joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402b98
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41a014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402c30
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402c10
xor eax, eax
push ebp
push 0x402c09
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402c4c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402c10
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x41a014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41a014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403464
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41b034], 0
je 0x4034c5
cmp word [0x41b208], 0xd7b2
jne 0x40348d
cmp dword [0x41b210], 0
jbe 0x40348d
mov eax, 0x41b204
call dword [0x41b220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41a05c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4034ec
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41a020], 0
jne 0x4034e1
push 0
push 0x41a054
push 0x41a05c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404390
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4043f6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403830
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402a2c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4043e0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4043fd
lea eax, [ebp - 0x10]
call fcn.004035e8
ret

Function at 0x4058bc
Capabilities:
Accept command line arguments

Disassembly:
push edi
mov edi, edx
test eax, eax
jne 0x4058ea
sub esp, 0x104
mov ecx, esp
push 0x104
push ecx
push 0
call sub.kernel32.dll_GetModuleFileNameA
xchg ecx, eax
mov edx, esp
mov eax, edi
call fcn.004036d8
add esp, 0x104
pop edi
ret
push eax
call sub.kernel32.dll_GetCommandLineA_1
pop ecx
inc ecx
call fcn.0040d698
mov edx, eax
call fcn.0040d6a8
loop 0x4058f2
mov ecx, eax
sub ecx, edx
cmp ecx, 2
jl 0x405916
cmp byte [edx], 0x22
jne 0x405916
cmp byte [eax - 1], 0x22
jne 0x405916
inc edx
dec eax
sub eax, edx
xchg ecx, eax
xchg edi, eax
call fcn.004036d8
pop edi
ret
Function at 0x405934
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x405a88
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004035e8
lea eax, [ebp - 4]
mov edx, esi
call fcn.00403680
jmp 0x405a23
lea ecx, [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x405aa0
call fcn.0040d5c8
cmp dword [ebx], 0
je 0x4059a2
mov eax, ebx
mov edx, 0x405aa0
call fcn.00403850
cmp dword [ebx], 0
jne 0x4059c9
mov eax, dword [ebp - 8]
call fcn.00403848
cmp eax, 2
jne 0x4059c9
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0x3a
jne 0x4059c9
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040363c
jmp 0x405a23
push 0x200
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov edx, dword [ebx]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 8]
call fcn.00403894
mov eax, dword [ebp - 0x16c]
call fcn.00403a48
push eax
call sub.shell32.dll_SHGetFileInfoA
cmp byte [ebp - 0x15c], 0
je 0x405a19
lea eax, [ebp - 8]
lea edx, [ebp - 0x15c]
mov ecx, 0x104
call fcn.00403830
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00403850
cmp dword [ebp - 4], 0
jne 0x405981
lea edx, [ebp - 0x170]
mov eax, dword [ebx]
call fcn.0040d7c4
cmp dword [ebp - 0x170], 0
jne 0x405a5d
lea edx, [ebp - 0x174]
mov eax, esi
call fcn.0040d7c4
mov edx, dword [ebp - 0x174]
mov eax, ebx
call fcn.00403850
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a8f
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.0040360c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040360c
ret

Function at 0x405d34
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff44
mov edi, edx
mov esi, eax
xor ebx, ebx
mov dword [esp + 0x20], 0x94
lea eax, [esp + 0x20]
push eax
call sub.kernel32.dll_GetVersionExA
xor eax, eax
mov edx, dword [esp + 0x30]
cmp edx, 2
jne 0x405d6a
cmp dword [esp + 0x24], 4
setae al
jmp 0x405d98
cmp edx, 1
jne 0x405d98
mov edx, dword [esp + 0x24]
cmp edx, 4
seta al
test al, al
jne 0x405d98
cmp edx, 4
jne 0x405d98
cmp dword [esp + 0x28], 0
seta al
test al, al
jne 0x405d98
cmp word [esp + 0x2c], 0x1111
setae al
test al, al
je 0x405db5
push 0x405e24
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x405e30
push ebx
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x405dd0
push edi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, esi
call fcn.00403a48
push eax
call ebx
jmp 0x405e18
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, esi
call fcn.00403a48
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
lea ecx, [esp + 0xb4]
mov eax, dword [esp]
imul dword [esp + 4]
xor edx, edx
call fcn.004053f0
lea eax, [esp + 0xb4]
mov ecx, edi
mov edx, dword [esp + 8]
call fcn.0040a7b8
add esp, 0xbc
pop edi
pop esi
pop ebx
ret
Function at 0x406270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
mov dword [esp + 8], 4
xor eax, eax
mov dword [esp], eax
test ebx, ebx
je 0x4062b4
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
mov eax, esi
call fcn.00403a48
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4062b4
cmp dword [esp + 4], 4
je 0x4062b9
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x4062c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.00403a48
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete al
pop ebp
ret

Function at 0x406300
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.004035e8
cmp dword [ebp - 0xc], 0
je 0x4063a6
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
push ebp
call fcn.004062c4
pop ecx
test al, al
je 0x4063a6
cmp dword [ebp - 4], 1
je 0x406343
cmp dword [ebp - 4], 2
jne 0x4063a6
mov eax, dword [ebp - 8]
call fcn.00402830
mov dword [ebp - 0x14], eax
push ebp
call fcn.004062c4
pop ecx
test al, al
je 0x40639e
cmp dword [ebp - 4], 2
jne 0x406394
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov edi, eax
mov eax, edi
call fcn.00402830
mov esi, eax
push edi
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, ebx
mov edx, esi
call fcn.004037c4
mov eax, esi
call fcn.00402860
jmp 0x40639e
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.004037c4
mov eax, dword [ebp - 0x14]
call fcn.00402860
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406434
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x406461
lea eax, [esp + 4]
push eax
push 0
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403a48
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x406465
xor eax, eax
jmp 0x406467
mov al, 1
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x4064a4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406563
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.0040c2c4
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push edi
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x40654d
cmp dword [ebp - 8], 0
jbe 0x40654b
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00402830
mov ebx, eax
xor esi, esi
jmp 0x406529
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004037c4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040c2b4
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
inc esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push edi
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0x103
jne 0x40650c
mov eax, ebx
call fcn.00402860
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40656a
lea eax, [ebp - 0x10]
call fcn.004035e8
ret

Function at 0x406dd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
cmp byte [ebx + 0x18], 0
jne 0x406e4c
mov byte [ebp - 0x1004], 0
mov eax, dword [ebx + 0x19]
call fcn.00403a48
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov eax, esi
call fcn.00403a48
push eax
mov eax, dword [ebp - 4]
call fcn.00403a48
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403a48
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
test eax, eax
je 0x406e43
mov eax, edi
lea edx, [ebp - 0x1004]
mov ecx, 0x1000
call fcn.00403830
jmp 0x406e7d
mov eax, edi
call fcn.004035e8
jmp 0x406e7d
mov eax, edi
mov edx, esi
call fcn.0040363c
mov eax, dword [ebx + 0x19]
call fcn.00403a48
push eax
mov eax, esi
call fcn.00403a48
push eax
mov eax, dword [ebp - 4]
call fcn.00403a48
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403a48
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a8b8
Capabilities:
Get file attributes

Disassembly:
push ebx
push eax
push 0x8001
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x40a8d3
dec eax
and al, 0x10
setne al
xchg ebx, eax
push eax
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
pop ebx
ret

Function at 0x40b6fc
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x27], 0xef
test dl, dl
je 0x40b708
or byte [eax + 0x27], 0x10
mov ecx, dword [eax + 0x1c]
jecxz 0x40b721
push eax
je 0x40b722
call dword [0x41a148]
pop eax
push 5
push dword [eax + 0x1c]
call sub.user32.dll_ShowWindow
ret
and byte [eax + 0x37], 0xfe
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x41a148]
ret
Function at 0x40ca0c
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.0040c9a8
je 0x40ca3e
mov eax, ebx
push edx
call fcn.00409330
pop edx
cmp eax, edx
je 0x40ca3e
test edx, edx
mov eax, ebx
jne 0x40ca30
pop ebx
inc edx
jmp fcn.00409320
mov byte [ebx + 0x49], dl
xor edx, edx
call fcn.00409320
xchg ebx, eax
cmp eax, 0
pop ebx
jne fcn.0040ca5c
ret
Function at 0x40d750
Capabilities:
Get file attributes

Disassembly:
call fcn.00404f60
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x40d764
dec eax
and al, 0x10
sete al
ret

Function at 0x40d7e0
Capabilities:
Get common file path

Disassembly:
push ebx
xchg ebx, eax
sub esp, 0x104
mov eax, esp
push 0x104
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
mov edx, esp
call fcn.004037c4
mov edx, ebx
mov eax, dword [edx]
call fcn.00405b90
add esp, 0x104
pop ebx
ret

Function at 0x40d810
Capabilities:
Get common file path

Disassembly:
push ebx
xchg ebx, eax
sub esp, 0x104
mov eax, esp
push 0x104
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esp
call fcn.004037c4
mov edx, ebx
mov eax, dword [edx]
call fcn.00405b90
add esp, 0x104
pop ebx
ret

Function at 0x40d840
Capabilities:
Get common file path

Disassembly:
push eax
sub esp, 0x108
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov edx, esp
mov eax, dword [esp + 0x108]
call fcn.004037c4
add esp, 0x108
pop edx
mov eax, dword [edx]
call fcn.00405b90
ret

Function at 0x40e2d0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40e304
xor eax, eax
jmp 0x40e355
lea eax, [ebp - 0xc]
push eax
mov ax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x40e338
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x40e338
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
mov ax, word [ebp + 8]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40f5f0
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edx, dword [0x41a550]
mov edx, dword [edx]
mov eax, dword [esp]
mov eax, dword [eax + 0x18]
call fcn.0040b6b4
mov ebp, 0xff
mov eax, 0x1a
call fcn.00416c3c
mov esi, eax
dec esi
test esi, esi
jl 0x40f662
inc esi
xor ebx, ebx
mov edi, ebx
shl edi, 2
mov eax, dword [0x41a4e8]
mov eax, dword [eax]
mov edx, dword [eax + edi*4]
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
call fcn.0040dd84
mov eax, dword [0x41a4e8]
mov eax, dword [eax]
mov eax, dword [eax + edi*4 + 4]
call fcn.0040d548
push eax
call sub.kernel32.dll_GetUserDefaultLangID
movzx eax, ax
pop edx
cmp edx, eax
jne 0x40f65e
mov ebp, ebx
inc ebx
dec esi
jne 0x40f624
cmp ebp, 0xff
jne 0x40f6a2
mov eax, 0x1a
call fcn.00416c3c
mov esi, eax
dec esi
test esi, esi
jl 0x40f6a2
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 2
mov edx, dword [0x41a4e8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
mov edx, 0x40f6c8
call fcn.00403994
jne 0x40f69e
mov ebp, ebx
jmp 0x40f6a2
inc ebx
dec esi
jne 0x40f67e
cmp ebp, 0xff
jne 0x40f6ac
xor ebp, ebp
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
mov edx, ebp
call fcn.0040c18c
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41186c
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, edx
mov dword [esp], pe_nt_image_headers32
test al, al
je 0x41188d
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
jmp 0x411898
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00403830
add esp, 0x104
pop ebx
ret

Function at 0x4118b0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc10
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [esp]
push eax
call sub.ole32.dll_CoTaskMemFree
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x3e9
call fcn.00403830
add esp, 0x3f0
pop ebx
ret
Function at 0x413178
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x413357
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x41a4fc]
mov eax, dword [eax]
mov edx, dword [eax + 0xe4]
mov eax, dword [0x41b9f4]
mov eax, dword [eax + 0x5c]
call fcn.0040b6b4
mov eax, dword [0x41a53c]
mov eax, dword [eax]
call fcn.0040bbac
mov eax, 0x28
call fcn.00416c3c
mov edi, eax
dec edi
test edi, edi
jl 0x41333c
inc edi
xor ebx, ebx
mov esi, ebx
add esi, esi
lea esi, [esi + esi*2]
mov eax, dword [0x41a4f8]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x10]
call fcn.0040d548
xor edx, edx
mov dl, byte [ebp - 1]
cmp eax, edx
jne 0x413334
mov eax, dword [0x41a4f8]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 4]
lea ecx, [ebp - 0xc]
xor edx, edx
call fcn.00411e24
mov eax, dword [0x41a4f8]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 8]
lea ecx, [ebp - 0x10]
xor edx, edx
call fcn.00411e24
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00405bb8
mov eax, dword [0x41a4f8]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0xc]
call fcn.0040d548
mov dword [ebp - 8], eax
mov eax, dword [0x41a4f8]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x14]
call fcn.0040d548
dec eax
jne 0x4132ef
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402a0c
mov dword [ebp - 0x50], 0x3c
mov eax, dword [0x41a53c]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, 0x413368
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xc]
call fcn.00403a48
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
call fcn.00403a48
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x10]
call fcn.00403a48
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], 0x240
lea eax, [ebp - 0x50]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x413323
jmp 0x4132d2
mov eax, dword [0x41a53c]
mov eax, dword [eax]
call fcn.0040bbac
push 0x32
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4132c6
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x413323
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00403a48
push eax
mov eax, dword [ebp - 0x10]
call fcn.00403a48
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403a48
push eax
push 0x413368
mov eax, dword [0x41a53c]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.shell32.dll_ShellExecuteA
push 0
push 0x2800
mov eax, dword [0x41b9f4]
call fcn.00411fec
inc ebx
dec edi
jne 0x4131db
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41335e
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040360c
ret
Function at 0x413838
Capabilities:
Delete file

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
cmp dword [0x41ba14], 0
jle 0x413857
mov eax, dword [0x41ba20]
call fcn.00403a48
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, ebx
call fcn.0040a968
mov dword [esp], eax
mov eax, dword [esp]
mov edx, 0x41390c
call fcn.004068d0
mov eax, 0x75
call fcn.00416c3c
cmp eax, dword [0x41ba14]
jne 0x413895
mov eax, 0x76
call fcn.00416c3c
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
jmp 0x4138a8
mov eax, 0x5f
call fcn.00416c3c
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
cmp dword [0x41ba1c], 1
jne 0x4138d7
mov eax, 0x5f
call fcn.00416c3c
mov edx, eax
imul edx, dword [0x41ba14]
mov eax, dword [0x41a528]
add edx, dword [eax]
mov eax, dword [0x41ba18]
xor ecx, ecx
call fcn.004069b8
push dword [esp + 0xc]
push dword [esp + 0xc]
mov eax, dword [esp + 8]
call fcn.00413634
mov eax, dword [esp]
call fcn.0040a058
mov eax, 0x41ba20
mov edx, ebx
call fcn.0040363c
add esp, 0x10
pop ebx
ret
Function at 0x413b74
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov esi, edx
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x413d32
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1d], 1
lea eax, [esi + esi*2]
mov edx, dword [0x41a558]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x24]
xor edx, edx
call fcn.00411e24
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0040363c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00403a48
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x413cc9
test bl, 0x10
jne 0x413cc9
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00403a48
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push edi
call sub.kernel32.dll_GetFileTime
push edi
call sub.kernel32.dll_CloseHandle
lea eax, [esi + esi*2]
mov edx, dword [0x41a558]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 4]
call fcn.0040d548
cmp eax, 4
ja case.default.0x413c3b
jmp dword [eax*4 + 0x413c42]
push ebp
call fcn.00413974
pop ecx
jmp case.default.0x413c3b
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
call fcn.00405b48
dec eax
jne 0x413c76
push ebp
call fcn.00413974
pop ecx
jmp case.default.0x413c3b
mov byte [ebp - 0x1d], 0
jmp case.default.0x413c3b
mov byte [ebp - 0x1d], 1
jmp case.default.0x413c3b
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
call fcn.00405b48
dec eax
sete byte [ebp - 0x1d]
jmp case.default.0x413c3b
mov byte [ebp - 0x1d], 0
cmp byte [ebp - 0x1d], 0
je 0x413cde
test bl, 1
je 0x413cb7
and ebx, 0xfffffffe
push ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00403a48
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00403a48
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x413cde
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00405bb8
mov eax, dword [ebp - 0x28]
call fcn.00405c10
cmp byte [ebp - 0x1d], 0
jne 0x413cee
mov eax, dword [ebp - 0xc]
call fcn.004035e8
jmp 0x413d14
lea eax, [esi + esi*2]
mov edx, dword [0x41a558]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 8]
call fcn.0040d548
dec eax
jne 0x413d14
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov eax, dword [0x41ba24]
call fcn.0040c2b4
mov bl, byte [ebp - 0x1d]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413d39
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.0040360c
ret