joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a0d2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0042e466
xor ebx, ebx
cmp dword [0x4565c4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x43a1a8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x43a288
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x446474
push edi
call esi
cmp eax, ebx
je 0x43a288
push eax
call fcn.0042e3f8
mov dword [esp], 0x446464
push edi
mov dword [0x4565c4], eax
call esi
push eax
call fcn.0042e3f8
mov dword [esp], 0x446450
push edi
mov dword [0x4565c8], eax
call esi
push eax
call fcn.0042e3f8
mov dword [0x4565cc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0042928b
test eax, eax
pop ecx
pop ecx
je 0x43a176
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00428676
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x43a1a8
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0042e3f8
cmp eax, ebx
pop ecx
mov dword [0x4565d4], eax
je 0x43a1a8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042e3f8
pop ecx
mov dword [0x4565d0], eax
mov eax, dword [0x4565d0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x43a22d
cmp dword [0x4565d4], ecx
je 0x43a22d
push eax
call fcn.0042e46f
push dword [0x4565d4]
mov esi, eax
call fcn.0042e46f
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x43a22d
cmp edi, ebx
je 0x43a22d
call esi
cmp eax, ebx
je 0x43a1fa
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43a1fa
test byte [ebp - 0x18], 1
jne 0x43a22d
lea eax, [ebp - 0x10]
push eax
call fcn.004292c2
test eax, eax
pop ecx
je 0x43a215
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00428676
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x43a224
or dword [ebp + 0x10], 0x200000
jmp 0x43a268
or dword [ebp + 0x10], 0x40000
jmp 0x43a268
mov eax, dword [0x4565c8]
cmp eax, dword [ebp - 8]
je 0x43a268
push eax
call fcn.0042e46f
cmp eax, ebx
pop ecx
je 0x43a268
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43a268
mov eax, dword [0x4565cc]
cmp eax, dword [ebp - 8]
je 0x43a268
push eax
call fcn.0042e46f
cmp eax, ebx
pop ecx
je 0x43a268
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4565c4]
call fcn.0042e46f
cmp eax, ebx
pop ecx
je 0x43a288
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43a28a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43da6d
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x452528]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0043da02
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0042a1a0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x43dabc
cmp dword [ebp - 0x1c], 5
jb 0x43dad4
jmp 0x43dad0
cmp dword [ebp - 0x10], 1
jne 0x43dad4
cmp dword [ebp - 0x1c], 4
ja 0x43dad0
jne 0x43dad4
cmp dword [ebp - 0x18], 0
jbe 0x43dad4
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x446d50
call fcn.0043d8f3
test eax, eax
jge 0x43daf5
mov byte [0x456659], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00426fe7
add ebp, 0x78
leave
ret
Function at 0x4010b4
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.00401090
call fcn.004016ae
mov esi, eax
call fcn.00401079
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403973
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
lea eax, [esp + 4]
push esi
push edi
push eax
lea eax, [esp + 0xc]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor edi, edi
test eax, eax
je 0x4039ba
cmp dword [esp + 8], edi
je 0x4039ba
mov edx, edi
mov ecx, edi
mov eax, dword [esp + 8]
shr eax, cl
and eax, 1
add edx, eax
inc ecx
cmp ecx, 0x20
jb 0x4039a7
jmp 0x4039c9
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x28]
mov eax, 0x40000000
mov dword [esi], edx
lea ecx, [esp + 8]
mov dword [esi + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
call fcn.00414e0e
test al, al
je 0x403a19
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], ecx
shrd ecx, eax, 5
push edi
push 0x11
shr eax, 5
push eax
push ecx
call fcn.004011d0
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40bc4a
Capabilities:
Hide graphical window

Disassembly:
push dword [esp + 4]
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
neg eax
sbb eax, eax
neg eax
ret 4

Function at 0x40be26
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
mov eax, 0x424d4b
call fcn.00401160
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [esi], 0x426de8
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
mov byte [esi + 0x45], bl
call fcn.0041590f
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.0041590f
mov byte [ebp - 4], 4
lea ecx, [esi + 0x64]
mov byte [esi + 0x60], bl
call fcn.0041590f
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.0041590f
mov byte [esi + 0x7c], 1
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 7
call fcn.0041590f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x40be32
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
mov eax, 0x424d4b
call fcn.00401160
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [esi], 0x426de8
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
mov byte [esi + 0x45], bl
call fcn.0041590f
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.0041590f
mov byte [ebp - 4], 4
lea ecx, [esi + 0x64]
mov byte [esi + 0x60], bl
call fcn.0041590f
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.0041590f
mov byte [esi + 0x7c], 1
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 7
call fcn.0041590f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40dacc
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x424f33
call fcn.00401160
sub esp, 0x31c
push ebx
push esi
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x40]
push edi
call fcn.0041590f
mov ebx, dword [ebp + 0x10]
and dword [ebp - 4], 0
mov edi, dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
cmp byte [ebx], 0
je 0x40db3c
push dword [ebx + 0xc]
lea ecx, [ebp - 0x28]
push dword [ebx + 8]
call fcn.00412f86
push eax
mov edx, 0xdb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.0041301b
add esp, 0xc
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00415a48
push dword [ebp - 0x34]
call edi
pop ecx
mov byte [ebp - 4], 0
push dword [ebp - 0x28]
call edi
pop ecx
lea eax, [ebx + 0x18]
mov ecx, eax
mov dword [ebp + 0x10], eax
call fcn.00415cf3
mov esi, eax
lea eax, [ebp - 0x34]
lea ecx, [esi + 1]
push ecx
push eax
lea ecx, [ebx + 0x18]
call fcn.00406c2d
mov byte [ebp - 4], 3
mov ecx, dword [ebx + 0x18]
add ecx, 2
lea eax, [ecx + esi*2]
push eax
lea ecx, [ebp - 0x28]
call fcn.00415934
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040da6e
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0040da6e
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x18]
call fcn.004159b1
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.00415bda
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x18]
call fcn.00415c46
lea ecx, [ebp - 0x18]
call fcn.00415bda
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x18]
call fcn.00415c46
lea ecx, [ebp - 0x18]
call fcn.00415bda
cmp byte [ebx + 1], 0
je 0x40dc20
mov edx, 0x3f4
lea ecx, [ebp - 0x4c]
call fcn.00414b64
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.00415c46
mov byte [ebp - 4], 5
push dword [ebp - 0x4c]
call edi
lea ecx, [ebp - 0x18]
mov dword [esp], 0x426e2c
call fcn.00415c81
push 0
lea ecx, [ebx + 0x10]
lea edx, [ebp - 0x6c]
call fcn.00414962
pop ecx
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00415c81
push dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [esi + 4]
call ebx
push dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x110
push 0x2b4
lea eax, [ebp - 0x328]
push eax
mov eax, dword [ebp + 0x10]
push 0x80
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x40dc79
push dword [ebp + 0xc]
push dword [esi + 4]
call ebx
push 0
push dword [ebp - 0x328]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x18]
call edi
pop ecx
push dword [ebp - 0x28]
call edi
pop ecx
push dword [ebp - 0x34]
call edi
pop ecx
push dword [ebp - 0x40]
call edi
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40e040
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x424f96
call fcn.00401160
push ecx
push ebx
or eax, 0xffffffff
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x38]
mov word [esi], bx
mov byte [esi + 2], 1
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
call fcn.0041590f
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.0041590f
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call fcn.0041590f
mov byte [esi + 0x5c], bl
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 3
call fcn.0040df88
lea ecx, [esi + 0x9c]
mov byte [ebp - 4], 4
call fcn.0042403c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x40ff16
Capabilities:
Create thread

Disassembly:
mov eax, 0x4250fd
call fcn.00401160
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push ebx
push edi
push 0x40fec8
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x40ff57
call fcn.00423faa
mov esi, eax
test esi, esi
jne 0x40ff68
push ecx
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.0040f621
mov esi, ebx
lea ecx, [ebp - 0x10]
call fcn.00423fbb
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x411e3f
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ebp, [esi + 4]
cmp dword [ebp], ebx
jne 0x411e5a
mov ecx, ebp
call fcn.0042401a
test eax, eax
jne 0x411ec2
push edi
lea edi, [esi + 8]
cmp dword [edi], ebx
jne 0x411e6d
mov ecx, edi
call fcn.0042401a
test eax, eax
jne 0x411ec1
push dword [ebp]
mov ebp, dword [sym.imp.KERNEL32.dll_ResetEvent]
call ebp
test eax, eax
jne 0x411e81
call fcn.00423faa
push dword [edi]
call ebp
test eax, eax
jne 0x411e8e
call fcn.00423faa
mov byte [esi + 0x10], bl
cmp dword [esi + 0xc], ebx
je 0x411e9a
xor eax, eax
jmp 0x411ec1
lea eax, [esp + 0x10]
push eax
push ebx
push esi
push 0x411e02
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
jne 0x411ebf
call fcn.00423faa
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4130ef
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push 0x4010
push 0x2b4
lea eax, [ebp - 0x2b4]
or edx, 0x80
push eax
push edx
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x2b0]
mov dword [edx], ecx
mov esp, ebp
pop ebp
ret
Function at 0x413479
Capabilities:
Create directory

Disassembly:
mov eax, 0x425356
call fcn.00401160
sub esp, 0x44
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41349c
mov al, 1
jmp 0x4134e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4134ad
xor al, al
jmp 0x4134e2
lea ecx, [ebp - 0x4c]
call fcn.00413942
lea ecx, [ebp - 0x24]
call fcn.0041590f
push esi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], ebx
call fcn.00413975
test al, al
je 0x4134d6
mov ebx, dword [ebp - 0x2c]
shr ebx, 4
and bl, 1
push dword [ebp - 0x24]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4134f2
Capabilities:
Create directory

Disassembly:
mov eax, 0x425370
call fcn.00401160
sub esp, 0x20
push ebx
push esi
push edi
mov esi, ecx
call fcn.00413963
cmp eax, 0xffffffff
je 0x413519
test al, 0x10
je 0x413519
mov al, 1
jmp 0x413639
mov ecx, esi
call fcn.004142f0
test al, al
je 0x41352b
xor al, al
jmp 0x413639
mov ecx, esi
call fcn.00414446
push esi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], eax
call fcn.00415934
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00415cf3
mov ebx, dword [ebp - 0x20]
mov edx, eax
mov edi, dword [ebp - 0x1c]
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
test edx, edx
js 0x413577
lea ecx, [edi - 1]
cmp edx, ecx
jne 0x413577
cmp edi, eax
jne 0x41356c
jmp 0x41362e
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x1c], edi
mov word [ebx + ecx*2], ax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004159b1
mov byte [ebp - 4], 1
mov esi, edi
jmp 0x4135d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4135e1
lea ecx, [ebp - 0x20]
call fcn.00415cf3
mov esi, eax
test esi, esi
js 0x4135e1
je 0x4135e1
cmp esi, 1
jne 0x4135ba
movzx eax, word [ebx]
cmp eax, 0x5c
je 0x4135e1
cmp eax, 0x2f
je 0x4135e1
lea eax, [esi + 1]
cmp dword [ebp - 0x14], eax
jae 0x4135e1
cmp esi, edi
jae 0x4135d1
mov edi, esi
xor eax, eax
mov dword [ebp - 0x1c], edi
mov word [ebx + esi*2], ax
mov ecx, ebx
call fcn.00413479
test al, al
je 0x41358b
mov edi, dword [ebp - 0x2c]
jmp 0x41361b
mov edi, dword [ebp - 0x2c]
mov byte [ebp - 0x10], 0
jmp 0x413626
lea ecx, [edi + 2]
lea ecx, [ecx + esi*2]
call fcn.00414052
test eax, eax
jns 0x4135fe
mov esi, dword [ebp - 0x28]
jmp 0x413601
inc esi
add esi, eax
push esi
push edi
lea ecx, [ebp - 0x20]
call fcn.00415aa8
mov ebx, dword [ebp - 0x20]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4135e4
cmp esi, dword [ebp - 0x28]
jl 0x4135ea
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
mov al, byte [ebp - 0x10]
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41364a
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, ecx
call fcn.00413963
cmp eax, 0xffffffff
je 0x413672
test al, 0x10
jne 0x413672
test al, 1
je 0x413672
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x413672
xor al, al
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
pop esi
setne al
ret

Function at 0x413680
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x20c]
push eax
call fcn.004159df
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
pop edi
sbb eax, eax
inc eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x413963
Capabilities:
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
ret

Function at 0x413dfb
Capabilities:
Get disk information

Disassembly:
mov eax, 0x4253de
call fcn.00401160
sub esp, 0x24
push ebx
mov eax, ecx
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040d731
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x413e2e
xor al, al
jmp 0x413ed9
push esi
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov esi, eax
pop ecx
mov dword [ebp - 0x24], esi
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x413ece
cmp edi, dword [ebp - 0x18]
ja 0x413ece
lea ecx, [ebp - 0x30]
call fcn.0041590f
mov byte [ebp - 4], 1
mov edx, ebx
mov dword [ebp - 0x18], edx
mov ecx, ebx
mov dword [ebp - 0x10], ecx
test edi, edi
je 0x413ebf
push 2
pop eax
mov dword [ebp - 0x14], eax
cmp word [esi + eax - 2], bx
jne 0x413eae
lea eax, [edx + esi]
push eax
lea ecx, [ebp - 0x30]
call fcn.004159df
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
push eax
call fcn.0040d77d
mov eax, dword [ebp - 0x14]
mov edx, eax
mov ecx, dword [ebp - 0x10]
inc ecx
add eax, 2
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
cmp ecx, edi
jb 0x413e80
mov edx, dword [ebp - 0x18]
push dword [ebp - 0x30]
cmp edx, edi
sete bl
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov al, bl
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x413f3f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413f65
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x413f65
xor al, al
jmp 0x413f79
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41ea37
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e4
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41ea6d
cmp dword [ebp - 0x110], 6
jne 0x41ea6d
cmp dword [ebp - 0x10c], 0
je 0x41ea97
push str.SetDefaultDllDirectories
push 0x42712c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41ea97
push 0xc00
call eax
test eax, eax
jne 0x41eb31
push 0x106
lea eax, [ebp - 0x3e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41eb31
cmp eax, 0x104
ja 0x41eb31
lea eax, [ebp - 0x3e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x3e6], cx
je 0x41eadb
mov word [ebp + eax*2 - 0x3e4], cx
inc eax
cmp byte [str.UXTHEME], 0
push esi
mov esi, str.UXTHEME
je 0x41eb30
push edi
lea edi, [ebp - 0x3e4]
lea edi, [edi + eax*2]
mov edx, edi
mov cl, byte [esi]
inc esi
movsx ax, cl
mov word [edx], ax
lea edx, [edx + 2]
test cl, cl
jne 0x41eaf6
push str..dll
lea eax, [ebp - 0x3e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
push 0
lea eax, [ebp - 0x3e4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x41eaf4
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x421b73
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00421b56
mov edx, eax
test edx, edx
jne 0x421bb6
xor ecx, ecx
cmp dword [esi + 0x18], ecx
je 0x421b8d
xor eax, eax
jmp 0x421bc3
lea eax, [esp + 4]
push eax
push ecx
push esi
push fcn.004227aa
push ecx
push ecx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x18], eax
test eax, eax
jne 0x421b89
call fcn.00423faa
mov edx, eax
test edx, edx
je 0x421b89
movzx eax, dx
or eax, 0x80070000
test edx, edx
cmovle eax, edx
pop esi
pop ecx
ret