joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e0c0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x450058
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x46414c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], 0
test esi, esi
jne 0x41e12d
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e119
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0x20]
mov edi, 1
cmp dword [eax - 4], edi
jle 0x41e14d
mov ecx, dword [eax - 0xc]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.004017a0
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41e0f1
mov eax, dword [esp + 0x20]
cmp dword [eax - 4], edi
jle 0x41e173
mov ecx, dword [eax - 0xc]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.004017a0
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
push eax
call fcn.00422690
xor ecx, ecx
add esp, 4
test eax, eax
setne cl
mov dword [esi], eax
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov esi, ecx
mov ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41e1b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x420420
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x420427
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x420504
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x45d000]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x45d000]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x45d000]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x45d000]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x45d000]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x45d000]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x45d000]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x45d000]
inc ecx
sub edx, 8
sub esi, 1
jne 0x420440
pop edi
test edx, edx
je 0x42052b
jmp 0x420510
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x45d000]
inc ecx
sub edx, 1
jne 0x420510
not eax
pop esi
ret

Function at 0x420530
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x45d000]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x45d000]
mov dword [edx + 8], ecx
ret

Function at 0x420580
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x45d000]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x45d000]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0x420ce0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x420d12
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x420d08
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x420d25
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call fcn.00428630
add dword [edi + 0x1c], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret
Function at 0x420d40
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x420d73
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x13]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x420d6d
mov byte [esi + 8], 1
mov edi, dword [esp + 8]
jmp 0x420d9f
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x420d85
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x14]
push edi
add edx, ebx
push edx
lea eax, [esp + 0x13]
push eax
call fcn.00428630
add esp, 0xc
add ebx, edi
mov dword [esi + 0x1c], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x420db6
movzx ecx, byte [esp + 3]
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
xor eax, eax
add esp, 8
ret
cmp byte [esi], 0
je 0x420db0
cmp byte [esi + 8], 0
je 0x420db0
or eax, 0xffffffff
add esp, 8
ret
Function at 0x420ea0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x420ee5
cmp byte [esi + 1], 0
je 0x420eed
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x420f02
cmp byte [esi + 1], 0
je 0x420ef4
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [esi + 0xc]
mov dword [esp + 4], ebp
jmp 0x420f0b
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x420ebe
or eax, 0xffffffff
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x420f0b
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov ebp, eax
push edi
mov edi, 0xffff
mov dword [esp + 0xc], edi
cmp ebp, edi
jae 0x420f1f
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call fcn.004267b3
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x420f3d
pop ebx
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x18
ret
mov eax, 4
mov dword [esp + 0x18], 0xffffffff
cmp edi, eax
jbe 0x421051
jmp 0x420f60
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
mov dword [esp + 0x14], edi
cmp eax, edi
ja 0x420f71
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
mov dword [esp + 0x20], eax
cmp ebp, 0x404
jbe 0x420f8a
mov ebp, 0x404
cmp byte [esi], 0
je 0x420faf
cmp byte [esi + 1], 0
je 0x421051
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x420fb2
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebp
je 0x420fda
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x420fd4
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x421000
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x420feb
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
push edi
add ecx, eax
push ecx
push ebx
call fcn.00428630
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x421051
lea eax, [ebp - 3]
test eax, eax
jl 0x42103c
dec eax
cmp byte [eax + ebx], 0x50
jne 0x42102c
cmp byte [eax + ebx + 1], 0x4b
jne 0x42102c
cmp byte [eax + ebx + 2], 5
jne 0x42102c
cmp byte [eax + ebx + 3], 6
je 0x421032
test eax, eax
jge 0x421010
jmp 0x42103c
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
jne 0x421051
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x420f54
push ebx
call fcn.00424dcf
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
Function at 0x421980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x421998
pop edi
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x42198d
cmp dword [edi + 0x7c], ebx
je 0x4219a7
call fcn.00421d70
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.004216f0
add esp, 0xc
test eax, eax
je 0x4219cd
pop edi
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push ebp
push 0x84
call fcn.004267b3
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x421a0f
push 0x4000
call fcn.004267b3
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add esp, 4
mov dword [ebp], eax
mov dword [ebp + 0x44], ecx
mov dword [ebp + 0x48], edx
mov dword [ebp + 0x4c], ebx
cmp eax, ebx
jne 0x421a1b
push ebp
call fcn.00424dcf
add esp, 4
pop ebp
pop edi
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [ebp + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [ebp + 0x54], ecx
mov dword [ebp + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [ebp + 0x64], edx
mov ecx, dword [edi]
mov dword [ebp + 0x60], ecx
mov edx, dword [edi + 0xc]
push esi
mov dword [ebp + 0x68], edx
mov dword [ebp + 0x18], ebx
cmp eax, ebx
jne 0x421a64
lea esi, [ebp + 4]
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
call fcn.004207f0
test eax, eax
jne 0x421a64
mov dword [ebp + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [ebp + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [ebp + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [ebp + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x421a8e
mov cl, byte [edi + 0x39]
mov byte [ebp + 0x80], cl
jmp 0x421a97
mov dl, byte [edi + 0x3f]
mov byte [ebp + 0x80], dl
movzx eax, byte [ebp + 0x6c]
mov esi, dword [esp + 0x20]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [ebp + 0x70]
mov dword [ebp + 0x7c], eax
mov dword [edx], 0x12345678
mov dword [ebp + 0x74], 0x23456789
mov dword [ebp + 0x78], 0x34567890
cmp esi, ebx
je 0x421ad4
mov cl, byte [esi]
cmp cl, bl
je 0x421ad4
call fcn.00420530
add esi, 1
jne 0x421ac4
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [ebp + 0x3c], eax
mov dword [ebp + 8], ebx
pop esi
mov dword [edi + 0x7c], ebp
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x421ed0
Capabilities:
Get common file path

Disassembly:
cmp dword [esi], 0
push edi
jne 0x421f6f
cmp dword [esi + 4], 0xffffffff
jne 0x421f6f
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, edi
lea edx, [eax + 2]
jmp 0x421f00
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421f00
sub eax, edx
sar eax, 1
movzx eax, word [esi + eax*2 + 0x242]
cmp ax, 0x5c
je 0x421f39
cmp ax, 0x2f
je 0x421f39
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x421f26
mov eax, dword [0x45b7e0]
mov dword [edi], eax
mov eax, dword [esp + 8]
lea ecx, [esp + 8]
push ecx
call fcn.00420c40
add esp, 4
test eax, eax
jne 0x421f56
mov eax, dword [esp + 8]
pop edi
ret 4
call fcn.00421070
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
ret 4
mov eax, 0x1000000
pop edi
ret 4
Function at 0x42404d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46414c]
jne 0x424057
repz ret
jmp fcn.0042841f

Function at 0x430f53
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00427e2e
and dword [ebp - 4], 0
cmp dword [0x46f7dc], 0
mov ebx, eax
jne 0x431004
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4310b5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x451d60
push edi
call esi
test eax, eax
je 0x4310b5
push eax
call fcn.00427dbc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x46f7dc], eax
call esi
push eax
call fcn.00427dbc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x46f7e0], eax
call esi
push eax
call fcn.00427dbc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x46f7e4], eax
call esi
push eax
call fcn.00427dbc
pop ecx
mov dword [0x46f7ec], eax
test eax, eax
je 0x431004
push 0x451d08
push edi
call esi
push eax
call fcn.00427dbc
pop ecx
mov dword [0x46f7e8], eax
mov eax, dword [0x46f7e8]
cmp eax, ebx
je 0x43105c
cmp dword [0x46f7ec], ebx
je 0x43105c
push eax
call fcn.00427e37
push dword [0x46f7ec]
mov esi, eax
call fcn.00427e37
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43105c
test edi, edi
je 0x43105c
call esi
test eax, eax
je 0x431053
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x431053
test byte [ebp - 0xc], 1
jne 0x43105c
or dword [ebp + 0x10], 0x200000
jmp 0x431095
mov eax, dword [0x46f7e0]
cmp eax, ebx
je 0x431095
push eax
call fcn.00427e37
pop ecx
test eax, eax
je 0x431095
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x431095
mov eax, dword [0x46f7e4]
cmp eax, ebx
je 0x431095
push eax
call fcn.00427e37
pop ecx
test eax, eax
je 0x431095
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46f7dc]
call fcn.00427e37
pop ecx
test eax, eax
je 0x4310b5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4310b7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x438c90
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.00435740
mov eax, dword [0x46414c]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x438cf5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x438cf5
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.0042ce5f
add eax, 0x40
push eax
call fcn.00448928
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0042404d
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.004487f0
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x438d84
call fcn.00438bb0
test eax, eax
jle 0x438d84
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0042404d
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0042404d
add esp, 0x108
ret
Function at 0x402ebd
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x402eda
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x402ee9
mov ebx, 0x40f0f8
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402efe
mov ecx, dword [0x424798]
add ecx, eax
push ecx
call fcn.004030ec
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.004030ba
test eax, eax
je 0x403065
test byte [ebp + 0x17], 0x80
je 0x40304e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40b028
mov dword [ebp - 0xc], eax
call fcn.00405d8a
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x4030b0
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402f4e
mov esi, dword [ebp + 0x14]
mov edi, 0x40b0f8
push esi
push edi
call fcn.004030ba
test eax, eax
je 0x403065
sub dword [ebp + 0x14], esi
mov dword [0x40b040], edi
mov dword [0x40b044], esi
mov eax, dword [ebp - 8]
mov ecx, 0x40b028
mov dword [0x40b048], ebx
mov dword [0x40b04c], eax
call fcn.00405daa
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x403046
mov esi, dword [0x40b048]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x4092a0], 1
mov edi, eax
je 0x402ff0
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x402fbd
cmp dword [ebp + 0x14], 0
jne 0x402ff0
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x54]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.00404d4f
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x40303b
cmp dword [ebp + 0x10], eax
jne 0x403019
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40304a
cmp dword [ebp - 0x10], esi
jne 0x40304a
add dword [ebp - 4], esi
jmp 0x40302f
sub dword [ebp - 8], esi
add dword [ebp - 4], esi
cmp dword [ebp - 8], 1
mov ebx, dword [0x40b048]
jl 0x4030b0
cmp dword [ebp - 0x14], 1
jne 0x402f71
jmp 0x4030b0
cmp dword [ebp + 0x14], eax
jg 0x402f41
jmp 0x4030b0
push 0xfffffffffffffffc
jmp 0x403067
push 0xfffffffffffffffe
jmp 0x403067
test edi, edi
je 0x4030a5
cmp dword [ebp + 0x14], esi
jge 0x40305a
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.004030ba
test eax, eax
jne 0x4030ad
push 0xfffffffffffffffd
pop eax
jmp 0x4030b3
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403075
mov esi, dword [ebp + 0x14]
mov edi, 0x40b0f8
push esi
push edi
call fcn.004030ba
test eax, eax
je 0x403065
lea eax, [ebp + 0x10]
push 0
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40304a
cmp esi, dword [ebp + 0x10]
jne 0x40304a
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x40306a
jmp 0x4030b0
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x405234
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x422d48], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x405258
test al, 0x10
jne 0x40525b
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x422d48
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405286
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x4052ee
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00405599
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x405322
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4247c8], eax
jmp 0x4054b3
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405340
test eax, eax
je 0x405458
test byte [ebp + 0xc], 2
je 0x405458
mov esi, 0x421d48
push edi
push esi
call fcn.004059ac
test ebx, ebx
je 0x40535d
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405363
push edi
call fcn.00405500
push 0x409010
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40544e
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.004054e4
cmp byte [eax], 0
je 0x4053b4
cmp byte [ebp - 0x18], 0
je 0x4053b4
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x4053ca
mov al, byte [esi + 1]
test al, al
je 0x40542d
cmp al, 0x2e
jne 0x4053ca
cmp byte [esi + 2], 0
je 0x40542d
push esi
push ebx
call fcn.004059ac
mov eax, dword [ebp - 0x148]
test al, 0x10
je 0x4053f0
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x40542d
push dword [ebp + 0xc]
push edi
call fcn.004052ee
jmp 0x40542d
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405425
test byte [ebp + 0xc], 4
je 0x40541d
push edi
push 0xfffffffffffffff1
call fcn.00404d4f
push 0
push edi
call fcn.004056f4
jmp 0x40542d
inc dword [0x4247c8]
jmp 0x40542d
push edi
push 0xfffffffffffffff2
call fcn.00404d4f
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405392
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x405458
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4054b3
cmp dword [ebp - 8], esi
jne 0x40546d
inc dword [0x4247c8]
jmp 0x4054b3
push edi
call fcn.00405c81
test eax, eax
je 0x4054b3
push edi
call fcn.004054b9
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4054ab
test byte [ebp + 0xc], 4
je 0x405465
push edi
push 0xfffffffffffffff1
call fcn.00404d4f
push esi
push edi
call fcn.004056f4
jmp 0x4054b3
push edi
push 0xffffffffffffffe5
call fcn.00404d4f
pop edi
pop esi
leave
ret 8
Function at 0x405599
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x422148
push esi
call fcn.004059ac
push esi
call fcn.0040554c
mov edi, eax
test edi, edi
jne 0x4055ba
xor eax, eax
jmp 0x40560c
push edi
call fcn.00405be8
test byte [0x424750], 0x80
je 0x4055d3
mov al, byte [edi]
test al, al
je 0x4055b6
cmp al, 0x5c
je 0x4055b6
sub edi, esi
jmp 0x4055eb
call fcn.00405c81
test eax, eax
je 0x4055e5
test byte [eax], 0x10
je 0x4055b6
push esi
call fcn.00405500
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x4055d7
call fcn.004054b9
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x40567d
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4056ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4056f0
test edi, edi
jne 0x4056b7
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4056ea