joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001bd57
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10012ef4
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1001bdc6
cmp esi, dword [ebp - 4]
je 0x1001bdc1
cmp dword [ebp + 0xc], 0
je 0x1001bdc1
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1001bd9e
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1001b8a9
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1001bdc8
xor eax, eax
inc eax
jmp 0x1001bdc8
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1001be2d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1002d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10012ef4
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10012ef4
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1001bea4
cmp word [ecx], dx
je 0x1001bea4
mov eax, dword [0x10028664]
push edi
dec eax
push eax
push 0x10028550
call fcn.1001bdcc
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1001bf17
cmp word [eax], dx
je 0x1001bf17
mov eax, dword [edi]
test eax, eax
je 0x1001bec8
cmp word [eax], dx
je 0x1001bec8
lea eax, [ebp - 0x10]
push eax
call fcn.1001b7af
jmp 0x1001bed1
lea eax, [ebp - 0x10]
push eax
call fcn.1001b84a
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1001bf41
mov eax, dword [0x1002854c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10028240
call fcn.1001bdcc
add esp, 0xc
test al, al
je 0x1001bf41
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1001bf0c
cmp word [eax], di
je 0x1001bf0c
lea eax, [ebp - 0x10]
push eax
call fcn.1001b7af
pop ecx
jmp 0x1001bf43
lea eax, [ebp - 0x10]
push eax
call fcn.1001b84a
jmp 0x1001bf09
mov eax, dword [edi]
test eax, eax
je 0x1001bf2e
cmp word [eax], dx
je 0x1001bf2e
lea eax, [ebp - 0x10]
push eax
call fcn.1001b764
pop ecx
jmp 0x1001bf41
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1001c00c
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1001bc51
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1001c00c
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1001c00c
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1001c00c
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1001bf99
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10012458
test ebx, ebx
je 0x1001c007
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10012458
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1001c00c
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1001c00c
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1001eb07
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1001c00e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008154
leave
ret
Function at 0x10020750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002077d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002077d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403c20
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x210
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x21c]
push ebp
mov ebp, dword [esp + 0x21c]
push esi
push edi
push eax
mov eax, dword [0x439630]
or eax, 8
push eax
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403ce9
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea eax, [esp + 0x14]
push 0x105
push eax
push 0
push dword [esp + 0x1c]
call edi
test eax, eax
jne 0x403cac
mov esi, dword [esp + 0x22c]
lea ebx, [ebx]
test esi, esi
jne 0x403cda
push esi
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call fcn.00403c20
test eax, eax
jne 0x403cac
push 0x105
lea eax, [esp + 0x18]
push eax
push esi
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x403c80
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00408260
test eax, eax
je 0x403cf6
push 0
push dword [0x439630]
push ebx
push ebp
call eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 0xc
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 0xc
cmp dword [0x439630], 0
jne 0x403ce4
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x403ce4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 0xc
Function at 0x404230
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
js 0x404256
mov eax, dword [0x439598]
push 0
add eax, ecx
push 0
push eax
push dword [0x40e014]
mov dword [0x42718c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.00403f10
test eax, eax
js 0x4043a5
push 4
lea eax, [esp + 0xc]
push eax
push dword [0x40e014]
call fcn.004082d0
test eax, eax
jne 0x404284
mov eax, 0xfffffffd
pop ecx
ret 0x10
add dword [0x42718c], 4
push esi
push dword [esp + 0xc]
call fcn.00403f10
mov esi, eax
test esi, esi
jns 0x4042a0
pop esi
pop ecx
ret 0x10
mov edx, dword [esp + 0x14]
push ebx
push edi
test edx, edx
jne 0x404364
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4043a0
mov ecx, dword [esp + 0x14]
test ecx, ecx
jle 0x4043a0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
lea esp, [esp]
mov eax, 0x4000
cmp ecx, eax
cmovl eax, ecx
push eax
push 0x41b188
push dword [0x40e014]
mov dword [esp + 0x18], eax
call fcn.004082d0
test eax, eax
je 0x40438a
push dword [esp + 0xc]
push 0x41b188
push edi
call fcn.004083a0
test eax, eax
je 0x404358
mov ecx, dword [0x41316c]
mov eax, dword [esp + 0xc]
add ecx, eax
mov edx, dword [0x413170]
mov dword [0x41316c], ecx
test edx, edx
je 0x404339
push ecx
push dword [0x413168]
push 0x430
push edx
call ebx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
add esi, eax
add dword [0x42718c], eax
sub ecx, eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jg 0x4042d0
pop edi
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0x10
pop edi
pop ebx
mov eax, 0xfffffffe
pop esi
pop ecx
ret 0x10
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xc]
cmp dword [esp + 0x14], ecx
push 0
cmovl ecx, dword [esp + 0x18]
push eax
push ecx
push edx
push dword [0x40e014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404396
pop edi
pop ebx
mov eax, 0xfffffffd
pop esi
pop ecx
ret 0x10
mov esi, dword [esp + 0xc]
add dword [0x42718c], esi
pop edi
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0x10

Function at 0x4043d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x80
cmp dword [esp + 0x84], 0
je 0x404401
mov eax, dword [0x4271a0]
test eax, eax
je 0x4043f0
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x4271a0], 0
add esp, 0x80
ret
cmp dword [0x4271a0], 0
je 0x404418
push 0
call fcn.004079b0
add esp, 0x80
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x413180]
jbe 0x404488
cmp dword [0x437518], 0
je 0x404463
test byte [0x439634], 1
je 0x404488
call fcn.004043b0
push eax
lea eax, [esp + 4]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp]
push eax
push 0
call fcn.004074c0
add esp, 0x80
ret
push 0
push 0x404920
push 0
push 0x6f
push dword [0x437514]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x4271a0], eax
call dword [sym.imp.USER32.dll_ShowWindow]
add esp, 0x80
ret
Function at 0x4075d0
Capabilities:
Create directory

Disassembly:
sub esp, 0x20
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x40001
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push dword [esp + 0x28]
mov dword [esp + 0x18], 0x40c9b0
mov dword [esp + 0x1c], 0x40c9b0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x40c9a0
mov dword [esp + 8], 0xc
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40764a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x407658
lea eax, [esp + 0xc]
push eax
push 0x80000007
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
je 0x407652
xor eax, eax
add esp, 0x20
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x20
ret 4
Function at 0x407930
Capabilities:
Get common file path

Disassembly:
sub esp, 0x23c
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
cmp ecx, 0x104
jbe 0x407992
xor ecx, ecx
mov eax, 1
push dword [esp + 0x240]
lea eax, [eax*2 + 0x40c358]
push eax
lea eax, [esp + 8]
lea eax, [eax + ecx*2]
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [esp]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add esp, 0x23c
ret 4
test ecx, ecx
je 0x407951
cmp word [esp + ecx*2 - 2], 0x5c
je 0x407951
xor eax, eax
jmp 0x407956

Function at 0x407a00
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x407a24
push dword [esp + 8]
push dword [esp + 8]
call fcn.00407a80
add esp, 8
inc dword [0x439610]
ret 8
Function at 0x407a80
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
push esi
push edi
push 0x40caac
push 0x432eb8
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test esi, esi
je 0x407ae9
push esi
call ebp
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push 1
push ecx
push 1
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
push 0x432eb8
push esi
call edi
test eax, eax
je 0x407bfc
cmp eax, 0x400
jg 0x407bfc
push 0x400
push 0x4326b8
push dword [esp + 0x18]
call edi
test eax, eax
je 0x407bfc
cmp eax, 0x400
jg 0x407bfc
push ebx
push 0x4326b8
push 0x432eb8
push str._ls_ls_r_n
push 0x4322b8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x439544]
add esp, 0x10
mov ebx, eax
mov dword [esp + 0x18], ebx
push dword [ecx + 0x128]
push 0x4326b8
call fcn.00407660
push 0x4326b8
call ebp
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push 4
push ecx
push 1
push 0xc0000000
push 0x4326b8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x407bfb
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebx + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x407bf4
push esi
push edi
push ebp
call fcn.004082d0
test eax, eax
je 0x407bf4
push str._Rename__r_n
push edi
call fcn.00408540
test eax, eax
jne 0x407c00
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov edx, esi
push ebx
push 0x4322b8
lea eax, [edx + edi]
push eax
call fcn.00407fa0
push 0
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebx]
push eax
push edi
push ebp
call fcn.004083a0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
pop ebp
ret
push 0x40cac0
add eax, 0xa
push eax
call fcn.00408540
mov edx, eax
test edx, edx
je 0x407bc4
lea ecx, [edi + esi]
add ebx, ecx
cmp ecx, edx
jbe 0x407c2a
sub ebx, ecx
nop
mov al, byte [ecx]
mov byte [ebx + ecx], al
dec ecx
cmp ecx, edx
ja 0x407c20
mov ebx, dword [esp + 0x18]
sub edx, edi
inc edx
jmp 0x407bc6
Function at 0x407c40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push esi
call edi
test eax, eax
jne 0x407cfa
push eax
lea eax, [esp + 0xc]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407c93
cmp dword [esp + 8], 2
jne 0x407c93
mov ax, word [esp + 0x10]
cmp al, 0xff
jne 0x407c93
cmp ah, 0xfe
jne 0x407c93
pop edi
xor eax, eax
pop esi
pop ecx
ret 8
cmp dword [esp + 0x14], 0
je 0x407cf1
push 1
push 0
push 0
push esi
call edi
test eax, eax
jne 0x407cf1
push eax
lea eax, [esp + 0x18]
push eax
push 2
push 0x40c9d4
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x407cdd
cmp dword [esp + 0x14], 2
jne 0x407cdd
mov ecx, 1
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
pop edi
cmovne eax, edx
pop esi
pop ecx
ret 8
xor ecx, ecx
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
pop edi
cmovne eax, edx
pop esi
pop ecx
ret 8
push 0
push 0
push 0
push esi
call edi
pop edi
mov eax, 1
pop esi
pop ecx
ret 8

Function at 0x407d80
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
je 0x407de0
mov ecx, edi
and ecx, 0xfffffffe
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [esp + 0x10], 1
push esi
je 0x407dbd
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x407dd1
pop edi
mov eax, 1
pop esi
ret 8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x407dd1
pop edi
mov eax, 1
pop esi
ret 8
test byte [esp + 0x10], 4
jne 0x407de0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
xor eax, eax
pop esi
ret 8
Function at 0x407e80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
push 0x800
push dword [esp + 0xc]
push 0x4312b8
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x4312b8
call fcn.004085d0
mov edi, eax
test edi, edi
jne 0x407eab
xor eax, eax
pop edi
ret 4
push edi
call fcn.00408730
test byte [0x439540], 0x80
je 0x407ec7
movzx eax, word [edi]
test ax, ax
je 0x407ea5
cmp eax, 0x5c
je 0x407ea5
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sub edi, 0x4312b8
push ebp
push esi
push 0x4312b8
sar edi, 1
call ebx
mov esi, dword [sym.imp.USER32.dll_CharPrevW]
cmp eax, edi
jle 0x407f45
mov ebp, dword [sym.imp.KERNEL32.dll_FindClose]
nop
push 0x4336b8
push 0x4312b8
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x407f11
push eax
call ebp
test byte [0x4336b8], 0x10
je 0x407f8d
push 0x4312b8
call ebx
lea eax, [eax*2 + 0x4312b8]
nop
cmp word [eax], 0x5c
je 0x407f35
push eax
push 0x4312b8
call esi
cmp eax, 0x4312b8
ja 0x407f20
xor ecx, ecx
push 0x4312b8
mov word [eax], cx
call ebx
cmp eax, edi
jg 0x407ef0
push 0x4312b8
call ebx
lea eax, [eax*2 + 0x4312b8]
push eax
push 0x4312b8
call esi
cmp word [eax], 0x5c
je 0x407f71
push 0x40c358
push 0x4312b8
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4312b8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
pop esi
pop ebp
setne cl
pop ebx
mov eax, ecx
pop edi
ret 4
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
ret 4

Function at 0x407fd0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x10
mov dword [0x430270], 0x44
lea eax, [esp]
mov dword [0x43029c], 0x80
push eax
push 0x430270
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push dword [esp + 0x34]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x408015
add esp, 0x10
ret 4
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp]
add esp, 0x10
ret 4
Function at 0x408030
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push ebp
push esi
mov esi, dword [esp + 0x26c]
mov ebp, ebx
push esi
and ebp, 4
call fcn.00407e80
mov dword [esp + 0xc], eax
test bl, 8
je 0x408079
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
pop esi
sbb eax, eax
inc eax
add dword [0x439608], eax
pop ebp
pop ebx
add esp, 0x25c
ret 8
push edi
mov edi, ebx
and edi, 1
mov dword [esp + 0x18], edi
je 0x408096
test eax, eax
je 0x4081dc
test bl, 2
je 0x4081dc
push 0x800
push esi
push 0x4302b8
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
test edi, edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x4080bf
push str..
push 0x4302b8
call edi
jmp 0x4080c5
push esi
call fcn.004086f0
cmp word [esi], 0
jne 0x4080d5
cmp word [0x4302b8], 0x5c
jne 0x4080dd
push 0x40c358
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push eax
push 0x4302b8
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4081be
cmp word [esp + 0x48], 0x2e
jne 0x40812a
mov ax, word [esp + 0x4a]
test ax, ax
je 0x40819f
cmp ax, 0x2e
jne 0x40812a
cmp word [esp + 0x4c], 0
je 0x40819f
push 0x800
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
test byte [esp + 0x1c], 0x10
je 0x408157
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x40819f
push ebx
push esi
call fcn.00408030
jmp 0x40819f
push ebp
push esi
call fcn.00407d80
test eax, eax
jne 0x408197
test ebp, ebp
je 0x40818f
push esi
push 0xfffffffffffffff1
call fcn.004074c0
push 5
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x408187
push eax
push esi
call fcn.00407a80
add esp, 8
inc dword [0x439610]
jmp 0x40819f
inc dword [0x439608]
jmp 0x40819f
push esi
push 0xfffffffffffffff2
call fcn.004074c0
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x408106
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call ebx
jmp 0x4081c4
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4081d6
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov word [eax - 2], cx
mov eax, dword [esp + 0x10]
jmp 0x4081e2
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
pop edi
je 0x40824f
test eax, eax
je 0x408235
push 0x4336b8
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x40824f
push eax
call ebx
push esi
call fcn.00407d50
mov eax, ebp
or eax, 1
push eax
push esi
call fcn.00407d80
test eax, eax
jne 0x408247
test ebp, ebp
je 0x408235
push esi
push 0xfffffffffffffff1
call fcn.004074c0
push 0
push esi
call fcn.00407a00
pop esi
pop ebp
pop ebx
add esp, 0x25c
ret 8
inc dword [0x439608]
pop esi
pop ebp
pop ebx
add esp, 0x25c
ret 8
push esi
push 0xffffffffffffffe5
call fcn.004074c0
pop esi
pop ebp
pop ebx
add esp, 0x25c
ret 8
Function at 0x4082a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x408310
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0x14]
xor eax, eax
mov word [esi], ax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408393
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x1000
push eax
push esi
lea eax, [esp + 0x14]
push eax
push 0
push dword [esp + 0x20]
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40837b
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x408380
cmp eax, 2
je 0x408380
xor eax, eax
mov word [esi], ax
push dword [esp + 0x14]
xor eax, eax
mov word [esi + 0xffe], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
ret 0x14

Function at 0x408400
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, 0x64
lea ebx, [ebx]
mov eax, dword [0x40ca98]
dec esi
mov dword [esp + 0x10], eax
mov eax, dword [0x40ca9c]
mov dword [esp + 0x14], eax
call ebp
xor edx, edx
mov ecx, 0x1a
div ecx
push edi
add word [esp + 0x18], dx
lea eax, [esp + 0x14]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x408467
test esi, esi
jne 0x408420
mov word [edi], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8

Function at 0x4085a0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4085c4
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4