joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a7008]
jne 0x401010
repz ret
jmp fcn.00401798

Function at 0x4082ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404f7f
and dword [ebp - 4], 0
cmp dword [0x4a9774], 0
mov ebx, eax
jne 0x40835c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40840d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40840d
push eax
call fcn.00404f0d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4a9774], eax
call esi
push eax
call fcn.00404f0d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a9778], eax
call esi
push eax
call fcn.00404f0d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4a977c], eax
call esi
push eax
call fcn.00404f0d
pop ecx
mov dword [0x4a9784], eax
test eax, eax
je 0x40835c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404f0d
pop ecx
mov dword [0x4a9780], eax
mov eax, dword [0x4a9780]
cmp eax, ebx
je 0x4083b4
cmp dword [0x4a9784], ebx
je 0x4083b4
push eax
call fcn.00404f88
push dword [0x4a9784]
mov esi, eax
call fcn.00404f88
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4083b4
test edi, edi
je 0x4083b4
call esi
test eax, eax
je 0x4083ab
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4083ab
test byte [ebp - 0xc], 1
jne 0x4083b4
or dword [ebp + 0x10], 0x200000
jmp 0x4083ed
mov eax, dword [0x4a9778]
cmp eax, ebx
je 0x4083ed
push eax
call fcn.00404f88
pop ecx
test eax, eax
je 0x4083ed
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4083ed
mov eax, dword [0x4a977c]
cmp eax, ebx
je 0x4083ed
push eax
call fcn.00404f88
pop ecx
test eax, eax
je 0x4083ed
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a9774]
call fcn.00404f88
pop ecx
test eax, eax
je 0x40840d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40840f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b790
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x27918b4], 0x930
jne 0x40b7ad
push str.zukatatuxaweporijoj
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
cmp dword [0x27918b4], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x27915d0], eax
jne 0x40b7d3
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea ecx, [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov esp, ebp
pop ebp
ret
Function at 0x407760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407778
mov eax, 1
add ebx, ebx
jne 0x40779b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407790
jne 0x4077ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407790
xor ecx, ecx
sub eax, 3
jb 0x4077c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x407832
mov ebp, eax
add ebx, ebx
jne 0x4077cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4077d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4077fc
inc ecx
add ebx, ebx
jne 0x4077e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4077dd
jne 0x4077f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4077dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40781c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40780d
jmp 0x40777e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40781c
add edi, ecx
jmp 0x40777e
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40783a
cmp byte [edi], 0
jne 0x40783a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40783f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4078ae
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x71c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7228]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40786c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7230]
or eax, eax
je 0x4078a8
mov dword [ebx], eax
add ebx, 4
jmp 0x407889
call dword [esi + 0x722c]
mov ebp, dword [esi + 0x7234]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4078e2
sub esp, 0xffffff80
jmp 0x401020
Function at 0x10008ff3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10009032
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10009032
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10009032
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10009032
cmp dword [ecx + 0x74], 0xe
jbe 0x10009032
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000bcaf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000bd4c
push ebx
push esi
call fcn.1000bc78
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000bc0c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000bcf9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000bd4b
push edi
push eax
call fcn.1000cc6b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000bd19
call fcn.1000a754
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000bd4a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000bc0c
add esp, 0x20
test eax, eax
jne 0x1000bd38
push edi
call fcn.1000a754
jmp 0x1000bd40
push ebx
call fcn.1000a754
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000bfb9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10013678
push 0x10013670
push str.FlsAlloc
push 0x1f
call fcn.1000bed5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000bfed
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001214c]
call esi
jmp 0x1000bff3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000c038
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10013688
push 0x10013680
push str.FlsGetValue
push 0x21
call fcn.1000bed5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000c06f
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001214c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000c077
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10013690
push 0x10013688
push str.FlsSetValue
push 0x22
call fcn.1000bed5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000c0b1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001214c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10011730
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001175d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001175d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0xf66240
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf6624a
pushal
call 0xf66250
pop ebp
sub ebp, 0x10
sub ebp, 0xb66240
jmp 0xf66266
mov eax, 0xb66240
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a7
mov edx, 0xa68bce43
xor byte [eax], dl
inc eax
dec ecx
jne 0xf6627d
jmp 0xf66290
enter 0xffffffffffffc88e, 0xffffffffffffffca
jg 0xf662d9
inc ebx
inc ebx
ret 0xbb82
mov byte [ecx], cl
pop ss
stosd dword es:[edi], eax
inc esi
inc ebx
inc ebx
inc ebx
stosb byte es:[edi], al
imul eax, dword [ebx + 0x43], 0x43
inc ebx
push ss
enter 0xffffffffffffc8af, 0xffffffffffffffc6
dec ebx
inc ebx
inc ebx
inc ebx
enter 0x4fd6, 0x43
inc ebx
inc ebx
enter 0x53ce, 0x43
inc ebx
inc ebx
sub byte [edx - 0x3fbe8dbf], 0x81
inc edi
or cl, byte [esi + eax*8 - 0x49]
mov esp, 0x811ebcbc
dec edi
inc ebx
enter 0x67cf, 0x47
inc ebx
inc ebx
inc ebx
sub esp, dword [edi - 0x22]
bound eax, qword [ebx + 0x2b]
pop edi
xchg bh, dl
inc ebx
inc edx
outsd dx, dword [esi]
into
daa
mov edi, 0xab674fca
inc esi
inc ebx
inc ebx
inc ebx
stosb byte es:[edi], al
jp 0xf66366
inc ebx
inc ebx
into
daa
mov edi, 0x17676fca
push ds
mov esp, 0x36bc4f36
dec ebx
stosd dword es:[edi], eax
and eax, 0xc8434343
dec byte [ebx + 0x43]
inc ebx
inc ebx
jo 0xf662cd
jo 0xf662d6
shr byte [ebx - 0x38b3f4ba], 0xd
inc ebx
inc ebx
inc ebx
dec esp
retf
invalid
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x49d2b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.___1
lea edi, [esi - 0x63000]
push edi
or ebp, 0xffffffff
jmp 0x49d2d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x49d2d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49d2c8
mov eax, 1
add ebx, ebx
jne 0x49d2eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x49d2fc
jne 0x49d31b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49d31b
dec eax
add ebx, ebx
jne 0x49d308
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x49d2e0
add ebx, ebx
jne 0x49d317
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x49d36d
xor ecx, ecx
sub eax, 3
jb 0x49d333
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49d3a2
sar eax, 1
mov ebp, eax
jmp 0x49d33e
add ebx, ebx
jne 0x49d33e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49d30c
inc ecx
add ebx, ebx
jne 0x49d34c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49d30c
add ebx, ebx
jne 0x49d359
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x49d34e
jne 0x49d36a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49d34e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x49d38c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x49d37e
jmp 0x49d2ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x49d38c
add edi, ecx
jmp 0x49d2ce
pop esi
mov edi, esi
mov ecx, 0x18a2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49d3aa
cmp byte [edi], 0x20
jne 0x49d3aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x49d3af
lea edi, [esi + 0x99000]
mov eax, dword [edi]
or eax, eax
je 0x49d427
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9e740]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9e894]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x49d3dc
mov ecx, edi
jns 0x49d40b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9e898]
or eax, eax
je 0x49d421
mov dword [ebx], eax
add ebx, 4
jmp 0x49d3f9
call dword [esi + 0x9e8a8]
mov ebp, dword [esi + 0x9e89c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x49d45b
sub esp, 0xffffff80
jmp 0x451d43
Function at 0x40141e
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x214
lea eax, [esp]
push ebp
push esi
mov esi, dword [esp + 0x228]
push edi
mov edi, dword [esp + 0x22c]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or eax, 9
push eax
push dword [esp + 0x230]
push dword [esp + 0x230]
call fcn.00406322
test eax, eax
jne 0x401527
xor ebp, ebp
test byte [esp + 0x22c], 2
je 0x401493
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebp
push eax
lea eax, [esp + 0x28]
push eax
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x401503
push 0x105
lea eax, [esp + 0x18]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x4014ce
test edi, edi
jne 0x401503
push dword [esp + 0x22c]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call fcn.0040141e
test eax, eax
jne 0x4014d8
push 0x105
lea eax, [esp + 0x18]
push eax
push edi
push dword [esp + 0x18]
call ebp
test eax, eax
je 0x4014a6
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406930
test eax, eax
jne 0x401514
push dword [esp + 0x228]
push dword [esp + 0x228]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x401527
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x401527
push 0
push esi
push dword [esp + 0x230]
push dword [esp + 0x230]
call eax
pop edi
pop esi
pop ebp
add esp, 0x214
ret 0xc
Function at 0x40316c
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x9c
mov ecx, dword [esp + 0xa0]
mov eax, 0x4189e8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xb8]
mov ebx, 0x8000
test edi, edi
cmovne ebx, dword [esp + 0xbc]
xor esi, esi
test edi, edi
cmovne eax, edi
mov dword [esp + 0x1c], eax
test ecx, ecx
js 0x4031b4
mov eax, dword [0x429578]
add eax, ecx
push eax
call fcn.00403155
push 4
lea eax, [esp + 0x14]
push eax
push dword [0x40a010]
call fcn.00406992
test eax, eax
je 0x403378
mov eax, dword [esp + 0x10]
test eax, eax
jns 0x40331a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40c960
mov dword [esp + 0x14], eax
call fcn.00407cbe
mov eax, dword [esp + 0x10]
and eax, 0x7fffffff
mov ecx, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], ecx
jbe 0x403312
mov ebp, 0x4000
cmp ecx, ebp
cmovl ebp, ecx
push ebp
push 0x4149e8
call fcn.0040313f
test eax, eax
je 0x403378
sub dword [esp + 0x10], ebp
mov dword [0x40c97c], ebp
mov ebp, dword [esp + 0x1c]
mov dword [0x40c978], 0x4149e8
mov ecx, 0x40c960
mov dword [0x40c980], ebp
mov dword [0x40c984], ebx
call fcn.00406ef2
mov dword [esp + 0x28], eax
test eax, eax
js 0x403316
mov eax, dword [0x40c980]
sub eax, ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x429614], 1
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
je 0x4032cb
sub eax, dword [esp + 0x14]
cmp eax, 0xc8
ja 0x40328f
test ecx, ecx
jne 0x4032cb
mov eax, dword [esp + 0x20]
push eax
push 0x64
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [esp + 0x30]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
push 0
call fcn.00405d93
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40330a
test edi, edi
jne 0x4032ef
push eax
push ebp
push dword [esp + 0xbc]
call fcn.00406a55
test eax, eax
je 0x40335d
mov eax, dword [esp + 0x18]
jmp 0x4032fb
mov ebp, dword [0x40c980]
sub ebx, eax
mov dword [esp + 0x1c], ebp
add esi, eax
cmp dword [esp + 0x28], 1
jne 0x40323c
jmp 0x403312
test ecx, ecx
jg 0x403207
mov eax, esi
jmp 0x40337b
push 0xfffffffffffffffc
jmp 0x40337a
test edi, edi
jne 0x403361
test eax, eax
jle 0x403312
mov ebp, 0x4149e8
cmp eax, ebx
mov edi, ebx
cmovl edi, eax
push edi
push ebp
call fcn.0040313f
test eax, eax
je 0x403378
push edi
push ebp
push dword [esp + 0xbc]
call fcn.00406a55
test eax, eax
je 0x40335d
mov eax, dword [esp + 0x10]
add esi, edi
sub eax, edi
mov dword [esp + 0x10], eax
test eax, eax
jg 0x403327
jmp 0x403312
push 0xfffffffffffffffe
jmp 0x40337a
mov esi, dword [esp + 0xbc]
cmp eax, esi
cmovl esi, eax
push esi
push edi
call fcn.0040313f
test eax, eax
jne 0x403312
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret 0x10
Function at 0x403388
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0
je 0x4033a7
mov eax, dword [0x40c958]
test eax, eax
je 0x40339f
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40c958], 0
ret
cmp dword [0x40c958], 0
je 0x4033b8
push 0
call fcn.00406259
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x429520]
jbe 0x4033eb
push 0
push 0x40364e
push 0
push 0x6f
push dword [0x428514]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x40c958], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x405e77
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x405e91
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4
Function at 0x4061e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
lea eax, [ebp - 0x23c]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
ja 0x406222
test eax, eax
je 0x406222
add eax, eax
cmp word [ebp + eax - 0x23e], 0x5c
je 0x406224
mov ecx, 0x4082a8
jmp 0x406229
xor eax, eax
mov ecx, 0x4082aa
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x23c]
add eax, ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406287
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4062aa
push dword [esp + 8]
push dword [esp + 8]
call fcn.00406350
pop ecx
pop ecx
inc dword [0x4295f0]
ret 8

Function at 0x406350
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, 0x400
mov dword [0x426670], 0x55004e
mov ebp, 0x426670
mov dword [0x426674], 0x4c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
je 0x4063a6
push 1
push 0
push esi
call fcn.00406965
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x406486
cmp eax, ebx
jg 0x406486
push ebx
mov esi, 0x425e70
push esi
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x406486
cmp eax, ebx
jg 0x406486
push esi
push ebp
push str._ls_ls_r_n
push 0x425a70
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x429530]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.00405ef2
push 4
push 0xc0000000
push esi
call fcn.00406965
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406486
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebp + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x40647f
push esi
push edi
push ebx
call fcn.00406992
test eax, eax
je 0x40647f
push str._Rename__r_n
push edi
call fcn.00406b80
test eax, eax
jne 0x40648b
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x425a70
lea eax, [ecx + edi]
push eax
call fcn.004066fe
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.00406a55
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x408974
add eax, 0xa
push eax
call fcn.00406b80
mov ecx, eax
test ecx, ecx
je 0x406450
lea edx, [edi + esi]
jmp 0x4064aa
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x4064a4
sub ecx, edi
inc ecx
jmp 0x406452
Function at 0x4065cf
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00406be7
mov edi, eax
cmp edi, 0xffffffff
je 0x406612
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x4065f3
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4065f9
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x406602
xor eax, eax
inc eax
jmp 0x406614
test byte [ebp + 0xc], 4
jne 0x406612
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x406682
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x425270
push ebx
call fcn.00406b64
push ebx
call fcn.00406c0f
mov esi, eax
test esi, esi
je 0x4066f7
push esi
call fcn.00406d87
test byte [0x42952c], 0x80
je 0x4066bb
movzx eax, word [esi]
test ax, ax
je 0x4066f7
cmp eax, 0x5c
je 0x4066f7
sub esi, ebx
sar esi, 1
jmp 0x4066d5
call fcn.00406619
test eax, eax
je 0x4066cf
test byte [eax], 0x10
je 0x4066f7
push ebx
call fcn.00406d5a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
cmp eax, esi
jg 0x4066c1
call fcn.004065a0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4066f7
xor eax, eax
inc eax
jmp 0x4066f9
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x406720
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x424a28], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x424a28
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40675f
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4