joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10078785
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
xor eax, eax
cmp byte [esi + 0x18], al
je 0x100787a2
push eax
push eax
push esi
push 0x1007d3ad
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
pop esi
ret

Function at 0x1007a5e7
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x10
mov eax, 0x1009cb58
call fcn.10094b6a
mov ebx, ecx
mov eax, dword [ebx + 8]
sub eax, 0x10
call fcn.10084ad6
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
call fcn.1005ffe4
mov eax, dword [ebx + 8]
push ecx
sub eax, 0x10
mov dword [ebp - 0x1c], esp
mov esi, esp
call fcn.10084ad6
add eax, 0x10
mov dword [esi], eax
call fcn.10028524
mov dword [ebp - 0x14], eax
test eax, eax
jns 0x1007a684
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.10084ad6
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
push 0x100191bc
lea eax, [ebp - 0x1c]
push eax
lea edi, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.1005fd4e
mov byte [ebp - 4], 2
mov ebx, dword [ebx + 0x18]
push dword [eax]
mov edx, dword [ebx]
push 0
mov ecx, ebx
call dword [edx + 4]
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.10084b37
lea eax, [esi - 0x10]
call fcn.10084b37
jmp 0x1007a73a
xor edx, edx
lea esi, [ebx + 0xc]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
inc edx
sub edx, dword [eax - 4]
mov eax, 0x105
sub ecx, eax
or ecx, edx
jge 0x1007a6a4
mov ecx, esi
call fcn.1008495f
push dword [esi]
push 0
push 0x100191f8
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x1007a716
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1007a6ce
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x14], eax
mov eax, dword [0x100bcf90]
mov ecx, 0x100bcf90
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push 0x10019200
push eax
mov byte [ebp - 4], 3
call fcn.100847a7
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebx + 0x18]
mov eax, dword [ecx]
add esp, 0xc
push edi
push 0
call dword [eax + 4]
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.10084b37
or eax, 0xffffffff
call fcn.1008472b
cmp byte [ebx + 0x14], 0
je 0x1007a73a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 4
push 0x10007584
mov eax, esi
call fcn.10067944
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.10084b37
mov eax, dword [ebp - 0x14]
call fcn.10094c56
ret
Function at 0x1007c90a
Capabilities:
Accept command line arguments

Disassembly:
push 0x24
mov eax, 0x100a2ca3
call fcn.10094b6a
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10026b5d
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
call fcn.100271a7
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov eax, dword [ebp - 0x14]
setne byte [ebp - 0xd]
add eax, 0xfffffff0
call fcn.10084b37
mov eax, dword [edi + 0xc]
sub eax, 0x10
call fcn.10084ad6
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
mov eax, dword [edi + 8]
sub eax, 0x10
call fcn.10084ad6
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
call fcn.1005f623
mov ebx, eax
mov eax, dword [ebp - 0x14]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.10084b37
lea eax, [esi - 0x10]
call fcn.10084b37
cmp byte [ebp - 0xd], 0
jne 0x1007c9b2
test bl, bl
jne 0x1007c9b2
cmp byte [edi + 0x15], bl
je 0x1007c9b2
cmp byte [edi + 0x14], bl
je 0x1007c9b2
inc bl
jmp 0x1007c9b4
xor bl, bl
lea ecx, [ebp - 0x30]
call fcn.10026eb8
mov al, bl
call fcn.10094c56
ret
Function at 0x10080fc8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.100800c0
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
jmp dword [ecx]
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
invalid
cmp dh, al
test dword [ecx + 0x11fffffc], esp
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x100811ae
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x100811cb
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x104
jge 0x10081232
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
and eax, 0x80
test eax, eax
je 0x100811fd
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
xor ah, bh
invalid
invalid
jmp 0x10081230
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
cmp eax, 0x5c
jne 0x1008121c
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
test eax, eax
jne 0x10081230
jmp 0x10081232
jmp 0x100811be
mov eax, dword [ebp - 0x670]
add eax, dword [ebp - 0x384]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.10080053
add esp, 0xc

Function at 0x1008325e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100832b5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x100832a7
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x100832a3
cmp edi, eax
jae 0x100832a7
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x10083295
cmp edi, eax
jb 0x100832ab
xor eax, eax
jmp 0x100832b4
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x10083b40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 8]
push 0
push 0x10011df4
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10083ba6
cmp dword [ebp + 8], 1
je 0x10083b7e
cmp dword [ebp + 8], 2
je 0x10083b7e
push 0xd
pop eax
jmp 0x10083ba6
mov eax, dword [ebp - 4]
test edi, edi
je 0x10083ba0
test eax, eax
je 0x10083b9b
test al, 1
jne 0x10083b79
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x10083ba0
jmp 0x10083b79
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 4

Function at 0x10086de1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100bc210]
jne 0x10086deb
repz ret
jmp fcn.1008a698

Function at 0x10090bab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100bc210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1008921e
and dword [ebp - 0x14], 0
cmp dword [0x100c6774], 0
mov dword [ebp - 0x18], eax
jne 0x10090c5e
push 0x100030bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10090d06
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100030b0
push ebx
call edi
test eax, eax
je 0x10090d06
mov esi, dword [fcn.10001074]
push eax
call esi
push 0x100030a0
push ebx
mov dword [0x100c6774], eax
call edi
push eax
call esi
push 0x1000308c
push ebx
mov dword [0x100c6778], eax
call edi
push eax
call esi
push 0x10003070
push ebx
mov dword [0x100c677c], eax
call edi
push eax
call esi
mov dword [0x100c6784], eax
test eax, eax
je 0x10090c5e
push 0x10003058
push ebx
call edi
push eax
call esi
mov dword [0x100c6780], eax
mov eax, dword [0x100c6780]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.10001070]
cmp eax, ecx
je 0x10090cb7
cmp dword [0x100c6784], ecx
je 0x10090cb7
push eax
call esi
push dword [0x100c6784]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10090cb7
test ebx, ebx
je 0x10090cb7
call edi
test eax, eax
je 0x10090cae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10090cae
test byte [ebp - 8], 1
jne 0x10090cb7
or dword [ebp + 0x10], 0x200000
jmp 0x10090cea
mov eax, dword [0x100c6778]
cmp eax, dword [ebp - 0x18]
je 0x10090cea
push eax
call esi
test eax, eax
je 0x10090cea
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10090cea
mov eax, dword [0x100c677c]
cmp eax, dword [ebp - 0x18]
je 0x10090cea
push eax
call esi
test eax, eax
je 0x10090cea
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100c6774]
call esi
test eax, eax
je 0x10090d06
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10090d08
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10086de1
leave
ret
Function at 0x100935a0
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
pop ebp
ret 4
Function at 0x10094220
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x100bc210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x24]
push edi
mov ecx, ebx
and ecx, 0x3f
mov edi, 0x40
sub edi, ecx
cmp edi, 8
mov dword [ebp - 0x50], eax
ja 0x10094255
add edi, 0x40
lea edx, [edi - 8]
push edx
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.1008a7e0
mov ecx, dword [esi + 0x20]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, 0x1d
or ecx, edx
add esp, 0xc
mov dword [ebp - 0x58], ecx
push 2
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp + edi - 0x54]
lea eax, [ebx*8]
push edx
mov byte [ebp - 0x4c], 0x80
mov dword [ebp - 0x54], eax
call fcn.10094320
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
call fcn.10094110
mov ecx, dword [ebp - 0x50]
push 8
push esi
push ecx
call fcn.10094320
xor eax, eax
push 0x40
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
push eax
add esi, 0x28
push esi
call fcn.1008a7e0
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10086de1
mov esp, ebp
pop ebp
ret 8
Function at 0x889058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8891a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x88907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88906a
add dl, dl
jne 0x889089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8890dc
xor eax, eax
add dl, dl
jne 0x889096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88917d
add dl, dl
jne 0x8890a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8890b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8890bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8890c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8890d2
push edi
mov eax, eax
shr byte [ecx], 0xc7
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x889075
mov eax, 1
add dl, dl
jne 0x8890ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8890f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8890e1
sub eax, ebx
mov ebx, 1
jne 0x889128
mov ecx, 1
add dl, dl
jne 0x88910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x889119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x889105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x889075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x88913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x889136
cmp eax, 0x7d00
jae 0x88916d
cmp eax, 0x500
jb 0x889168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x889075
cmp eax, 0x7f
ja 0x889170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x889075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x88919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x889075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4e7058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x4e71a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x4e707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4e706a
add dl, dl
jne 0x4e7089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4e70dc
xor eax, eax
add dl, dl
jne 0x4e7096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4e717d
add dl, dl
jne 0x4e70a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4e70b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4e70bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4e70c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4e70d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x4e7075
mov eax, 1
add dl, dl
jne 0x4e70ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4e70f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4e70e1
sub eax, ebx
mov ebx, 1
jne 0x4e7128
mov ecx, 1
add dl, dl
jne 0x4e710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4e7119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4e7105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4e7075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4e713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4e714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4e7136
cmp eax, 0x7d00
jae 0x4e716d
cmp eax, 0x500
jb 0x4e7168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4e7075
cmp eax, 0x7f
ja 0x4e7170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4e7075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4e719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x4e7075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401fd0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 0xffffffff
je 0x402000
test al, 0x10
jne 0x402018
test al, 1
je 0x401ff9
and al, 0xfe
push eax
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00482c00
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402015
pop edi
pop esi
pop ebx
ret
push esi
call edi
mov ecx, dword [esp + 0x14]
mov edx, ecx
or edx, 0x10
cmp eax, edx
je 0x402029
push ecx
push esi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x406690
Capabilities:
Get session user name

Disassembly:
sub esp, 0xcc
xor eax, eax
push ebx
mov ebx, dword [esp + 0xd8]
push ebp
mov ebp, dword [esp + 0xd8]
lea ecx, [ebx + ebx]
push esi
mov edx, ecx
push edi
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.0047e240
test eax, eax
je 0x406756
push 0x41
push 0
push 1
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov esi, eax
test esi, esi
jne 0x4066ec
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push eax
push 0x4067f0
push esi
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
push esi
call dword [sym.imp.USER32.dll_CloseDesktop]
lea ecx, [esp + 0x14]
push ecx
call fcn.00451ffc
add esp, 4
cmp eax, ebx
jb 0x406738
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xcc
ret
lea edx, [esp + 0x14]
push edx
push ebp
call fcn.00451fd7
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x18], 0x64
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov esi, eax
test esi, esi
je 0x4067c6
lea edx, [esp + 0x14]
push edx
call fcn.00451ffc
add esp, 4
cmp eax, ebx
jb 0x4067a8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xcc
ret
lea eax, [esp + 0x14]
push eax
push ebp
call fcn.00451fd7
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4dd
jne 0x4067d8
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
Function at 0x407870
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x660
push ebx
push ebp
push esi
mov esi, dword [esp + 0x670]
xor ebp, ebp
cmp esi, ebp
je 0x4079f5
push esi
call fcn.00451ffc
add esp, 4
test eax, eax
je 0x4079f5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4079f5
test bl, 1
je 0x4078bd
and ebx, 0xfffffffe
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test bl, 0x10
je 0x4079e4
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x46a]
mov word [esp + 0x468], bp
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x46c]
push eax
call fcn.00451fd7
lea ecx, [esp + 0x470]
push 0x62270c
push ecx
call fcn.00451fad
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x24]
add esp, 0x10
mov dword [esp + 0x10], ebp
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x468]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4079d2
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea ecx, [esp + 0x3c]
push 0x622758
push ecx
call ebp
test eax, eax
je 0x4079b7
lea edx, [esp + 0x3c]
push 0x622754
push edx
call ebp
test eax, eax
je 0x4079b7
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x262]
mov word [esp + 0x260], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x260]
push esi
push eax
call fcn.00451fd7
lea ecx, [esp + 0x268]
push 0x62261c
push ecx
call fcn.00451fad
lea edx, [esp + 0x4c]
lea eax, [esp + 0x270]
push edx
push eax
call fcn.00451fad
lea ecx, [esp + 0x278]
push ecx
call fcn.00407870
add esp, 0x1c
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407939
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x660
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebp
pop ebx
add esp, 0x660
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x660
ret
Function at 0x407a10
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x664
push ebx
push esi
mov esi, dword [esp + 0x670]
xor ebx, ebx
cmp esi, ebx
je 0x407bb6
push esi
call fcn.00451ffc
add esp, 4
test eax, eax
je 0x407bb6
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x18]
push ebx
push eax
push esi
mov dword [esp + 0x24], ebx
call fcn.004050f0
add esp, 0x1c
test eax, eax
je 0x407bb6
mov eax, dword [esp + 8]
cmp eax, 0xffffffff
je 0x407bb6
test al, 1
je 0x407a7c
and al, 0xfe
push eax
push esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 8]
test al, 0x10
je 0x407ba6
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x46a]
mov word [esp + 0x468], bx
push esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x46c]
push ecx
stosw word es:[edi], ax
call fcn.00451fd7
lea edx, [esp + 0x470]
push 0x62270c
push edx
call fcn.00451fad
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x22c]
mov dword [esp + 0x228], ebx
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x218]
lea ecx, [esp + 0x468]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407b95
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea edx, [esp + 0x248]
push 0x622758
push edx
call ebp
test eax, eax
je 0x407b76
lea eax, [esp + 0x248]
push 0x622754
push eax
call ebp
test eax, eax
je 0x407b76
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push esi
push ecx
stosw word es:[edi], ax
call fcn.00451fd7
lea edx, [esp + 0x1c]
push 0x62261c
push edx
call fcn.00451fad
lea eax, [esp + 0x258]
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.00451fad
lea edx, [esp + 0x2c]
push edx
call fcn.00407a10
add esp, 0x1c
lea eax, [esp + 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407b01
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebx
add esp, 0x664
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebx
add esp, 0x664
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x664
ret