joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002dee4
Capabilities:
Terminate process

Disassembly:
push 0xc
mov eax, 0x100ba33e
call fcn.1004a303
mov edi, ecx
mov dword [ebp - 0x18], edi
xor edx, edx
mov dword [edi], edx
mov dword [ebp - 4], 1
cmp dword [ebp + 8], edx
je 0x1002df81
mov esi, dword [ebp + 8]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x1002df0b
sub esi, ecx
sar esi, 1
inc esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1007531c
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x1002df4e
push 0x100bffd8
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], 0x8007000e
call sub.msvcr100.dll__CxxThrowException
lea ecx, [esi + esi]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
ja 0x1002df6f
push 2
pop eax
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push ecx
push dword [ebp + 8]
push eax
call sub.msvcr100.dll_memcpy
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov dword [edi], eax
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.1004a3db
ret 4

Function at 0x1002e0e4
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x224
mov eax, 0x100ba387
call fcn.1004a36c
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp + 0x14]
xor ecx, ecx
mov dword [ebp - 0x230], eax
mov esi, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], 0x208
test eax, eax
je 0x1002e147
push eax
mov dword [ebp - 0x21c], ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor ecx, ecx
lea eax, [ebp - 0x21c]
push eax
push 1
push ecx
push dword [ebp - 0x22c]
push edi
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov edi, 0xffff
test eax, eax
je 0x1002e17b
mov esi, eax
jle 0x1002e173
and esi, edi
or esi, 0x80070000
test esi, esi
js 0x1002e231
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push dword [ebp - 0x228]
push dword [ebp - 0x21c]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x1002e1b4
mov esi, eax
jle 0x1002e1b4
and esi, edi
or esi, 0x80070000
test esi, esi
js 0x1002e231
cmp dword [ebp - 0x224], 1
je 0x1002e1d1
cmp dword [ebp - 0x224], 7
je 0x1002e1d1
mov esi, 0x8000ffff
jmp 0x1002e231
mov eax, dword [ebp - 0x220]
xor ecx, ecx
push 2
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1007531c
mov edi, eax
pop ecx
test edi, edi
jne 0x1002e20f
push 0x100bffd8
lea eax, [ebp - 0x228]
push eax
mov dword [ebp - 0x228], 0x8007000e
call sub.msvcr100.dll__CxxThrowException
mov ecx, dword [ebp - 0x230]
push edi
call fcn.1007531c
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
push edi
call sub.msvcr100.dll_memcpy
add esp, 0xc
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x21c]
test ecx, ecx
je 0x1002e24d
and dword [ebp - 0x21c], 0
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
call fcn.1004a3ef
ret 0x10
Function at 0x1003b977
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1000a714]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10009754
call fcn.1007531c
mov edi, eax
lea eax, [ebp - 0x118]
xor esi, esi
push eax
mov dword [ebp - 0x118], 0x114
mov dword [ebp - 0x120], esi
call dword [sym.imp.kernel32.dll_GetVersionExW]
test eax, eax
je 0x1003b9d8
cmp dword [ebp - 0x108], 2
jne 0x1003b9d8
cmp dword [ebp - 0x114], 5
jb 0x1003b9d8
mov dword [ebp - 0x120], 1
test edi, edi
jne 0x1003ba6d
push 0x10009760
call fcn.1007531c
test eax, eax
jne 0x1003ba6d
mov edi, 0x10009718
mov ebx, esi
cmp ebx, 0x3c
jae 0x1003ba12
push esi
push esi
push esi
push 0x10009970
push edi
call fcn.1007531c
add ebx, 0x14
add edi, 0x14
test eax, eax
je 0x1003b9f5
mov edi, 0x10009718
test eax, eax
jne 0x1003ba6d
mov ebx, esi
cmp ebx, 0x3c
jae 0x1003ba3e
push dword [ebp - 0x120]
push esi
push 0x10009970
push edi
call fcn.1007531c
add ebx, 0x14
add edi, 0x14
test eax, eax
je 0x1003ba1d
mov edi, 0x10009718
test eax, eax
jne 0x1003ba6d
cmp esi, 0x3c
jae 0x1003ba69
push 1
push dword [ebp - 0x120]
push 0x10009970
push edi
call fcn.1007531c
add esi, 0x14
add edi, 0x14
test eax, eax
je 0x1003ba47
test eax, eax
je 0x1003ba72
mov eax, 0x80040201
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10049665
leave
ret

Function at 0x10048e3c
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x100be4e0
call fcn.1004a336
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], 0x1000a6b8
push 3
pop edi
mov dword [ebp - 4], edi
mov byte [ebp - 4], 4
call fcn.10048fe1
mov eax, dword [esi + 0x14]
xor ebx, ebx
test eax, eax
je 0x10048e81
cmp word [eax], bx
je 0x10048e81
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
jne 0x10048e81
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 4], edi
jmp 0x10048e98
mov byte [ebp - 4], 2
mov ecx, dword [esi + 0x138]
test ecx, ecx
je 0x10048eac
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 1
lea ecx, [esi + 0xa4]
call fcn.1003709e
mov byte [ebp - 4], bl
lea ecx, [esi + 0x10]
call fcn.1003709e
or dword [ebp - 4], 0xffffffff
mov dword [esi], 0x1000a6b0
call fcn.1004a3db
ret
Function at 0x10049665
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000a714]
jne 0x1004a5c5
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x100cecf0], eax
mov dword [0x100cecec], ecx
mov dword [0x100cece8], edx
mov dword [0x100cece4], ebx
mov dword [0x100cece0], esi
mov dword [0x100cecdc], edi
mov word [0x100ced08], ss
mov word [0x100cecfc], cs
mov word [0x100cecd8], ds
mov word [0x100cecd4], es
mov word [0x100cecd0], fs
mov word [0x100ceccc], gs
pushfd
pop dword [0x100ced00]
mov eax, dword [ebp]
mov dword [0x100cecf4], eax
mov eax, dword [ebp + 4]
mov dword [0x100cecf8], eax
lea eax, [ebp + 8]
mov dword [0x100ced04], eax
mov eax, dword [ebp - 0x320]
mov dword [0x100cec40], 0x10001
mov eax, dword [0x100cecf8]
mov dword [0x100cebf4], eax
mov dword [0x100cebe8], 0xc0000409
mov dword [0x100cebec], 1
mov eax, dword [0x1000a714]
mov dword [ebp - 0x328], eax
mov eax, dword [0x100c8984]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x100cec38], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x1000a924
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x100cec38], 0
jne 0x1004a6b1
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x1005b8fc
Capabilities:
Delete directory

Disassembly:
push 0x10
mov eax, 0x100beb24
call fcn.1004a303
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0x1000ce54
mov dword [edi + 4], 0x1001f860
mov dword [edi + 0xc], 0x1000ce64
mov dword [edi + 0x10], 0x1000cea0
xor ebx, ebx
mov dword [ebp - 4], 2
cmp dword [edi + 0x38], ebx
je 0x1005b990
lea eax, [edi + 0x1e8]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.1005e47a
mov esi, dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp esi, eax
je 0x1005b964
push 0x326a6f78
call fcn.1007531c
cmp dword [edi + 0x208], ebx
je 0x1005b976
push 0x326a6f79
call fcn.1007531c
cmp dword [edi + 0x204], ebx
je 0x1005b988
push 0x326a6f7a
call fcn.1007531c
lea ecx, [ebp - 0x1c]
call fcn.100515e1
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x1005b9a0
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x14], ebx
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x1005b9b0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi + 0x18], ebx
mov eax, dword [edi + 0x214]
cmp eax, 0xffffffff
je 0x1005b9c9
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [edi + 0x214], 0xffffffff
cmp dword [edi + 0x218], ebx
je 0x1005b9f7
lea esi, [edi + 0x21c]
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1005b9ec
push 0x326a7030
call fcn.1007531c
xor eax, eax
mov word [esi], ax
mov dword [edi + 0x218], ebx
lea eax, [edi + 0x1e8]
push eax
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
lea ecx, [edi + 0x40]
call fcn.1005a0fa
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.1006499f
call fcn.1004a3db
ret
Function at 0x1007531c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1007532b
pop dword [ebp - 0x2c]
mov eax, 0x841d5b7f
add eax, 0x8be9f7ac
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xb1d9135b
add dword [ebp - 0x3c], 0x9c7931f0
mov dword [ebp - 0x38], 0x84afe5a1
add dword [ebp - 0x38], 0xad8366a4
mov dword [ebp - 0x34], 0x96478b24
sub dword [ebp - 0x34], 0x49fb46f6
mov dword [ebp - 0x30], 0xd4fa22d6
add dword [ebp - 0x30], 0x2b05dd2a
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xe12f8cd6
add dword [ebp - 0x3c], 0x9342dc80
mov dword [ebp - 0x38], 0x4e330942
sub dword [ebp - 0x38], 0xcc6a7cd
mov dword [ebp - 0x34], 0x2f60f837
sub dword [ebp - 0x34], 0xcbf18bcb
mov dword [ebp - 0x30], 0x4067f934
add dword [ebp - 0x30], 0xbf9806cc
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x55231
push 0
call eax
mov ecx, 0xa35df45e
add ecx, 0x5ca248ac
xor esi, esi
add esi, eax
mov edi, 0x100d9600
add edi, dword [ebp - 0x2c]
mov edx, 0x21378b66
add edx, 0x2e27c960
xor dword [ebp - 0x1c], ecx
mov ebx, dword [edi]
xor ebx, edx
add dword [ebp - 0x14], 0xc79b5189
mov dword [esi], ebx
sub dword [ebp - 0x18], 0x78d0bf63
add esi, 0x6053e98b
add esi, 0x9fac1679
add edi, 0x90b5865f
sub edi, 0x90b5865b
loop 0x1007543f
add eax, 0x9dba01ea
add eax, 0x6246e511
mov ebx, eax
add eax, 5
mov ecx, 0x9a1a6a9d
sub ecx, 0x8a1a6a9d
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x1000891a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10004058]
jne 0x1002f994
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x1003ad68], eax
mov dword [0x1003ad64], ecx
mov dword [0x1003ad60], edx
mov dword [0x1003ad5c], ebx
mov dword [0x1003ad58], esi
mov dword [0x1003ad54], edi
mov word [0x1003ad80], ss
mov word [0x1003ad74], cs
mov word [0x1003ad50], ds
mov word [0x1003ad4c], es
mov word [0x1003ad48], fs
mov word [0x1003ad44], gs
pushfd
pop dword [0x1003ad78]
mov eax, dword [ebp]
mov dword [0x1003ad6c], eax
mov eax, dword [ebp + 4]
mov dword [0x1003ad70], eax
lea eax, [ebp + 8]
mov dword [0x1003ad7c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1003acb8], 0x10001
mov eax, dword [0x1003ad70]
mov dword [0x1003ac6c], eax
mov dword [0x1003ac60], 0xc0000409
mov dword [0x1003ac64], 1
mov eax, dword [0x10004058]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10039abc]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1003acb0], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x1000426c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1003acb0], 0
jne 0x1002fa80
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x40257f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
xor edi, edi
lea ecx, [ebp - 0x1c]
mov ebx, vtable.Util::RegKey.0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], edi
call fcn.00406c99
lea eax, [ebp - 0x18]
push eax
push 0x20019
push edi
push str.SoftwareTencentQQBrowserAdvanced
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x18]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x402613
push esi
push 4
pop esi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], edi
push eax
push edi
push str.JoinUserExperienceImprovePlan
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb al, al
inc al
je 0x402612
cmp dword [ebp - 8], esi
je 0x402603
cmp dword [ebp - 8], 3
jne 0x402612
cmp dword [ebp - 0xc], esi
jne 0x402612
cmp dword [ebp - 0x10], edi
setne byte [0x4625d0]
pop esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
call fcn.00406c99
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40480c
Capabilities:
Check if file exists
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48c
mov eax, dword [0x461008]
xor eax, esp
mov dword [esp + 0x488], eax
push ebx
push esi
push edi
push ecx
push ecx
xor edi, edi
mov esi, ecx
push edi
push ecx
push edi
xor edx, edx
mov ecx, 0x970
call fcn.004026b8
add esp, 0x14
call fcn.004027e0
xor eax, eax
push 0x206
mov word [esp + 0x84], ax
lea eax, [esp + 0x86]
push edi
push eax
call fcn.0042edc0
add esp, 0xc
lea eax, [esp + 0x80]
mov ebx, 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x404894
push str.TencentQQBrowser_bugreport.exe
lea eax, [esp + 0x84]
push ebx
push eax
call fcn.0042d724
add esp, 0xc
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404a1f
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call ebx
mov dword [0x464ea4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x464d74]
mov dword [0x464ea8], eax
mov eax, dword [0x464d78]
sub eax, ecx
mov dword [0x464eb8], esi
cdq
mov esi, 0x280
idiv esi
mov dword [0x464eb0], edi
test eax, eax
je 0x4048f2
mov dword [0x464ec0], ecx
mov dword [0x464ec4], eax
xor eax, eax
push 0x206
mov word [esp + 0x28c], ax
lea eax, [esp + 0x28e]
push edi
push eax
call fcn.0042edc0
add esp, 0xc
mov dword [esp + 0x1c], 0xc
xor eax, eax
mov dword [esp + 0x20], edi
inc eax
mov dword [esp + 0x24], eax
push edi
push edi
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x40
mov esi, eax
mov dword [esp + 0x3c], 0x44
lea eax, [esp + 0x40]
push edi
push eax
call fcn.0042edc0
add esp, 0xc
xorps xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
xor edx, edx
mov dword [esp + 0x14], edi
inc edx
xor ecx, ecx
push edx
push edi
mov word [esp + 0x74], cx
lea ecx, [esp + 0x1c]
push ecx
push eax
push eax
push eax
mov dword [esp + 0x80], edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x404a15
test esi, esi
je 0x404a1c
call ebx
push eax
push 0x464ea0
push dword [esp + 0x18]
lea eax, [esp + 0x294]
push esi
push str.bugreport__buginfo:_p:_p:_p:_lu
push 0x104
push eax
call fcn.00404e1f
add esp, 0x1c
lea eax, [esp + 0x28]
xor ebx, ebx
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [esp + 0x2a8]
push eax
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404a15
mov eax, dword [esp + 0x28]
push 0xffffffffffffffff
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push ebx
push eax
push 2
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esp + 0x28]
call edi
push dword [esp + 0x2c]
call edi
test esi, esi
je 0x404a1c
push esi
call edi
xor eax, eax
inc eax
mov ecx, dword [esp + 0x494]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042cfd6
mov esp, ebp
pop ebp
ret
Function at 0x404f8f
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 0x24
mov eax, 0x449112
call fcn.0042f711
mov edi, ecx
mov dword [ebp - 0x20], edi
xor ebx, ebx
lea eax, [ebp + 8]
push ebx
push 0x80
push 3
push ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x1c], 8
push 1
cmovae eax, dword [ebp + 8]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
je 0x405140
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x405140
push ebx
push ebx
push ebx
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 4], 2
test ebx, ebx
je 0x4050fd
xor eax, eax
push eax
push eax
push eax
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [edi], edx
test edx, edx
je 0x4050fd
mov ecx, dword [edx + 0x3c]
movzx eax, word [ecx + edx + 6]
test ax, ax
jne 0x405037
or dword [ebp - 0x24], 0xffffffff
jmp 0x405052
imul eax, eax, 0x28
add eax, ecx
mov ecx, dword [eax + edx + 0xe4]
add ecx, dword [eax + edx + 0xe0]
mov dword [ebp - 0x24], ecx
cmp ecx, 0xffffffff
jne 0x40505c
cmp dword [ebp - 0x28], 0xffffffff
jle 0x4050ed
mov eax, dword [str.zzd.]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 1]
mov al, byte [0x452b7c]
mov byte [ebp - 0x14], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405072
sub ecx, edx
mov dword [ebp - 0x1c], ecx
lea eax, [ecx + 1]
push eax
call fcn.0042cfcd
push dword [ebp - 0x1c]
mov edi, eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, dword [ebp - 0x24]
push eax
push edi
call fcn.0042ee50
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0043f163
add esp, 0x1c
test eax, eax
je 0x40512c
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 8]
mov dword [ebp - 0x24], eax
cmp eax, dword [ebp - 0x28]
jg 0x4050e3
push dword [ebp - 0x1c]
add eax, ecx
push eax
push edi
call fcn.0042ee50
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0043f163
add esp, 0x18
test eax, eax
je 0x40512c
push edi
call fcn.0042d790
mov edi, dword [ebp - 0x20]
pop ecx
cmp dword [edi], 0
je 0x4050fd
push dword [edi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
and dword [edi], 0
xor edi, edi
cmp ebx, 0xffffffff
je 0x40510b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp esi, 0xffffffff
je 0x405119
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.00401aa3
mov eax, edi
call fcn.0042f6cf
ret
push edi
call fcn.0042d790
mov eax, dword [ebp - 0x20]
pop ecx
mov edi, dword [eax]
add edi, dword [ebp - 0x1c]
add edi, dword [ebp - 0x24]
jmp 0x4050ff
mov edi, ebx
jmp 0x40510d
Function at 0x405344
Capabilities:
Delete directory

Disassembly:
push 0x5c
mov eax, 0x449177
call fcn.0042f711
mov ebx, ecx
mov dword [ebp - 0x48], ebx
xor edi, edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
push ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00401605
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00405190
mov esi, 0x452b8c
lea ecx, [ebp - 0x44]
push esi
call fcn.00401c13
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00405247
push edi
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.00401aa3
push edi
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x2c]
call fcn.004054f9
pop ecx
push edi
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00401aa3
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00401605
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00405190
push esi
lea ecx, [ebp - 0x44]
call fcn.00401c13
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c]
call fcn.00405247
push edi
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.00401aa3
push 1
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x2c]
call fcn.004054f9
pop ecx
push edi
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00401aa3
mov eax, dword [ebp - 0x5c]
mov esi, dword [ebp - 0x60]
sub eax, esi
push 0x18
cdq
pop edi
idiv edi
mov ecx, eax
mov eax, dword [ebp - 0x50]
mov ebx, dword [ebp - 0x54]
sub eax, ebx
cdq
idiv edi
mov edi, eax
mov dword [ebp - 0x64], edi
test ecx, ecx
je 0x405494
mov ebx, dword [ebp - 0x48]
mov edi, ecx
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00401605
mov edx, esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2c]
call fcn.00405247
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.0042e292
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00401aa3
add esi, 0x18
dec edi
jne 0x40544f
mov edi, dword [ebp - 0x64]
mov ebx, dword [ebp - 0x54]
test edi, edi
je 0x4054e1
push dword [ebp - 0x48]
lea ecx, [ebp - 0x2c]
call fcn.00401605
mov edx, ebx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2c]
call fcn.00405247
lea ecx, [ebp - 0x2c]
call fcn.00405344
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00401aa3
add ebx, 0x18
dec edi
jne 0x405498
lea ecx, [ebp - 0x54]
call fcn.00402f33
lea ecx, [ebp - 0x60]
call fcn.00402f33
mov al, 1
call fcn.0042f6cf
ret
Function at 0x406d3b
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 4
mov eax, 0x4491f7
call fcn.0042f6de
mov esi, ecx
xor ebx, ebx
lea eax, [ebp + 8]
push ebx
push 0x80
push 3
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x1c], 8
push ebx
cmovae eax, dword [ebp + 8]
push 1
push 0x80000000
push eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push ebx
push 2
push ebx
push edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
xor eax, eax
push eax
push eax
push eax
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0xc
mov dword [ebp - 0x10], eax
call fcn.004021d7
pop ecx
test eax, eax
je 0x406dbb
mov ecx, dword [ebp - 0x10]
mov dword [eax], edi
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
jmp 0x406dbd
xor eax, eax
push 0
push 1
lea ecx, [ebp + 8]
mov dword [esi], eax
call fcn.00401aa3
mov eax, esi
call fcn.0042f6bb
ret 0x18

Function at 0x406e7d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
je 0x406f72
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
js 0x406f72
xor eax, eax
push 0x4e
push eax
mov word [ebp - 0x58], ax
lea eax, [ebp - 0x56]
push eax
call fcn.0042edc0
movzx eax, byte [ebp - 0x261]
push eax
movzx eax, byte [ebp - 0x262]
push eax
movzx eax, byte [ebp - 0x263]
push eax
movzx eax, byte [ebp - 0x264]
push eax
movzx eax, byte [ebp - 0x265]
push eax
movzx eax, byte [ebp - 0x266]
push eax
movzx eax, byte [ebp - 0x267]
push eax
movzx eax, byte [ebp - 0x268]
push eax
movzx eax, word [ebp - 0x26a]
push eax
movzx eax, word [ebp - 0x26c]
push eax
push dword [ebp - 0x270]
lea eax, [ebp - 0x58]
push str._08X__04X__04x__02X_02X__02X_02X_02X_02X_02X_02X
push 0x28
push eax
call fcn.00406e28
add esp, 0x44
xor eax, eax
mov word [ebp - 0x260], ax
push 0x206
push eax
lea eax, [ebp - 0x25e]
push eax
call fcn.0042edc0
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
xor eax, eax
inc eax
jmp 0x406f74
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042cfd6
mov esp, ebp
pop ebp
ret