joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a5d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x6a5d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x6a5d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x6a5d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x6a5d94
push eax
push esi
call fcn.006a820b
add esp, 8
pop esi
ret 0x10

Function at 0x6a5da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6a5e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x6a5e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x6be320
push ecx
mov dword [esp + 0x1c], 4
call fcn.006a7dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x6a5dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x6a5e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6a5ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x6a5eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x6be320
push ecx
mov dword [esp + 0x1c], 4
call fcn.006a7dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x6a5eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x6a5e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x6a6000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x6a6131
push esi
call fcn.006a9145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00698080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x6a6131
push 0
push ebp
call fcn.006983a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00698260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x6a608b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.006982f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x6a6121
push 0x6be918
push edi
call fcn.006a73f0
push eax
push ebx
push esi
call fcn.006a5f60
push 0x6be8f8
push edi
call fcn.006a73f0
push eax
push ebx
push esi
call fcn.006a5f60
push 0x6be8d8
push edi
call fcn.006a73f0
push eax
push ebx
push esi
call fcn.006a5f60
push 0x6be8c0
push edi
call fcn.006a73f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.006a5f60
push 0x6be8a0
push edi
call fcn.006a73f0
push eax
push ebx
push esi
call fcn.006a5f60
push 0x6be888
push edi
call fcn.006a73f0
push eax
push ebx
push esi
call fcn.006a5f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6a71b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006a7140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006a7140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006a7140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006a7140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6a7bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6a7c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6b987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6a7c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6a7c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x406ced
Capabilities:
Parse pe header

Disassembly:
push 0x74
push 0x40af98
call fcn.00406fd4
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x406d2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406d2d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x406d45
cmp eax, 0x20b
je 0x406d32
mov dword [ebp - 0x1c], ebx
jmp 0x406d59
cmp dword [ecx + 0x84], 0xe
jbe 0x406d2d
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x406d53
cmp dword [ecx + 0x74], 0xe
jbe 0x406d2d
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x40ea78], 0xffffffff
or dword [0x40ea7c], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x40d464]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x40d460]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40ea74], eax
call fcn.0053e000
call fcn.00406fd0
cmp dword [0x40d320], ebx
jne 0x406db9
push fcn.00406fd0
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00406fbe
push 0x40c00c
push 0x40c008
call sub.MSVCR71.dll__initterm
push 0x406f74
call fcn.00406f1e
mov eax, dword [0x40d45c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x40d458]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x406e0d
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x40c004
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x406e8b
cmp al, bl
je 0x406e37
cmp dword [ebp - 0x20], ebx
jne 0x406e8b
mov al, byte [esi]
cmp al, bl
je 0x406e47
cmp al, 0x20
ja 0x406e47
inc esi
mov dword [ebp - 0x24], esi
jmp 0x406e37
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x406e63
movzx eax, word [ebp - 0x54]
jmp 0x406e66
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00404254
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x406e83
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x406ee0
cmp al, 0x22
jne 0x406e9a
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x406ead
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x406e25
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040700f
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x403d10
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x210
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x21c]
push ebp
mov ebp, dword [esp + 0x21c]
push esi
push edi
push eax
mov eax, dword [0x439630]
or eax, 8
push eax
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403dd9
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea eax, [esp + 0x14]
push 0x105
push eax
push 0
push dword [esp + 0x1c]
call edi
test eax, eax
jne 0x403d9c
mov esi, dword [esp + 0x22c]
lea ebx, [ebx]
test esi, esi
jne 0x403dca
push esi
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call fcn.00403d10
test eax, eax
jne 0x403d9c
push 0x105
lea eax, [esp + 0x18]
push eax
push esi
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x403d70
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004088e0
test eax, eax
je 0x403de6
push 0
push dword [0x439630]
push ebx
push ebp
call eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 0xc
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 0xc
cmp dword [0x439630], 0
jne 0x403dd4
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x403dd4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 0xc
Function at 0x4042c0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
js 0x4042e6
mov eax, dword [0x439598]
push 0
add eax, ecx
push 0
push eax
push dword [0x40e014]
mov dword [0x42718c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.00403fa0
test eax, eax
js 0x404435
push 4
lea eax, [esp + 0xc]
push eax
push dword [0x40e014]
call fcn.00408950
test eax, eax
jne 0x404314
mov eax, 0xfffffffd
pop ecx
ret 0x10
add dword [0x42718c], 4
push esi
push dword [esp + 0xc]
call fcn.00403fa0
mov esi, eax
test esi, esi
jns 0x404330
pop esi
pop ecx
ret 0x10
mov edx, dword [esp + 0x14]
push ebx
push edi
test edx, edx
jne 0x4043f4
mov edi, dword [esp + 0x18]
test edi, edi
je 0x404430
mov ecx, dword [esp + 0x14]
test ecx, ecx
jle 0x404430
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
lea esp, [esp]
mov eax, 0x4000
cmp ecx, eax
cmovl eax, ecx
push eax
push 0x41b188
push dword [0x40e014]
mov dword [esp + 0x18], eax
call fcn.00408950
test eax, eax
je 0x40441a
push dword [esp + 0xc]
push 0x41b188
push edi
call fcn.00408a20
test eax, eax
je 0x4043e8
mov ecx, dword [0x41316c]
mov eax, dword [esp + 0xc]
add ecx, eax
mov edx, dword [0x413170]
mov dword [0x41316c], ecx
test edx, edx
je 0x4043c9
push ecx
push dword [0x413168]
push 0x430
push edx
call ebx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
add esi, eax
add dword [0x42718c], eax
sub ecx, eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jg 0x404360
pop edi
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0x10
pop edi
pop ebx
mov eax, 0xfffffffe
pop esi
pop ecx
ret 0x10
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xc]
cmp dword [esp + 0x14], ecx
push 0
cmovl ecx, dword [esp + 0x18]
push eax
push ecx
push edx
push dword [0x40e014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404426
pop edi
pop ebx
mov eax, 0xfffffffd
pop esi
pop ecx
ret 0x10
mov esi, dword [esp + 0xc]
add dword [0x42718c], esi
pop edi
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0x10

Function at 0x404460
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x80
cmp dword [esp + 0x84], 0
je 0x404491
mov eax, dword [0x4271a0]
test eax, eax
je 0x404480
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x4271a0], 0
add esp, 0x80
ret
cmp dword [0x4271a0], 0
je 0x4044a8
push 0
call fcn.00407fa0
add esp, 0x80
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x413180]
jbe 0x404518
cmp dword [0x437518], 0
je 0x4044f3
test byte [0x439634], 1
je 0x404518
call fcn.00404440
push eax
lea eax, [esp + 4]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp]
push eax
push 0
call fcn.00407ab0
add esp, 0x80
ret
push 0
push 0x4049b0
push 0
push 0x6f
push dword [0x437514]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x4271a0], eax
call dword [sym.imp.USER32.dll_ShowWindow]
add esp, 0x80
ret
Function at 0x404a50
Capabilities:
Check os version
Delete registry value

Disassembly:
sub esp, 0x20c
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x404ae7
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc], ax
lea eax, [esp + 0xe]
push eax
call fcn.0040a550
lea eax, [esp + 0x10]
push 0x103
push eax
call fcn.00404af0
add esp, 0x14
cmp word [esp + 4], 0
je 0x404ae7
push esi
mov dword [esp + 4], 0
mov esi, 0xf003f
call fcn.00404ea0
test eax, eax
mov ecx, 0xf013f
lea eax, [esp + 4]
push eax
cmovne esi, ecx
push esi
push 0
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x404ae7
lea eax, [esp + 4]
push eax
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x20c
ret
Function at 0x405670
Capabilities:
Check os version
Set registry value

Disassembly:
sub esp, 0x20c
push edi
mov edi, dword [esp + 0x214]
test edi, edi
je 0x40574a
cmp word [edi], 0
je 0x40574a
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x40574a
push esi
mov dword [esp + 8], 0
mov esi, 0xf003f
call fcn.00404ea0
test eax, eax
mov ecx, 0xf013f
lea eax, [esp + 8]
push eax
cmovne esi, ecx
push esi
push 0
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x40574a
push 0x206
push eax
mov word [esp + 0x10], ax
lea eax, [esp + 0x12]
push eax
call fcn.0040a550
push 0x103
lea eax, [esp + 0x18]
push eax
push edi
call fcn.00404be0
add esp, 0x18
lea ecx, [esp + 8]
xor eax, eax
lea edx, [ecx + 2]
mov word [esp + 0x20e], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405711
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x405740
lea eax, [ecx*2 + 2]
push eax
lea eax, [esp + 0xc]
push eax
push 1
push 0
push edi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
add esp, 0x20c
ret
Function at 0x407bc0
Capabilities:
Create directory

Disassembly:
sub esp, 0x20
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x40001
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push dword [esp + 0x28]
mov dword [esp + 0x18], 0x40cb00
mov dword [esp + 0x1c], 0x40cb00
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x40caf0
mov dword [esp + 8], 0xc
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407c3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x407c48
lea eax, [esp + 0xc]
push eax
push 0x80000007
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
je 0x407c42
xor eax, eax
add esp, 0x20
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x20
ret 4
Function at 0x407f20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x23c
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
cmp ecx, 0x104
jbe 0x407f82
xor ecx, ecx
mov eax, 1
push dword [esp + 0x240]
lea eax, [eax*2 + 0x40c368]
push eax
lea eax, [esp + 8]
lea eax, [eax + ecx*2]
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [esp]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add esp, 0x23c
ret 4
test ecx, ecx
je 0x407f41
cmp word [esp + ecx*2 - 2], 0x5c
je 0x407f41
xor eax, eax
jmp 0x407f46

Function at 0x407ff0
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x408014
push dword [esp + 8]
push dword [esp + 8]
call fcn.00408070
add esp, 8
inc dword [0x439610]
ret 8
Function at 0x408070
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
push esi
push edi
push 0x40cbfc
push 0x432eb8
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test esi, esi
je 0x4080d9
push esi
call ebp
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push 1
push ecx
push 1
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
push 0x432eb8
push esi
call edi
test eax, eax
je 0x4081ec
cmp eax, 0x400
jg 0x4081ec
push 0x400
push 0x4326b8
push dword [esp + 0x18]
call edi
test eax, eax
je 0x4081ec
cmp eax, 0x400
jg 0x4081ec
push ebx
push 0x4326b8
push 0x432eb8
push str._ls_ls_r_n
push 0x4322b8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x439544]
add esp, 0x10
mov ebx, eax
mov dword [esp + 0x18], ebx
push dword [ecx + 0x128]
push 0x4326b8
call fcn.00407c50
push 0x4326b8
call ebp
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push 4
push ecx
push 1
push 0xc0000000
push 0x4326b8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4081eb
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebx + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4081e4
push esi
push edi
push ebp
call fcn.00408950
test eax, eax
je 0x4081e4
push str._Rename__r_n
push edi
call fcn.00408bc0
test eax, eax
jne 0x4081f0
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov edx, esi
push ebx
push 0x4322b8
lea eax, [edx + edi]
push eax
call fcn.00408620
push 0
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebx]
push eax
push edi
push ebp
call fcn.00408a20
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
pop ebp
ret
push 0x40cc10
add eax, 0xa
push eax
call fcn.00408bc0
mov edx, eax
test edx, edx
je 0x4081b4
lea ecx, [edi + esi]
add ebx, ecx
cmp ecx, edx
jbe 0x40821a
sub ebx, ecx
nop
mov al, byte [ecx]
mov byte [ebx + ecx], al
dec ecx
cmp ecx, edx
ja 0x408210
mov ebx, dword [esp + 0x18]
sub edx, edi
inc edx
jmp 0x4081b6
Function at 0x408230
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push esi
call edi
test eax, eax
jne 0x4082ea
push eax
lea eax, [esp + 0xc]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x408283
cmp dword [esp + 8], 2
jne 0x408283
mov ax, word [esp + 0x10]
cmp al, 0xff
jne 0x408283
cmp ah, 0xfe
jne 0x408283
pop edi
xor eax, eax
pop esi
pop ecx
ret 8
cmp dword [esp + 0x14], 0
je 0x4082e1
push 1
push 0
push 0
push esi
call edi
test eax, eax
jne 0x4082e1
push eax
lea eax, [esp + 0x18]
push eax
push 2
push 0x40cb24
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4082cd
cmp dword [esp + 0x14], 2
jne 0x4082cd
mov ecx, 1
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
pop edi
cmovne eax, edx
pop esi
pop ecx
ret 8
xor ecx, ecx
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
pop edi
cmovne eax, edx
pop esi
pop ecx
ret 8
push 0
push 0
push 0
push esi
call edi
pop edi
mov eax, 1
pop esi
pop ecx
ret 8

Function at 0x408400
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
je 0x408460
mov ecx, edi
and ecx, 0xfffffffe
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [esp + 0x10], 1
push esi
je 0x40843d
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x408451
pop edi
mov eax, 1
pop esi
ret 8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x408451
pop edi
mov eax, 1
pop esi
ret 8
test byte [esp + 0x10], 4
jne 0x408460
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
xor eax, eax
pop esi
ret 8
Function at 0x408500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
push 0x800
push dword [esp + 0xc]
push 0x4312b8
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x4312b8
call fcn.00408c50
mov edi, eax
test edi, edi
jne 0x40852b
xor eax, eax
pop edi
ret 4
push edi
call fcn.00408db0
test byte [0x439540], 0x80
je 0x408547
movzx eax, word [edi]
test ax, ax
je 0x408525
cmp eax, 0x5c
je 0x408525
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sub edi, 0x4312b8
push ebp
push esi
push 0x4312b8
sar edi, 1
call ebx
mov esi, dword [sym.imp.USER32.dll_CharPrevW]
cmp eax, edi
jle 0x4085c5
mov ebp, dword [sym.imp.KERNEL32.dll_FindClose]
nop
push 0x4336b8
push 0x4312b8
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x408591
push eax
call ebp
test byte [0x4336b8], 0x10
je 0x40860d
push 0x4312b8
call ebx
lea eax, [eax*2 + 0x4312b8]
nop
cmp word [eax], 0x5c
je 0x4085b5
push eax
push 0x4312b8
call esi
cmp eax, 0x4312b8
ja 0x4085a0
xor ecx, ecx
push 0x4312b8
mov word [eax], cx
call ebx
cmp eax, edi
jg 0x408570
push 0x4312b8
call ebx
lea eax, [eax*2 + 0x4312b8]
push eax
push 0x4312b8
call esi
cmp word [eax], 0x5c
je 0x4085f1
push 0x40c368
push 0x4312b8
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4312b8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
pop esi
pop ebp
setne cl
pop ebx
mov eax, ecx
pop edi
ret 4
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
ret 4

Function at 0x408650
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x10
mov dword [0x430270], 0x44
lea eax, [esp]
mov dword [0x43029c], 0x80
push eax
push 0x430270
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push dword [esp + 0x34]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x408695
add esp, 0x10
ret 4
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp]
add esp, 0x10
ret 4