joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4388c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x438a8a
sub esp, 0x64
xor ebx, ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
xor ebx, ebx
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
xor eax, eax
mov ebp, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x60], ebx
xor edx, edx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x58], ebp
mov ecx, ebp
mov ebp, dword [esp + 0x2c]
cmp edx, ebp
jge 0x438982
mov dword [esp + 0x34], ecx
mov ecx, dword [ecx]
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], eax
lea ebx, [esp + 0x20]
cmp ebx, 0
je 0x438a83
mov ebp, 4
mov edx, 4
mov dword [esp + 0x4c], ebx
mov dword [esp], ebx
mov dword [esp + 0x50], ebp
mov dword [esp + 4], ebp
mov dword [esp + 0x54], edx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call fcn.00431690
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
add eax, ecx
mov ecx, dword [esp + 0x34]
add ecx, 4
mov edx, dword [esp + 0x30]
inc edx
mov ebp, dword [esp + 0x2c]
cmp edx, ebp
jl 0x43891f
mov ebx, dword [esp + 0x68]
mov dword [esp], ebx
mov ebx, eax
mov dword [esp + 0x1c], eax
add ebx, 3
mov dword [esp + 4], ebx
call fcn.004384c0
mov ebx, dword [esp + 8]
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x3c], ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x44], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x48], ebx
xor eax, eax
mov ebp, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x60], ebx
xor edx, edx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x58], ebp
mov ecx, ebp
mov ebp, dword [esp + 0x2c]
cmp edx, ebp
jge 0x4389ff
mov dword [esp + 0x34], ecx
mov esi, dword [ecx]
mov dword [esp + 0x30], edx
mov ebp, dword [esp + 0x1c]
cmp eax, ebp
jl 0x438a1e
mov ebx, dword [esp + 0x3c]
cmp eax, ebx
ja 0x438a17
mov edx, dword [esp + 0x38]
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
add esp, 0x64
ret
call fcn.004233a0
ud2
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
cmp eax, ecx
ja 0x438a7c
mov ebp, ecx
sub ebp, eax
sub edx, eax
mov ecx, dword [esp + 0x40]
cmp edx, 0
je 0x438a3f
add ecx, eax
mov dword [esp + 0x4c], ecx
mov dword [esp], ecx
mov dword [esp + 0x50], ebp
mov dword [esp + 4], ebp
mov dword [esp + 0x54], edx
mov dword [esp + 8], edx
mov dword [esp + 0xc], esi
call fcn.00431690
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x24]
add ebx, eax
mov eax, ebx
mov ecx, dword [esp + 0x34]
add ecx, 4
mov edx, dword [esp + 0x30]
inc edx
jmp 0x4389e5
call fcn.004233a0
ud2
mov dword [ebx], eax
jmp 0x43893a
call fcn.00448770
jmp fcn.004388c0
Function at 0x43b0a0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43b28f
sub esp, 0x3c
mov edi, dword [esp + 0x40]
mov ecx, dword [edi + 4]
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0xe9
xchg ebp, eax
jne 0x43b0e7
mov ebp, dword [edi + 4]
add ebp, 5
mov dword [esp + 0xc], ebp
mov esi, ecx
inc esi
mov eax, dword [esi]
cdq
mov ebx, dword [esp + 0xc]
add ebx, eax
mov dword [edi + 4], ebx
add esp, 0x3c
ret
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0xeb
xchg ebp, eax
jne 0x43b112
mov ebp, dword [edi + 4]
add ebp, 2
mov dword [esp + 8], ebp
mov eax, ecx
inc eax
movzx eax, byte [eax]
movsx eax, al
cdq
mov ebx, dword [esp + 8]
add ebx, eax
mov dword [edi + 4], ebx
add esp, 0x3c
ret
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0xcc
xchg ebp, eax
jne 0x43b120
add esp, 0x3c
ret
movzx ebp, byte [ecx]
xor edx, edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], edx
movzx ebp, byte [ecx + 1]
xor edx, edx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], edx
movzx ebp, byte [ecx + 2]
xor edx, edx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], edx
movzx ebp, byte [ecx + 3]
xor edx, edx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x38], ecx
movzx ebp, byte [ecx + 4]
xor ecx, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ecx
call fcn.00425780
mov ebx, 0x484c5f
mov dword [esp], ebx
mov dword [esp + 4], 0xc
call fcn.00426190
mov ebx, dword [esp + 0x38]
mov dword [esp], ebx
call fcn.00426150
mov ebx, 0x483fa4
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.00426190
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.00426020
mov ebx, 0x483fa4
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.00426190
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
call fcn.00426020
mov ebx, 0x483fa4
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.00426190
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00426020
mov ebx, 0x483fa4
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.00426190
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.00426020
mov ebx, 0x483fa4
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.00426190
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.00426020
mov ebx, 0x483fb3
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.00426190
call fcn.00425800
mov ebx, 0x48828c
mov dword [esp], ebx
mov dword [esp + 4], 0x22
call fcn.00424fa0
add esp, 0x3c
ret
call fcn.00448770
jmp fcn.0043b0a0
Function at 0x43d060
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43d15a
sub esp, 0x3c
mov esi, dword [esp + 0x40]
xor edx, edx
xor ecx, ecx
mov dword [esi + 0x90], edx
mov dword [esi + 0x94], ecx
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
mov ebp, dword [ebx + 0x18]
mov eax, dword [ebp + 0x54]
mov dword [esi + 0x98], eax
mov dword [esp], 0x472640
call fcn.0040b910
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x44]
inc ecx
mov dword [eax], ecx
mov edx, 1
mov ecx, 1
mov ebx, 0x4c8ec0
mov dword [esp], ebx
add dword [esp], 0x54
mov dword [esp + 0x30], eax
mov dword [esp + 4], eax
mov dword [esp + 0x34], edx
mov dword [esp + 8], edx
mov dword [esp + 0x38], ecx
mov dword [esp + 0xc], ecx
call fcn.0043c7e0
mov edx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
mov ebx, dword [esp + 0x40]
mov esi, dword [ebx + 0x64]
mov ebp, dword [ebx + 0x68]
mov dword [eax], esi
mov dword [eax + 4], ebp
mov ebp, edx
xor edx, edx
mov dword [eax + 8], ebp
mov dword [eax + 0xc], edx
mov edx, 2
mov ecx, 2
mov byte [esp], 0xd
mov dword [esp + 4], 2
mov dword [esp + 0x24], eax
mov dword [esp + 8], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0xc], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x10], ecx
call fcn.0043bff0
add esp, 0x3c
ret
call fcn.00448770
jmp fcn.0043d060
Function at 0x43d580
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43d69e
sub esp, 0x48
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
cmp edi, 0
jne 0x43d5ab
cmp esi, 0
je 0x43d5c5
mov edx, dword [0x4c8ed8]
mov eax, dword [0x4c8edc]
cmp eax, edi
jl 0x43d5c5
jg 0x43d5c1
cmp edx, esi
jbe 0x43d5c5
xor esi, esi
xor edi, edi
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
mov ebp, dword [ebx + 0x18]
mov ecx, dword [ebp + 0x4c]
mov eax, dword [ecx + 0x90]
mov edx, dword [ecx + 0x94]
add eax, 1
adc edx, 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 0x90], eax
mov dword [ecx + 0x94], edx
mov ebp, dword [ecx + 0x18]
mov eax, dword [ebp + 0x54]
mov dword [ecx + 0x98], eax
xor ebp, ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
lea ebp, [esp + 0x24]
mov eax, dword [ecx + 0x64]
mov dword [esp + 0x1c], eax
mov edx, dword [ecx + 0x68]
mov eax, dword [esp + 0x1c]
mov dword [ebp], eax
mov dword [ebp + 4], edx
mov edx, dword [ecx + 0x90]
mov ecx, dword [ecx + 0x94]
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], ecx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], edi
mov eax, esi
mov edx, edi
shrd eax, edi, 6
shr edx, 6
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], edx
mov edx, 3
mov ecx, 3
mov byte [esp], 0x1d
mov dword [esp + 4], 0xffffffff
mov dword [esp + 0x3c], ebp
mov dword [esp + 8], ebp
mov dword [esp + 0x40], edx
mov dword [esp + 0xc], edx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x10], ecx
call fcn.0043bff0
add esp, 0x48
ret
call fcn.00448770
jmp fcn.0043d580
Function at 0x449e20
Capabilities:
Access peb ldr_data

Disassembly:
push eax
push ebx
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
lea eax, [esp + 0xc]
mov dword [ebx + 0x20], eax
mov eax, dword [eax - 4]
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x2c], 0
pop ebx
pop eax
ret

Function at 0x44a100
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x44a140
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x4d10e0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x44a342
je 0x44a32a
cmp ebx, 0x20
jbe 0x44a2ec
cmp ebx, 0x40
jbe 0x44a25b
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x4d10f0]
pxor xmm2, xmmword [0x4d1100]
pxor xmm3, xmmword [0x4d1110]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x44a1e1
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x4d10f0]
pxor xmm2, xmmword [0x4d1100]
pxor xmm3, xmmword [0x4d1110]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
pxor xmm1, xmmword [0x4d10f0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqu xmm1, xmmword [eax]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
test ebx, ebx
je 0x44a375
add eax, 0x10
test ax, 0xff0
je 0x44a361
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x48eb20]
jmp 0x44a32e
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x48ec20]
jmp 0x44a32e
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
Function at 0x44b230
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x24c
mov dword [esp], esp
mov dword [esp + 4], 0x24c
call fcn.0044acc0
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xe4
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xe4
call fcn.0044acc0
lea ebx, [esp + 0xe4]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xad0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x402209
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x40a6bc], 0
push esi
jne 0x402240
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40221a
mov dword [ecx*4 + 0x40a6b8], eax
inc ecx
cmp ecx, 0x100
jl 0x402215
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x402271
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x40a6b8]
xor eax, esi
inc ecx
dec edx
jne 0x402253
pop edi
not eax
pop esi
ret 0xc
Function at 0x403be7
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push 8
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x403c59
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x403c32
cmp dword [ebp + 0x10], ebx
jne 0x403c60
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00403be7
test eax, eax
jne 0x403c44
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x403c19
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x403c59
Function at 0x403de6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
test esi, esi
mov dword [ebp - 8], edi
jne 0x403e03
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, esi
test esi, esi
jne 0x403e12
mov ebx, 0x41a028
mov eax, dword [ebp + 8]
test eax, eax
jl 0x403e29
mov ecx, dword [0x422028]
push 0
add ecx, eax
push ecx
call fcn.00403fb0
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.00403f7e
test eax, eax
je 0x403f6c
test byte [ebp + 0x17], 0x80
je 0x403f09
push 0x40c468
call fcn.00401000
and dword [ebp + 0x14], 0x7fffffff
jle 0x403f74
mov edi, 0x416028
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x403e6f
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00403f7e
test eax, eax
je 0x403f6c
sub dword [ebp + 0x14], esi
mov dword [0x40c468], edi
mov dword [0x40c46c], esi
mov eax, dword [ebp - 8]
push 0x40c468
mov dword [0x40c470], ebx
mov dword [0x40c474], eax
call fcn.00401031
xor ecx, ecx
mov dword [ebp - 0xc], eax
cmp eax, ecx
jl 0x403f01
mov eax, dword [0x40c470]
mov esi, eax
sub esi, ebx
je 0x403ef6
cmp dword [ebp + 0x10], ecx
jne 0x403edc
lea eax, [ebp + 8]
push ecx
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403f05
cmp dword [ebp + 8], esi
jne 0x403f05
add dword [ebp - 4], esi
jmp 0x403eee
sub dword [ebp - 8], esi
add dword [ebp - 4], esi
cmp dword [ebp - 8], 1
mov ebx, eax
jl 0x403f74
cmp dword [ebp - 0xc], 1
jne 0x403e8d
jmp 0x403f74
cmp dword [ebp + 0x14], ecx
jg 0x403e62
jmp 0x403f74
push 0xfffffffffffffffc
jmp 0x403f6e
push 0xfffffffffffffffe
jmp 0x403f6e
test esi, esi
jne 0x403f55
cmp dword [ebp + 0x14], esi
jle 0x403f74
mov edi, 0x416028
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403f22
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00403f7e
test eax, eax
je 0x403f6c
lea eax, [ebp + 0x10]
push 0
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403f05
cmp esi, dword [ebp + 0x10]
jne 0x403f05
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x403f17
jmp 0x403f74
cmp dword [ebp + 0x14], edi
mov esi, dword [ebp + 0x14]
jl 0x403f5f
mov esi, edi
push esi
push dword [ebp + 0x10]
call fcn.00403f7e
test eax, eax
jne 0x403f71
push 0xfffffffffffffffd
pop eax
jmp 0x403f77
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40653a
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
xor esi, esi
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
stosd dword es:[edi], eax
pop ecx
xor eax, eax
push dword [ebp + 0xc]
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406572
test al, 0x10
jne 0x406575
mov dword [ebp + 0xc], esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4065a4
cmp dword [ebp - 0xc], esi
je 0x4065a1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
leave
ret 8

Function at 0x4065db
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.004066e2
test eax, eax
je 0x40662a
cmp dword [ebp + 0xc], 0
push esi
je 0x406624
and dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 3
call sub.KERNEL32.dll_lstrlenA
and byte [eax + esi + 1], 0
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], esi
push eax
mov word [ebp - 0x10], 0x414
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
jmp 0x40662a
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
push 0xffffffffffffffef
call fcn.00405f97
pop esi
leave
ret 8
Function at 0x406800
Capabilities:
Get common file path
Get file size

Disassembly:
sub esp, 0xc
and dword [esp], 0
push ebx
push ebp
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov edi, dword [esp + 0x24]
test esi, esi
je 0x406850
push str.MoveFileExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40683e
push 5
push edi
push dword [esp + 0x28]
call eax
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esp + 0x10], 0
jne 0x4069eb
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov esi, 0x400
test edi, edi
mov ebp, 0x424f58
je 0x40687c
push 1
push 0
push edi
call fcn.004067e4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebp
push edi
call ebx
jmp 0x406886
mov dword [0x424f58], 0x4c554e
push esi
mov esi, 0x424b58
push esi
push dword [esp + 0x28]
call ebx
push esi
push ebp
push str._s_s_r_n
push 0x424758
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov dword [esp + 0x20], ebx
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
push eax
push 0x8000080
push 4
push eax
push eax
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x14], edi
je 0x4069eb
xor esi, esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
push esi
lea eax, [ebx + ebp + 0xa]
push eax
push esi
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [esp + 0x18], eax
je 0x4069d3
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, esi
je 0x4069c9
push str._Rename__r_n
push ebx
call fcn.0040676c
cmp eax, esi
jne 0x40694e
lea eax, [ebx + ebp]
push str._Rename__r_n
push eax
call sub.KERNEL32.dll_lstrcpyA
add ebp, 0xa
jmp 0x4069a3
add eax, 0xa
push 0x409344
push eax
call fcn.0040676c
mov esi, eax
test esi, esi
je 0x4069a1
mov edi, ebx
sub edi, esi
add edi, ebp
push edi
call fcn.004065cc
push edi
push esi
push eax
mov dword [esp + 0x30], eax
call fcn.004067c0
push edi
mov eax, dword [esp + 0x24]
push dword [esp + 0x28]
add eax, esi
push eax
call fcn.004067c0
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
sub esi, ebx
mov edi, dword [esp + 0x14]
mov eax, esi
xor esi, esi
jmp 0x4069a5
xor esi, esi
mov eax, ebp
push dword [esp + 0x20]
add eax, ebx
push 0x424758
push eax
call fcn.004067c0
push ebx
add ebp, dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esp + 0x10], 1
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8