joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4149e3
Capabilities:
Create directory
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.00443c10
mov ecx, dword [ebp + 0x18]
lea edx, [ebp - 0x20c]
add esp, 0xc
call fcn.00420d25
test eax, eax
je 0x414b28
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], ebx
push eax
push 0x4781e8
push 1
push ebx
push 0x478358
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x414b2b
mov eax, dword [ebp + 0x18]
lea edx, [ebp - 4]
push edx
push 0x4782a8
push eax
mov ecx, dword [eax]
call dword [ecx]
mov esi, eax
test esi, esi
js 0x414b1d
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp + 0x18]
push dword [ebp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp + 0x18]
cmp dword [ebp + 0x20], ebx
push ebx
cmovne esi, dword [ebp + 0x20]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x44]
mov esi, eax
test esi, esi
js 0x414b14
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [ebp + 0x14], ebx
je 0x414aae
push dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
push eax
call esi
push edi
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call esi
lea edi, [ebp - 0x20c]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x414ad2
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x20c]
mov esi, 0x482a7c
push 1
push edx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, dword [eax]
call dword [ecx + 0x18]
push ebx
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
push 0x3001
push 0x2000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop edi
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x414b2b
mov esi, dword [ebp + 0x20]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x414ed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x107]
push 0x103
push ebx
push eax
mov esi, ecx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x108], bl
call fcn.00443c10
lea eax, [esi + 0x9f6]
push eax
lea eax, [ebp - 0x108]
push 0x481d54
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x108]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [0x4ae264]
mov esi, eax
push ebx
lea eax, [ebp - 4]
push eax
push dword [ecx + 0x1220]
push dword [ecx + 0x121c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4151a1
Capabilities:
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x410], ax
xor ebx, ebx
lea eax, [ebp - 0x40e]
mov esi, ecx
push ebx
push eax
call fcn.00443c10
xor eax, eax
push edi
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push ebx
push eax
call fcn.00443c10
add esp, 0x18
lea eax, [ebp - 0x410]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4830c4
lea edi, [esi + 0xef2]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
lea eax, [ebp - 0x208]
push 0x482fec
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x208]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
push eax
lea eax, [ebp - 0x410]
push eax
call ebx
push 0x48307c
push edi
lea eax, [ebp - 0x208]
push 0x482fec
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x208]
push 0
push eax
lea eax, [ebp - 0x410]
push eax
call ebx
push 0x483094
push edi
lea eax, [ebp - 0x208]
push 0x482fec
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x208]
push 0
push eax
lea eax, [ebp - 0x410]
push eax
call ebx
push 0x4830ac
push edi
lea eax, [ebp - 0x208]
push 0x482fec
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x208]
push 0
push eax
lea eax, [ebp - 0x410]
push eax
call ebx
lea ecx, [ebp - 0x208]
sub ecx, edi
movzx eax, word [edi]
mov word [ecx + edi], ax
lea edi, [edi + 2]
test ax, ax
jne 0x4152b7
push 0x483064
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call ebx
test eax, eax
lea eax, [ebp - 0x208]
push eax
setne bl
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x415311
xor eax, 1
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41531a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push 0x206
push eax
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push eax
call fcn.00443c10
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x208]
push 0x4830c4
push ebx
push 0x482fec
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x208]
add esp, 0x1c
push eax
call esi
push 0x48307c
push ebx
lea eax, [ebp - 0x208]
push 0x482fec
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call esi
push 0x483094
push ebx
lea eax, [ebp - 0x208]
push 0x482fec
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call esi
push 0x4830ac
push ebx
lea eax, [ebp - 0x208]
push 0x482fec
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4153d6
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
lea eax, [ebp - 8]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x10]
movlpd qword [ebp - 0x18], xmm0
push eax
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x10], xmm0
push eax
push 0x4830dc
movlpd qword [ebp - 8], xmm0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov ebx, 0x96
mov esi, eax
push ebx
call fcn.0041ed67
push ebx
xor ebx, ebx
mov edi, eax
push ebx
push edi
call fcn.00443c10
add esp, 0x10
test esi, esi
je 0x415467
push 0x3f
lea eax, [ebp - 0x57]
mov byte [ebp - 0x58], bl
push ebx
push eax
call fcn.00443c10
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
shrd ecx, eax, 0x14
shr eax, 0x14
push eax
push ecx
lea eax, [ebp - 0x58]
push 0x481c98
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x95
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.0043ef20
add esp, 0x28
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416918
Capabilities:
Create pipe
Create process on windows
Print debug messages
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8b8
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push 0x7ff
push eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x8b4], al
lea eax, [ebp - 0x8b3]
push eax
call fcn.00443c10
add esp, 0xc
mov byte [ebp - 0xb0], 0
lea eax, [ebp - 0xaf]
push 0x31
push 0
push eax
call fcn.00443c10
mov ecx, dword [ebx + 0x1c]
add esp, 0xc
call fcn.00420b40
push eax
push dword [ebx + 0x18]
lea eax, [ebp - 0xb0]
push dword [ebx + 0x14]
push 0x483424
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
add esp, 0x14
stosd dword es:[edi], eax
push 0x800
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x1c], 0xc
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4169bf
push 0x483444
jmp 0x416a8e
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
push 0x44
pop esi
push esi
stosd dword es:[edi], eax
push 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00443c10
add esp, 0xc
or dword [ebp - 0x50], 0x100
xor eax, eax
mov dword [ebp - 0x7c], esi
mov word [ebp - 0x4c], ax
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x7c]
push eax
push ecx
push ecx
push 0x8000000
push 1
push ecx
push ecx
lea eax, [ebp - 0xb0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x2c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test esi, esi
je 0x416a89
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x28]
call esi
push dword [ebp - 0xc]
call esi
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push 0
push eax
push 0x800
lea eax, [ebp - 0x8b4]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x416a66
push 0x4834b8
jmp 0x416a8e
mov eax, dword [ebp - 8]
push dword [ebp - 0x10]
mov byte [ebp + eax - 0x8b4], 0
call esi
lea eax, [ebp - 0x8b4]
mov ecx, ebx
push eax
push dword [ebp + 8]
call fcn.004167ee
jmp 0x416aa1
push 0x48347c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp + 8]
push 0x48086e
call fcn.004074b1
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x417c87
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
xor esi, esi
push esi
push esi
push esi
push esi
mov ebx, ecx
call edi
push esi
push esi
push esi
push esi
mov dword [ebp - 4], eax
call edi
push 0
push 0
push 1
push 0
mov esi, eax
call edi
mov edi, dword [ebp - 4]
mov dword [ebx + 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x50], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x58], eax
mov al, byte [ebp + 0x24]
push 0
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x38], esi
mov dword [ebx + 0x30], 0x41c1ab
mov byte [ebx + 0x5c], al
call fcn.0041ed70
pop ecx
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jne 0x417cf1
xor eax, eax
jmp 0x417cf6
call fcn.0041570f
mov dword [ebx + 0x20], eax
mov al, byte [ebp + 0x28]
mov byte [ebx + 0x5d], al
mov eax, dword [ebp + 0x2c]
mov dword [ebx + 0x60], eax
mov eax, dword [ebp + 0x30]
mov dword [ebx + 0x64], eax
mov eax, dword [ebp + 0x34]
mov dword [ebx + 0x68], eax
mov eax, dword [ebp + 0x38]
push 0
mov dword [ebx + 0x6c], eax
call fcn.0041ed70
pop ecx
mov ecx, dword [ebp + 0x3c]
test ecx, ecx
jne 0x417d2a
xor eax, eax
jmp 0x417d2f
call fcn.0041570f
mov dword [ebx + 0x78], eax
mov eax, dword [ebp + 0x40]
mov dword [ebx + 0x80], eax
mov eax, dword [ebp + 0x44]
mov dword [ebx + 0x84], eax
mov eax, dword [ebp + 0x48]
mov dword [ebx + 0x8c], eax
mov eax, dword [ebp + 0x4c]
push 0x1000
mov dword [ebx + 0x90], eax
call fcn.0041ed67
mov dword [esp], 0x1000
mov esi, eax
push 0
push esi
call fcn.00443c10
push dword [ebp + 0x18]
lea eax, [ebx + 0x24]
mov dword [ebx + 0x7c], esi
push 0x481d54
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
xor esi, esi
push esi
call fcn.0041ed70
mov ecx, dword [ebp + 0x1c]
add esp, 0x1c
test ecx, ecx
jne 0x417d9c
mov eax, esi
jmp 0x417da1
call fcn.0041570f
mov dword [ebx + 0x40], eax
lea eax, [ebx + 4]
push eax
push esi
push ebx
push 0x417dd4
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push edi
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x48
Function at 0x41824e
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x418275
xor eax, eax
jmp 0x4182c7
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
test eax, eax
je 0x4182be
lea ecx, [eax + 1]
push esi
push ecx
call fcn.0043e4b6
pop ecx
push ebx
mov esi, eax
lea ecx, [ebp - 8]
mov eax, dword [ebp - 4]
push ecx
push eax
push esi
push edi
mov byte [esi + eax], bl
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 4]
sub esp, 0xc
mov ecx, esi
call fcn.004181cc
push esi
mov ebx, eax
call fcn.0043e094
add esp, 0x10
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418300
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
mov eax, 0x48086e
cmovne eax, edi
mov edi, eax
mov ecx, edi
call fcn.004063b8
mov ebx, eax
mov ecx, 0x1000
sub ecx, dword [esi + 4]
cmp ebx, ecx
cmovg eax, ecx
push eax
mov dword [ebp + 8], eax
mov eax, dword [esi + 4]
add eax, 8
add eax, esi
push edi
push eax
call fcn.00443520
mov eax, dword [ebp + 8]
mov ecx, 0x1000
add dword [esi + 4], eax
add esp, 0xc
cmp dword [esi + 4], ecx
jne 0x418372
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push ecx
lea eax, [esi + 8]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
and dword [esi + 4], 0
mov eax, dword [ebp + 8]
sub ebx, eax
je 0x41837a
add edi, eax
jmp 0x41830c
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x418386
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x474524
call fcn.00473e04
mov eax, 0x1018
call fcn.00443be0
push ebx
push esi
push edi
xor edi, edi
mov ebx, edx
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1024], eax
mov dword [ebp - 0x1020], edi
mov dword [ebp - 4], edi
cmp eax, 0xffffffff
je 0x41852a
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 2
call fcn.0044a060
mov eax, esp
mov dword [ebp - 0x1c], eax
test esi, esi
jle 0x41843d
mov esi, dword [ebp + 0xc]
mov ecx, eax
sub ecx, esi
mov dword [ebp - 0x18], ecx
xor eax, eax
cmp word [esi + 2], ax
jne 0x4183fb
mov eax, dword [esi]
jmp 0x418407
mov eax, dword [ebx]
mov ecx, ebx
push dword [esi]
call dword [eax + 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + esi], eax
test edi, edi
je 0x41841e
push 0x480d50
lea ecx, [ebp - 0x1024]
call fcn.00418300
push dword [esi]
lea ecx, [ebp - 0x1024]
call fcn.00418300
mov ecx, dword [ebp - 0x18]
inc edi
add esi, 4
cmp edi, dword [ebp + 8]
jl 0x4183ef
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
xor edi, edi
push ecx
mov dword [eax], ecx
inc edi
mov eax, dword [ebx]
push ecx
push edi
mov ecx, ebx
call dword [eax + 0x18]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4184e8
mov dword [ebp - 0x18], edi
push 0x480934
lea ecx, [ebp - 0x1024]
call fcn.00418300
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1024]
call fcn.00418300
mov dword [ebp - 0x14], edi
mov edx, edi
cmp esi, edi
jle 0x4184c7
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebx]
push 0
push dword [ecx + edx*4]
mov ecx, ebx
push dword [ebp - 0x18]
call dword [eax + 0x18]
push 0x480d50
lea ecx, [ebp - 0x1024]
mov esi, eax
call fcn.00418300
push esi
lea ecx, [ebp - 0x1024]
call fcn.00418300
mov edx, dword [ebp - 0x14]
inc edx
mov dword [ebp - 0x14], edx
cmp edx, edi
jl 0x418486
mov esi, dword [ebp + 8]
xor edi, edi
inc edi
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebx]
inc ecx
push 0
push dword [edx]
mov dword [ebp - 0x18], ecx
push ecx
mov ecx, ebx
call dword [eax + 0x18]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x41845c
push 0x480934
lea ecx, [ebp - 0x1024]
call fcn.00418300
cmp dword [ebp - 0x1020], 0
je 0x418524
xor eax, eax
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1020]
lea eax, [ebp - 0x101c]
push eax
push dword [ebp - 0x1024]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x1024]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
lea esp, [ebp - 0x1030]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418688
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push 0x103
lea eax, [ebp - 0x103]
mov byte [ebp - 0x104], 0
push 0
push eax
mov ebx, ecx
call fcn.00443c10
lea eax, [ebx + 0x28]
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x4186bc
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x104]
push 0x104
push eax
call fcn.0043e29a
add esp, 0xc
xor eax, eax
cmp byte [ebp - 0x104], 0x5c
jne 0x4186df
inc eax
jmp 0x4186f4
cmp byte [ebp - 0x103], 0x3a
jne 0x4186f4
cmp byte [ebp - 0x102], 0x5c
jne 0x418753
push 3
pop eax
push esi
lea esi, [ebp - 0x104]
add esi, eax
cmp byte [esi], 0
je 0x418752
push edi
xor edi, edi
mov al, byte [esi]
cmp al, 0x5c
jne 0x418725
cmp al, 0x3a
je 0x418725
push 0
lea eax, [ebp - 0x104]
mov byte [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [esi], 0x5c
inc edi
inc esi
cmp byte [esi], 0
jne 0x418705
test edi, edi
pop edi
je 0x418752
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx + 8], eax
pop esi
xor eax, eax
cmp dword [ebx + 8], 0xffffffff
pop ebx
setne al
mov esp, ebp
pop ebp
ret
Function at 0x418b8f
Capabilities:
Check if file exists
Create directory

Disassembly:
mov eax, 0x474600
call fcn.00473e04
sub esp, 0x98
push ebx
push esi
push edi
lea eax, [ebp - 0x40]
mov edi, ecx
push eax
call fcn.00418b38
xor ebx, ebx
lea ecx, [ebp - 0x28]
push 0x4835b4
mov edx, eax
mov dword [ebp - 4], ebx
call fcn.00419c58
pop ecx
xor esi, esi
mov byte [ebp - 4], 2
push ebx
inc esi
lea ecx, [ebp - 0x40]
push esi
call fcn.00408186
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x418bf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
call fcn.00418b55
push 0x480b08
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x88]
call fcn.00419c58
pop ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x58]
push dword [ebp + 0xc]
mov edx, eax
call fcn.00419c8a
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x88]
call fcn.00408186
push ebx
push esi
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 7
call fcn.00408186
push 0x480b40
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xa0]
call fcn.004170bd
pop ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 8
push ecx
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.00419c8a
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00416d47
push ebx
push esi
lea ecx, [ebp - 0x40]
call fcn.00408186
push ebx
push esi
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 7
call fcn.00408186
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x418cb6
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
push ecx
call fcn.0041824e
pop ecx
pop ecx
jmp 0x418d01
push 0x2c
mov dword [ebp - 0x3c], 0x48086e
mov dword [ebp - 0x38], 0x4835bc
mov dword [ebp - 0x34], 0x4835c4
mov dword [ebp - 0x30], 0x480b0c
mov dword [ebp - 0x2c], 0x4835cc
call fcn.0043d6b0
pop ecx
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 9
test eax, eax
je 0x418cfb
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push ecx
mov ecx, eax
call fcn.0040ab43
jmp 0x418cfd
mov eax, ebx
mov byte [ebp - 4], 7
mov esi, dword [ebp + 8]
mov dword [edi], eax
cmp dword [esi], 0
je 0x418d29
mov eax, esi
mov eax, dword [eax]
mov ecx, dword [edi]
push dword [eax + 4]
mov edx, dword [ecx]
push 0x4835bc
push dword [eax]
call dword [edx + 0x20]
inc ebx
lea eax, [esi + ebx*4]
cmp dword [eax], 0
jne 0x418d0d
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edx, dword [edi]
cmovae ecx, dword [ebp - 0x28]
call fcn.0041854a
mov eax, dword [esi]
xor edi, edi
jmp 0x418d4c
push eax
call fcn.0043d685
inc edi
pop ecx
mov eax, dword [esi + edi*4]
test eax, eax
jne 0x418d41
push esi
call fcn.0041ed70
pop ecx
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00408186
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00408186
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41a23e
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
push edi
push dword [esi + 0xf4]
mov dword [esi], 0x484058
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [esi + 0x143], 0
je 0x41a265
call fcn.00417add
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41a272
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esi + 0x11c]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
test eax, eax
je 0x41a28c
push eax
call ebx
mov dword [esi + 0x11c], edi
mov eax, dword [esi + 0x120]
test eax, eax
je 0x41a29f
push eax
call ebx
mov dword [esi + 0x120], edi
mov ecx, dword [esi + 0x128]
test ecx, ecx
je 0x41a2af
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x12c]
test ecx, ecx
je 0x41a2bf
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esi + 0x124]
test eax, eax
je 0x41a2d2
push eax
call ebx
mov dword [esi + 0x124], edi
mov ecx, dword [esi + 0x130]
test ecx, ecx
je 0x41a2e8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x130], edi
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41a2f5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [esi + 0xd8], edi
jle 0x41a31b
lea ebx, [esi + 0xb0]
mov ecx, dword [ebx]
test ecx, ecx
je 0x41a30f
mov eax, dword [ecx]
push 1
call dword [eax]
inc edi
add ebx, 4
cmp edi, dword [esi + 0xd8]
jl 0x41a303
cmp byte [esi + 0x144], 0
pop ebx
je 0x41a34c
push 0x484010
push dword [esi + 0x134]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esi + 0x138]
push ecx
call eax
pop ecx
push dword [esi + 0x134]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
ret
Function at 0x41c6ec
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47411a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push ebx
push 0x13
mov edx, dword [edi + 0x148]
pop ecx
call fcn.00411da6
mov edx, dword [edi + 0x148]
pop ecx
pop ecx
lea ecx, [edx + 0x10b97]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c731
sub ecx, esi
je 0x41c757
lea ecx, [edx + 0x10a98]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c745
sub ecx, edx
je 0x41c757
mov ecx, edi
call fcn.0041e103
mov eax, dword [edi + 0xf4]
mov ecx, dword [0x4ae5c8]
mov dword [0x4ae5c4], eax
mov eax, dword [edi + 0x148]
push 1
test byte [eax + 0xaf68], 1
pop eax
cmovne ecx, eax
mov dword [0x4ae5c8], ecx
mov eax, dword [edi + 0x148]
push 2
test byte [eax + 0xaf68], 2
pop eax
cmovne ecx, eax
push 0x928
mov dword [0x4ae5c8], ecx
call fcn.0043d6b0
mov esi, eax
pop ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x1c], ebx
test esi, esi
je 0x41c7d6
mov edx, dword [edi + 0x148]
mov ecx, dword [0x4ae5c8]
mov dword [esi + 0x924], ecx
mov ecx, esi
push edx
call fcn.0041278f
mov ecx, esi
call fcn.004129a2
jmp 0x41c7d8
mov esi, ebx
or dword [esp + 0x1c], 0xffffffff
call fcn.00413b89
mov ecx, esi
call fcn.00413460
mov edx, 0x4ae2a0
mov ecx, esi
sub edx, esi
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x41c7f2
lea ecx, [esi + 0x208]
mov edx, 0x4ae4a8
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x41c80e
lea ecx, [esi + 0x410]
mov edx, 0x4ae5ac
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x41c825
test esi, esi
je 0x41c83f
push esi
call fcn.0043d685
pop ecx
push ebx
push ebx
push 0x4ae2a0
push 0x41c86b
push ebx
push ebx
call fcn.00440387
mov ecx, dword [esp + 0x2c]
add esp, 0x18
mov byte [edi + 0xd], 1
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret