esi + 0x58], eax
pop esi
ret
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x4485ee
cmp byte [eax + 1], 0x8b
jne 0x4485ee
add dword [esi + 4], 0xfffffffe
add eax, 2
push ebx
mov dword [esi], eax
call fcn.00448430
mov edi, eax
call fcn.00448430
mov ebx, eax
cmp edi, 8
jne 0x4485e3
test bl, 0xe0
jne 0x4485e3
mov edi, 6
lea esp, [esp]
call fcn.00448430
sub edi, 1
jne 0x448560
test bl, 4
je 0x448591
call fcn.00448430
mov edi, eax
call fcn.00448430
shl eax, 8
add edi, eax
mov eax, edi
dec edi
test eax, eax
je 0x448591
call fcn.00448430
cmp eax, 0xffffffff
jne 0x448580
test bl, 8
je 0x4485a4
call fcn.00448430
test eax, eax
je 0x4485a4
cmp eax, 0xffffffff
jne 0x448596
test bl, 0x10
je 0x4485be
lea esp, [esp]
call fcn.00448430
test eax, eax
je 0x4485be
cmp eax, 0xffffffff
jne 0x4485b0
test bl, 2
je 0x4485d2
mov edi, 2
call fcn.00448430
sub edi, 1
jne 0x4485c8
mov ecx, dword [esi + 0x3c]
neg ecx
sbb ecx, ecx
pop ebx
and ecx, 0xfffffffd
pop edi
mov dword [esi + 0x38], ecx
pop esi
ret
pop ebx
pop edi
mov dword [esi + 0x38], 0xfffffffd
pop esi
ret
pop edi
mov dword [esi + 0x58], 1
pop esi
ret
Function at 0x4486b0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x44875b
cmp byte [esi + 0x5c], 0x77
jne 0x44875b
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
mov dword [esi], ebp
mov dword [esi + 4], edi
test edi, edi
je 0x448741
lea ebx, [ebx]
cmp dword [esi + 0x10], 0
jne 0x44870a
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call fcn.004320c5
add esp, 0x10
cmp eax, 0x4000
jne 0x44873a
mov dword [esi + 0x10], eax
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x10]
add dword [esi + 0x64], edx
add dword [esi + 0x68], eax
push 0
push esi
call fcn.00449ac0
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x10]
sub dword [esi + 0x64], ecx
sub dword [esi + 0x68], edx
add esp, 8
mov dword [esi + 0x38], eax
test eax, eax
jne 0x448741
test ecx, ecx
jne 0x4486e0
jmp 0x448741
mov dword [esi + 0x38], 0xffffffff
mov eax, dword [esi + 0x4c]
push edi
push ebp
push eax
call fcn.00449a20
add esp, 0xc
mov dword [esi + 0x4c], eax
mov eax, edi
sub eax, dword [esi + 4]
pop edi
pop ebp
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x448770
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x448824
cmp byte [esi + 0x5c], 0x77
jne 0x448824
mov dword [esi + 4], ebx
push edi
lea esp, [esp]
mov edi, 0x4000
sub edi, dword [esi + 0x10]
je 0x4487be
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
push eax
push edi
push 1
push ecx
call fcn.004320c5
add esp, 0x10
cmp eax, edi
jne 0x44881a
mov edx, dword [esi + 0x48]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x4000
test ebx, ebx
jne 0x44880a
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push ecx
push esi
call fcn.00449ac0
mov ecx, dword [esi + 0x10]
sub dword [esi + 0x68], ecx
add esp, 8
mov dword [esi + 0x38], eax
test edi, edi
jne 0x4487eb
cmp eax, 0xfffffffb
jne 0x4487eb
mov dword [esi + 0x38], edi
test ecx, ecx
jne 0x4487f9
cmp dword [esi + 0x38], 1
je 0x4487f9
xor ebx, ebx
jmp 0x4487fe
mov ebx, 1
mov eax, dword [esi + 0x38]
test eax, eax
je 0x448790
cmp eax, 1
je 0x448790
mov esi, dword [esi + 0x38]
mov eax, esi
dec eax
neg eax
sbb eax, eax
pop edi
and eax, esi
pop esi
pop ebx
ret
or eax, 0xffffffff
pop edi
mov dword [esi + 0x38], eax
pop esi
pop ebx
ret
pop esi
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x49bb68
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
xor eax, 0xbf4c25b5
jl 0x484daf
invalid
or dword ds:[eax + reloc.MSVBVM60.DLL___vbaVarTstGt], ebp
add al, 0xe9
dec ebx
xor eax, 0x7b7e0003
mul dword [edi + 2]
int1
push 0xffffffffffffff85
xor al, 0x27
dec esi
fxch st(4)
int3
call 0x484db3
fmul qword [edi + ecx*4]
pop ds
jp 0x484d84
push ebp
stosb byte es:[edi], al
and byte [esi - 0x221edf2f], dh
sub al, 0x3f
push es
mov cl, 0xcc
int3
maskmovq mm3, mm6
lea esp, [esp + 2]
lea esp, [esp + 0x10]
pushal
lea esp, [esp + 0x20]
jmp fcn.00482cd5
xor al, 0x24
jmp 0x49bb18
lea esp, [esp + 1]
call fcn.0049bb3e
loopne fcn.0049bbdf
loop 0x49bafa
je 0x49bb3a
idiv byte [ecx - 0x17]
mov byte [ebx - 0x34], bh
fdivr dword [ebx]
adc cl, byte [ebp + 0x424648d]
jmp 0x484df0

Function at 0x4b8f87
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.004b90c1
lea ecx, [eax + 4]
test ecx, ecx
jmp 0x4b8fef
jmp 0x4b906d
pushal
mov byte [esp + 0xd], bh
mov byte [esp + 0xc], ch
jmp 0x4b9011
lea esp, [esp + 0x20]
je 0x4b8f3a
call fcn.004b904f
jmp dword [ebx - 0xd]
lea esp, [esp + 4]
je 0x4b8f61
call fcn.004b9042
dec ebx
jb 0x4b90d1
rdtsc
push esp
xchg bh, dh
jmp 0x4b90d3
jmp 0x4b9116
sub ebp, 4
mov dx, word [esp]
xchg edx, eax
xor ax, 0x5854
jge 0x4b90f6
jl 0x4b90f8
je 0x4b90e9
xchg ebx, eax
test byte [0xf0f146c0], 0x8d
and al, 8
rol byte [esi - 0xf], 0xf0
lea esp, [esp + 8]
jmp 0x4b8f3a
jmp 0x4b911d
lea eax, reloc.MSVBVM60.DLL___vbaVarTstGt
jmp 0x4b9123
xchg dh, bl
xchg edx, ebx
neg dh
mov ebx, dword [esp]
setne bl
xchg bh, dh
inc dh
jmp 0x4b9185
rdtsc
push esp
xchg bh, dh
jmp 0x4b90d3
lea eax, reloc.MSVBVM60.DLL___vbaVarTstGt
movzx eax, byte [edi]
sub edx, eax
jns 0x4b9100
js 0x4b9167
mov ebx, dword [esp]
setne bl
jmp 0x4b910c
fisubr word [0xc24cc3e9]
movsd dword es:[edi], dword [esi]
push esp
xchg ecx, eax
pop ecx
mov eax, 0xfcedf29b
push edx
mov edx, ecx
mov dword [edx], eax
pop edx
jmp 0x4b90ed
btr ebx, esp
mov bx, word [esp]
mov dx, word [esp]
mov dl, 0x64
jmp 0x4b91da
xchg dh, bl
xchg edx, ebx
neg dh
jmp 0x4b912c
mov dx, word [esp]
mov dl, 0x64
jmp 0x4b91da
jnp 0x4b914e
btr ebx, esp
mov bx, word [esp]
jmp 0x4b916f
mov bl, al
call 0x4b91c4
clc
outsd dx, dword [esi]
call [edx - 0x7fe93797]
push ss
jno 0x4b9137
inc ebx
test al, 0x3d
lodsd eax, dword [esi]
mov ah, 0x47
xchg dword [eax + ebp*8 + 0xd5], ecx
call 0x4b9299
call fcn.004b925b
or dword [ebx + reloc.MSVBVM60.DLL___vbaVarTstGt], esp
jno 0x4b91b5
jp 0x4b91f0
in al, dx
pop ebx
xchg ecx, eax
adc byte [ebx - 0x3efd5af6], dl
add al, cl
lea ebx, reloc.MSVBVM60.DLL___vbaVarTstGt
mov dx, word [esp]
sub esp, 8
jbe 0x4b91bf
lea ebx, [ebp + 0x5f]
jmp 0x4b91a5
aam 0x47
out dx, al
stc
fmul dword [ebx + reloc.MSVBVM60.DLL___vbaVarTstGt]
mov edx, ebx
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x4b9279
push dword [esp + 4]
ret 8
Function at 0x58103c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 3], eax
pop ebx
xchg dword [esp], eax
neg ebx
mov bx, word [esp + 2]
rdtsc
jmp 0x581092
mov edx, ecx
mov bl, bh
mov cl, ch
mov ax, word [esp + 1]
lea esp, [esp]
xor ecx, esi
jmp 0x580fef
mov si, bx
mov al, 0x6e
rdtsc
neg ah
stc
rcr dh, 7
jmp 0x58100a
xchg ch, dl
push dword [esp]
xchg ecx, ebx
bsr ax, cx
jmp 0x581023
cpuid
inc ax
mov ebx, dword [esp + 3]
mov ebx, 0x63549376
mov eax, ecx
push dword [esp + 1]
jmp 0x5811a9
mov ax, word [esp]
mov bx, word [esp + 1]
bsf ax, si
push word [esp + 1]
push word [esp + 4]
jmp 0x581049
lea eax, [edi*4]
cpuid
pop di
lea ebx, reloc.MSVBVM60.DLL___vbaVarTstGt
cld
cpuid
jmp 0x581075
push dword [esp + 7]
btc ecx, ebx
not dh
bswap eax
mov edx, 0x4ad244f8
lea esp, [esp + 2]
add al, dh
jmp 0x58111c
Function at 0x581c2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 1]
mov cx, 0x806f
jmp 0x581ca0
rdtsc
bswap edx
mov dh, byte [esp + 3]
clc
rdtsc
add esp, 6
call fcn.00581c6e
pushal
invalid
inc ebx
shr ch, 5
clc
cmc
push dword [esp + 6]
stc
jmp 0x581c84

Function at 0x581d49
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], dx
pop di
neg ah
rdtsc
xchg byte [esp], cl
rdtsc
jmp 0x581d68
bsf bx, ax
mov di, 0xef01
bswap edi
xchg dh, al
and edx, ecx
jmp 0x581d4b
xchg esi, eax
mov ecx, dword [esp + 2]
lea ebp, [ebx*4]
pop dx
inc al
jmp 0x581d08
jmp 0x581d30
mov ebx, 0xcda50850
setge ah
mov edx, dword [esp]
and esi, ecx
cmc
xchg ah, bl
jmp 0x581e3b
lea ecx, [ebx + edi]
sete ah
xchg ah, bl
xchg si, ax
btr ebx, edx
add esp, 0
jmp 0x581d19
mov dh, byte [esp + 2]
lea esp, [esp]
mov di, sp
mov word [esp], bx
call fcn.00581d9e
xchg edx, eax
or eax, 0xc3feef9c
inc bl
lea esp, [esp]
and cl, bh
xchg word [esp], cx
stc
xchg bh, cl
jmp 0x581dba
lea edx, [edx + ebp]
mov bl, bh
mov cl, 0xaa
bsr cx, bp
xchg byte [esp], bl
mov dh, byte [esp + 1]
jmp 0x581dd1
setnp dh
bswap ebx
xchg word [esp], dx
bswap edi
clc
rol bp, cl
jmp 0x581df2
push esp
stc
btr eax, edx
add esp, 0
xchg dword [esp], eax
pop si
jmp 0x581e11

Function at 0x58210f
Capabilities:
Execute anti-debugging instructions

Disassembly:
not di
neg di
not edi
inc dl
mov bl, 0x38
xchg cx, bp
jmp 0x58208c
mov dword [esp + 0x10], ecx
mov byte [esp + 0x21], bh
setp ah
neg ch
mov dword [esp + 0x27], ebp
jmp 0x5820af
pop bp
neg bh
cpuid
sub esp, 4
pushal
pop dword [esp + 0x20]
jmp 0x5820dc
push dword [esp + 7]
mov word [esp + 0xa], dx
mov edx, 0xd2910bac
mov word [esp + 7], bx
jmp 0x5820f3

Function at 0x582719
Capabilities:
Get number of processors
Parse pe header

Disassembly:
call fcn.00580cca
pop word [esp + 5]
pushal
lea esp, [esp + 2]
mov dword [esp + 0x7c], edi
lea esp, [esp + 0x7c]
jmp 0x582750
mov eax, dword fs:[0x30]
jmp 0x5827a8
mov eax, dword [eax + 8]
push eax
jmp 0x580cc5
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x582783

Function at 0x58274a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov word [esp + 8], bx
call fcn.00582719
outsd dx, dword [esi]
cli
push 0x4353fa0f
fisttp word [edi + 0x2a]
fstp dword [eax - 0x4e]
lodsd eax, dword [esi]
mov esp, 0x22474ff
push dword [esp + 2]
push dword [esp + 2]
jmp 0x582731
Function at 0x40175e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x4c
mov eax, 0x44fc55
call fcn.0042e622
mov esi, edx
cmp dword [ecx], 1
jne 0x4017ee
lea ecx, [ebp - 0x40]
call fcn.004015eb
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x30], ebx
je 0x4017e6
push ecx
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.00401c58
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00401e90
push eax
lea ecx, [ebp - 0x28]
call fcn.004019d1
lea ecx, [ebp - 0x58]
call fcn.00401a5a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4017ca
test al, 0x10
jne 0x4017de
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.00401a5a
lea ecx, [ebp - 0x40]
call fcn.00401a5a
mov al, bl
jmp 0x4017f0
lea ecx, [ebp - 0x28]
call fcn.00401a5a
lea ecx, [ebp - 0x40]
call fcn.00401a5a
xor al, al
call fcn.0042e5d1
ret

Function at 0x4017f6
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x46b014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, ecx
push 0
push eax
call fcn.00430240
push 0x5c
push edi
call fcn.0042f4cc
add esp, 0x14
jmp 0x40187c
mov ecx, esi
lea eax, [ebp - 0x20c]
sub ecx, edi
sar ecx, 1
inc ecx
push ecx
push edi
push 0x104
push eax
call fcn.00432b5e
add esp, 0x10
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40186f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40186f
cmp eax, 5
jne 0x401892
lea eax, [esi + 2]
push 0x5c
push eax
call fcn.0042f4cc
pop ecx
pop ecx
mov esi, eax
test esi, esi
jne 0x40182d
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042dd4f
leave
ret
xor al, al
jmp 0x401884

Function at 0x401896
Capabilities:
Set registry value

Disassembly:
push ecx
push ecx
mov eax, dword [0x46b014]
xor eax, esp
mov dword [esp + 4], eax
and dword [esp], 0
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, edx
push edi
mov edi, dword [esp + 0x1c]
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x4018bd
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
push 0x20006
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
cmp ebx, 2
jne 0x401907
cmp dword [esi + 0x14], 0x10
jb 0x4018e4
mov esi, dword [esi]
xor ebx, ebx
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40190b
jmp 0x40193d
test ebx, ebx
jne 0x401931
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
jb 0x401916
mov edi, dword [edi]
cmp dword [ebp + 0x14], 0x10
jb 0x40191f
mov ebp, dword [ebp]
push eax
push edi
push 1
push ebx
push ebp
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042dd4f
pop ecx
pop ecx
ret
Function at 0x404ef8
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x46b014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x60]
mov word [ebp - 0x54], 0x500
push eax
xor ebx, ebx
push 8
mov dword [ebp - 0x58], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404f4d
lea eax, [ebp - 0x5c]
push eax
push 0x4c
lea eax, [ebp - 0x50]
push eax
push 1
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0x60]
test eax, eax
jne 0x404f5c
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0042dd4f
leave
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x404f4d
push esi
push dword [ebp - 0x64]
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x64]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, esi
pop esi
jmp 0x404f4f

Function at 0x4050db
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ffb4
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x46b014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0xffffffff
lea edi, [esi + 0x20]
je 0x40515f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4601e8
mov edx, edi
lea ecx, [ebp - 0x40]
call fcn.0040b87b
pop ecx
add esi, 8
mov ecx, eax
push esi
call fcn.0040aa8a
push eax
lea ecx, [ebp - 0x28]
call fcn.0040aac5
lea ecx, [ebp - 0x40]
call fcn.00401bc6
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x28]
call fcn.00401bc6
jmp 0x405162
add esi, 8
mov ecx, edi
call fcn.00401bc6
mov ecx, esi
call fcn.00401bc6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042dd4f
leave
ret
Function at 0x405580
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0x20
mov eax, 0x4500bd
call fcn.0042e622
xor ebx, ebx
lea eax, [ebp + 8]
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x1c], 0x10
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x405671
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x405673
mov edi, ebx
mov esi, 0x461c70
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4055c1
push dword [ebp - 0x2c]
sub esi, ecx
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
push esi
push ecx
push edi
call fcn.0040e0a6
add esp, 0x10
lea ecx, [ebp + 8]
mov edi, eax
lea eax, [ebp - 0x28]
cmp edi, 0xffffffff
cmove edi, dword [ebp + 0x18]
push edi
push ebx
push eax
call fcn.0040a915
cmp dword [ebp - 0x18], ebx
je 0x40565d
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40565d
call fcn.00404cea
xor edx, edx
cmp dword [eax + 8], ebx
lea ecx, [eax + 4]
lea eax, [ebp - 0x28]
cmovne edx, ecx
test edx, edx
je 0x405644
cmp dword [ebp - 0x14], 0x10
push edx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne al
jmp 0x405659
cmp dword [ebp - 0x14], 0x10
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0043959e
neg eax
pop ecx
sbb al, al
inc al
test al, al
je 0x405683
lea ecx, [ebp - 0x28]
inc edi
call fcn.00401bc6
mov edx, dword [ebp + 0x18]
cmp edi, edx
jb 0x4055b9
mov bl, 1
lea ecx, [ebp + 8]
call fcn.00401bc6
mov al, bl
call fcn.0042e5d1
ret
lea ecx, [ebp - 0x28]
call fcn.00401bc6
jmp 0x405673
Function at 0x407b82
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x46b014]
xor eax, ebp
mov dword [ebp + 0x188], eax
push ebx
push esi
xor ebx, ebx
mov dword [0x46d6c4], 1
push 0x208
lea eax, [ebp - 0x80]
mov dword [0x46d6c0], ebx
xorps xmm0, xmm0
mov dword [0x46d6d0], ebx
push ebx
push eax
movlpd qword [0x46d6c8], xmm0
call fcn.00430240
add esp, 0xc
lea eax, [ebp - 0x80]
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x407d1e
push 0x45fac0
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.004344dd
add esp, 0xc
test eax, eax
jne 0x407d1e
push str.LogFilesWMIEndpointSetup.etl
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.004344dd
add esp, 0xc
test eax, eax
jne 0x407d1e
push ebx
push 0x80
push 2
call fcn.00425472
push eax
push 7
push 0x40000000
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x407c4b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x80]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x407c51
sub ecx, edx
sar ecx, 1
push edi
lea edi, [ecx*2 + 2]
lea esi, [edi + 0x94]
push esi
call fcn.00439bde
mov dword [0x46d6d0], eax
pop ecx
test eax, eax
je 0x407d1d
push esi
push ebx
push eax
call fcn.00430240
mov eax, dword [0x46d6d0]
lea ecx, [ebp - 0x80]
add esp, 0xc
mov edx, edi
mov dword [eax], esi
mov eax, dword [0x46d6d0]
push ecx
mov dword [eax + 0x70], 0x78
mov eax, dword [0x46d6d0]
mov dword [eax + 0x6c], 0x94
mov eax, dword [0x46d6d0]
mov ecx, dword [eax + 0x6c]
add ecx, eax
call fcn.00407af6
push dword [0x46d6d0]
push str.EndpointSetup
push 0x46d6c8
call dword [sym.imp.ADVAPI32.dll_StartTraceW]
mov dword [0x46d6c0], eax
test eax, eax
jne 0x407d1d
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffff
push 4
push 1
push 0x461c78
push dword [0x46d6cc]
push dword [0x46d6c8]
call dword [sym.imp.ADVAPI32.dll_EnableTraceEx2]
mov ecx, dword [0x46d6c4]
xor edx, edx
test eax, eax
mov dword [0x46d6c0], eax
cmovne ecx, edx
mov dword [0x46d6c4], ecx
pop edi
mov ecx, dword [ebp + 0x188]
mov eax, 0x46d6c0
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dd4f
add ebp, 0x18c
leave
ret
Function at 0x40a125
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x46b014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push 0
push 0x80
push 2
or dword [edi], 0xffffffff
mov byte [edi + 4], 1
call fcn.00425472
push eax
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x40a195
and dword [ebp - 8], 0
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x40a199
push 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebx + esi]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40a195
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x40a175
jmp 0x40a199
mov byte [edi + 4], 0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dd4f
leave
ret 0xc
Function at 0x412aac
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x45157d
call fcn.0042e622
mov esi, ecx
push 1
call fcn.0042df70
mov dword [ebp - 0x14], eax
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push eax
push 0x414180
push ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.0043417c
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x412aec
call fcn.0042e5d1
ret 4
push 6
mov dword [edi], ebx
call fcn.0042cb35
int3

Function at 0x4168df
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x6c
push 0xffffffffffffffff
push 0x45188d
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x46b014]
xor eax, ebp
mov dword [ebp + 0x68], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x68], 0
lea eax, [esi + 0x60]
mov dword [ebp + 0x30], eax
je 0x41692a
push dword [esi + 0x68]
call fcn.004339bc
and dword [esi + 0x68], 0
pop ecx
mov edi, dword [esi + 0x58]
jmp 0x4169b2
lea eax, [edi - 1]
push eax
lea edx, [esi + 0x3c]
mov dword [ebp + 0x34], eax
lea ecx, [ebp + 0x50]
call fcn.0041b519
pop ecx
and dword [ebp - 4], 0
lea eax, [ebp + 0x50]
cmp dword [ebp + 0x64], 0x10
cmovae eax, dword [ebp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4169a3
push edi
lea edx, [esi + 0x3c]
lea ecx, [ebp + 0x38]
call fcn.0041b519
pop ecx
lea eax, [ebp + 0x38]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 0x50]
push eax
call fcn.0041b5d6
test al, al
jne 0x41699b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x50]
push eax
call fcn.0041b5d6
test al, al
je 0x4169e0
lea ecx, [ebp + 0x38]
call fcn.00401bc6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x50]
call fcn.00401bc6
mov edi, dword [ebp + 0x34]
test edi, edi
jne 0x416932
push ecx
mov ecx, dword [ebp + 0x30]
call fcn.004076a1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x68]
xor ecx, ebp
call fcn.0042dd4f
add ebp, 0x6c
leave
ret
push ecx
lea ecx, [esi + 0x60]
call fcn.004076a1
and dword [esi + 0x5c], 0
call fcn.0043953c
lea edx, [ebp + 0x38]
lea ecx, [ebp + 0x18]
mov edi, dword [eax]
call fcn.0040549c
mov esi, eax
lea edx, [ebp + 0x50]
mov byte [ebp - 4], 2
lea ecx, [ebp]
call fcn.0040549c
push eax
mov edx, str.rotating_file_sink:_failed_renaming
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.0040d7a6
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3c]
mov edx, eax
mov dword [esp], str._to
call fcn.0040b8d1
push esi
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x54]
call fcn.0041b3e8
pop ecx
pop ecx
mov edx, edi
mov byte [ebp - 4], 6
mov ecx, eax
call fcn.00404b9c
int3