joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426e47
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x42e17c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14c]
call fcn.00402be0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x4057a3
mov eax, dword [ebp + 8]
push eax
call fcn.0040f7a0
add esp, 4
test eax, eax
jne 0x4057ba
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14c]
call fcn.00402c40
jmp 0x40591b
mov ecx, dword [ebp + 8]
push ecx
push str._s_e
lea edx, [ebp - 0x11c]
push edx
call fcn.0040e4ec
add esp, 0xc
push 0x428964
lea eax, [ebp - 0x11c]
push eax
call fcn.00412057
add esp, 8
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x405909
cmp dword [ebp + 0xc], 0
je 0x405849
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040f7a0
add esp, 4
test eax, eax
je 0x405849
mov edx, dword [ebp - 0x120]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040f7a0
add esp, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00411f11
add esp, 0x10
mov edx, dword [ebp - 0x120]
push edx
push 1
push 2
push 0x428968
call fcn.00411f11
add esp, 0x10
cmp dword [ebp + 0x10], 0
je 0x4058fa
cmp dword [ebp + 0x14], 0
je 0x4058fa
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x122]
push ecx
movzx edx, word [ebp - 0x124]
push edx
movzx eax, word [ebp - 0x126]
push eax
movzx ecx, word [ebp - 0x128]
push ecx
movzx edx, word [ebp - 0x12a]
push edx
movzx eax, word [ebp - 0x12e]
push eax
movzx ecx, word [ebp - 0x130]
push ecx
push 0x42896c
lea edx, [ebp - 0x14c]
push edx
call fcn.00404920
add esp, 0x24
mov eax, dword [ebp - 0x120]
push eax
push 1
lea ecx, [ebp - 0x14c]
call fcn.00402f60
push eax
push 0
lea ecx, [ebp - 0x14c]
call fcn.00403060
push eax
call fcn.00411f11
add esp, 0x10
mov ecx, dword [ebp - 0x120]
push ecx
push 1
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00411f11
add esp, 0x10
mov ecx, dword [ebp - 0x120]
push ecx
call fcn.00411d33
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14c]
call fcn.00402c40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e39f
mov esp, ebp
pop ebp
ret
Function at 0x406ee0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4270bf
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x42e17c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x2c]
call fcn.00402be0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00402be0
mov byte [ebp - 4], 1
cmp dword [ebp + 8], 0
jne 0x406f43
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00402c40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402c40
jmp 0x406faa
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004027a0
push 0x428cec
lea ecx, [ebp - 0x2c]
call fcn.00402bb0
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0
lea ecx, [ebp - 0x2c]
call fcn.00403060
push eax
lea ecx, [ebp - 0x48]
call fcn.00404950
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x48]
call fcn.00402fe0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00402c40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402c40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x408690
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x42e17c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
je 0x4086b9
mov eax, dword [ebp + 8]
push eax
call fcn.00411ca2
add esp, 4
test eax, eax
jne 0x4086c0
xor al, al
jmp 0x408815
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401fe0
add esp, 4
movzx edx, al
test edx, edx
je 0x4086da
mov al, 1
jmp 0x408815
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x408813
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xb7
jne 0x408710
mov al, 1
jmp 0x408815
cmp dword [ebp - 0xc], 3
je 0x40871d
xor al, al
jmp 0x408815
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.00412362
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
call fcn.00411ca2
add esp, 4
movzx edx, word [ebp + eax*2 - 0x21a]
cmp edx, 0x5c
je 0x40876d
lea eax, [ebp - 0x218]
push eax
call fcn.00411ca2
add esp, 4
movzx ecx, word [ebp + eax*2 - 0x21a]
cmp ecx, 0x2f
jne 0x408788
lea edx, [ebp - 0x218]
push edx
call fcn.00411ca2
add esp, 4
xor ecx, ecx
mov word [ebp + eax*2 - 0x21a], cx
jmp 0x408735
lea edx, [ebp - 0x218]
push edx
call fcn.00411ca2
add esp, 4
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x4087a8
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4087d0
mov ecx, dword [ebp - 8]
movzx edx, word [ebp + ecx*2 - 0x218]
cmp edx, 0x5c
je 0x4087d0
mov eax, dword [ebp - 8]
movzx ecx, word [ebp + eax*2 - 0x218]
cmp ecx, 0x2f
je 0x4087d0
jmp 0x40879f
cmp dword [ebp - 8], 0
ja 0x4087da
xor al, al
jmp 0x408815
xor edx, edx
mov eax, dword [ebp - 8]
mov word [ebp + eax*2 - 0x218], dx
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.00408690
add esp, 8
movzx eax, al
test eax, eax
jne 0x408805
xor al, al
jmp 0x408815
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov al, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e39f
mov esp, ebp
pop ebp
ret
Function at 0x408a30
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4272a5
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x42e17c]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x28]
call fcn.004249c0
mov dword [ebp - 4], 0
mov dword [ebp - 0x280], 0xffffffff
mov ecx, dword [ebp + 0x10]
call fcn.0040a700
cmp dword [ebp + 8], 0
je 0x408a92
mov eax, dword [ebp + 8]
push eax
call fcn.00411ca2
add esp, 4
test eax, eax
jne 0x408ab6
mov dword [ebp - 0x284], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00424a70
mov eax, dword [ebp - 0x284]
jmp 0x408b97
cmp dword [ebp + 0xc], 0
je 0x408ad7
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x428d3c
lea eax, [ebp - 0x28]
push eax
call fcn.00425840
add esp, 0x10
jmp 0x408aec
mov ecx, dword [ebp + 8]
push ecx
push 0x428d48
lea edx, [ebp - 0x28]
push edx
call fcn.00425840
add esp, 0xc
lea eax, [ebp - 0x27c]
push eax
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
mov eax, dword [edx + 0x8c]
call eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0xffffffff
je 0x408b67
lea ecx, [ebp - 0x250]
push ecx
lea ecx, [ebp - 0x2a0]
call fcn.0040a660
mov byte [ebp - 4], 1
lea edx, [ebp - 0x2a0]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.0040a6c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2a0]
call fcn.0040a6a0
lea eax, [ebp - 0x27c]
push eax
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x408b65
jmp 0x408b67
jmp 0x408b0e
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x10]
call fcn.0040a8b0
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00424a70
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0040e39f
mov esp, ebp
pop ebp
ret
Function at 0x408bb0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4272e0
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x42e17c]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x28]
call fcn.00402be0
mov dword [ebp - 4], 0
mov dword [ebp - 0x170], 0xffffffff
mov ecx, dword [ebp + 0x10]
call fcn.0040a910
cmp dword [ebp + 8], 0
je 0x408c12
mov eax, dword [ebp + 8]
push eax
call fcn.0040f7a0
add esp, 4
test eax, eax
jne 0x408c36
mov dword [ebp - 0x174], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402c40
mov eax, dword [ebp - 0x174]
jmp 0x408d11
cmp dword [ebp + 0xc], 0
je 0x408c57
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x428d54
lea eax, [ebp - 0x28]
push eax
call fcn.00404920
add esp, 0x10
jmp 0x408c6c
mov ecx, dword [ebp + 8]
push ecx
push 0x428d5c
lea edx, [ebp - 0x28]
push edx
call fcn.00404920
add esp, 0xc
lea eax, [ebp - 0x16c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402fe0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xffffffff
je 0x408ce1
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x190]
call fcn.0040a5e0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x190]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.0040a8d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x190]
call fcn.00407a70
lea eax, [ebp - 0x16c]
push eax
mov ecx, dword [ebp - 0x170]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408cdf
jmp 0x408ce1
jmp 0x408c88
mov edx, dword [ebp - 0x170]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x10]
call fcn.0040a8b0
mov dword [ebp - 0x194], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402c40
mov eax, dword [ebp - 0x194]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0040e39f
mov esp, ebp
pop ebp
ret

Function at 0x4095f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x42e17c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x409619
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040f7a0
add esp, 4
test eax, eax
jne 0x40962d
lea ecx, [ebp - 0x218]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x409645
mov edx, dword [ebp + 0xc]
push edx
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.00411c3a
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
je 0x40968a
cmp dword [ebp + 0x14], 0
je 0x40968a
lea eax, [ebp - 0x110]
push eax
push 0x104
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.00411c3a
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e39f
mov esp, ebp
pop ebp
ret
Function at 0x4096c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x42e17c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jne 0x4096e4
jmp 0x409761
mov byte [ebp - 5], 0
push 3
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0040ed80
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x409710
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040f7a0
add esp, 4
test eax, eax
jne 0x409724
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x40973c
mov ecx, dword [ebp + 0xc]
push ecx
push 0x104
lea edx, [ebp - 0x118]
push edx
call fcn.00411c3a
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s_s_X.tmp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ecx + 0xc8]
call eax
add esp, 0x14
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040e39f
mov esp, ebp
pop ebp
ret
Function at 0x409b10
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4274f1
mov eax, dword fs:[0]
push eax
sub esp, 0x2a0
mov eax, dword [0x42e17c]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x280], 0
lea ecx, [ebp - 0x28]
call fcn.004249c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2a0]
call fcn.004249c0
mov byte [ebp - 4], 1
mov dword [ebp - 0x2a8], 0xffffffff
mov dword [ebp - 0x284], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
cmp dword [ebp + 8], 0
je 0x409b96
mov ecx, dword [ebp + 8]
push ecx
call fcn.00411ca2
add esp, 4
test eax, eax
jne 0x409b9b
jmp 0x409cfe
mov edx, dword [ebp + 8]
push edx
push 0x428dd4
lea eax, [ebp - 0x28]
push eax
call fcn.00425840
add esp, 0xc
lea ecx, [ebp - 0x27c]
push ecx
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
mov eax, dword [edx + 0x8c]
call eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0xffffffff
je 0x409cf1
push 0x428de0
lea ecx, [ebp - 0x250]
push ecx
call fcn.00412578
add esp, 8
test eax, eax
je 0x409c0f
push 0x428de4
lea edx, [ebp - 0x250]
push edx
call fcn.00412578
add esp, 8
test eax, eax
jne 0x409c14
jmp 0x409cd2
mov eax, dword [ebp - 0x27c]
and eax, 0x10
je 0x409cc5
mov dword [ebp - 0x2a4], 0
lea ecx, [ebp - 0x250]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x428dec
lea eax, [ebp - 0x2a0]
push eax
call fcn.00425840
add esp, 0x10
lea ecx, [ebp - 0x2a4]
push ecx
push 0
lea ecx, [ebp - 0x2a0]
call fcn.00425af0
push eax
call fcn.00409b10
add esp, 8
add eax, dword [ebp - 0x284]
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x2a4], 0
je 0x409c8d
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
add eax, 1
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x409cc3
push 0
lea ecx, [ebp - 0x2a0]
call fcn.00425af0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x409cb6
mov edx, dword [ebp - 0x284]
add edx, 1
mov dword [ebp - 0x284], edx
jmp 0x409cc3
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x409cd2
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
lea eax, [ebp - 0x27c]
push eax
mov ecx, dword [ebp - 0x2a8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409cec
jmp 0x409cf1
jmp 0x409bd2
mov edx, dword [ebp - 0x2a8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2a0]
call fcn.00424a70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00424a70
mov eax, dword [ebp - 0x2ac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0040e39f
mov esp, ebp
pop ebp
ret
Function at 0x409d50
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42752c
mov eax, dword fs:[0]
push eax
sub esp, 0x190
mov eax, dword [0x42e17c]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x170], 0
lea ecx, [ebp - 0x28]
call fcn.00402be0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x190]
call fcn.00402be0
mov byte [ebp - 4], 1
mov dword [ebp - 0x198], 0xffffffff
mov dword [ebp - 0x174], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
cmp dword [ebp + 8], 0
je 0x409dd6
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040f7a0
add esp, 4
test eax, eax
jne 0x409ddb
jmp 0x409f38
mov edx, dword [ebp + 8]
push edx
push str._s
lea eax, [ebp - 0x28]
push eax
call fcn.00404920
add esp, 0xc
lea ecx, [ebp - 0x16c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00402fe0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0xffffffff
je 0x409f2b
push 0x428e00
lea edx, [ebp - 0x140]
push edx
call fcn.0040f460
add esp, 8
test eax, eax
je 0x409e49
push 0x428e04
lea eax, [ebp - 0x140]
push eax
call fcn.0040f460
add esp, 8
test eax, eax
jne 0x409e4e
jmp 0x409f0c
mov ecx, dword [ebp - 0x16c]
and ecx, 0x10
je 0x409eff
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x140]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_s
lea ecx, [ebp - 0x190]
push ecx
call fcn.00404920
add esp, 0x10
lea edx, [ebp - 0x194]
push edx
push 0
lea ecx, [ebp - 0x190]
call fcn.00403060
push eax
call fcn.00409d50
add esp, 8
add eax, dword [ebp - 0x174]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x194], 0
je 0x409ec7
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x409efd
push 0
lea ecx, [ebp - 0x190]
call fcn.00403060
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x409ef0
mov eax, dword [ebp - 0x174]
add eax, 1
mov dword [ebp - 0x174], eax
jmp 0x409efd
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x409f0c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
lea ecx, [ebp - 0x16c]
push ecx
mov edx, dword [ebp - 0x198]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409f26
jmp 0x409f2b
jmp 0x409e0c
mov eax, dword [ebp - 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x174]
mov dword [ebp - 0x19c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x190]
call fcn.00402c40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402c40
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0040e39f
mov esp, ebp
pop ebp
ret
Function at 0x409f90
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x18], 0
jg 0x409fa1
mov dword [ebp + 0x18], 1
mov dword [ebp - 4], 0
jmp 0x409fb3
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x18]
jge 0x409fed
movzx edx, byte [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x409fd6
mov al, 1
jmp 0x40a01a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x409fe3
jmp 0x409fed
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x409faa
cmp dword [ebp + 0x14], 0
je 0x40a018
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.CopyFileWithRetryA
push str._s:_CopyFileA__s__s_fail_as__d
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.00406690
add esp, 0x18
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x40a0b0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
jg 0x40a0c1
mov dword [ebp + 0x10], 1
mov dword [ebp - 4], 0
jmp 0x40a0d3
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jge 0x40a104
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40a0ed
mov al, 1
jmp 0x40a12d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40a0fa
jmp 0x40a104
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40a0ca
cmp dword [ebp + 0xc], 0
je 0x40a12b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp + 8]
push eax
push str.DeleteFileWithRetryA
push str._s:_deletefile__s_fail_as__d
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00406690
add esp, 0x14
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x40d870
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x42e17c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x11c], 0
cmp dword [ebp + 8], 0
je 0x40d8bf
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x40d95e
push 0x104
push 0
lea edx, [ebp - 0x110]
push edx
call fcn.00410eb0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40d917
cmp dword [ebp + 0x18], 0
je 0x40d915
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x429218
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00406690
add esp, 0xc
jmp 0x40da2e
jmp 0x40d95e
push 0x5c
lea edx, [ebp - 0x110]
push edx
call fcn.0040dc30
add esp, 8
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x40d955
mov eax, dword [ebp - 0x11c]
add eax, 1
push eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call fcn.0040e1e0
add esp, 0xc
lea edx, [ebp - 0x110]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x40d9a7
cmp dword [ebp + 0x18], 0
je 0x40d9a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x429248
mov edx, dword [ebp + 0x18]
push edx
call fcn.00406690
add esp, 0x10
jmp 0x40da2e
jmp 0x40d9cf
cmp dword [ebp - 0x114], 6
jne 0x40d9cf
cmp dword [ebp + 0x18], 0
je 0x40d9cf
mov eax, dword [ebp + 8]
push eax
push 0x42927c
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00406690
add esp, 0xc
jmp 0x40da2e
push 0
lea edx, [ebp + 0x14]
push edx
push 0
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x40da24
cmp dword [ebp + 0x18], 0
je 0x40da24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4292b8
mov eax, dword [ebp + 0x18]
push eax
call fcn.00406690
add esp, 0xc
jmp 0x40da2e
mov dword [ebp - 0x120], 1
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e39f
mov esp, ebp
pop ebp
ret