joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401dca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x401dd9
pop dword [ebp - 0x14]
mov eax, 0xb885ed0c
add eax, 0x47ba30cd
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x8a90516c
add dword [ebp - 0x24], 0xc3c1f3df
mov dword [ebp - 0x20], 0x364c2871
add dword [ebp - 0x20], 0xfbe723d4
mov dword [ebp - 0x1c], 0x4a7c3a80
sub dword [ebp - 0x1c], 0xfe2ff652
mov dword [ebp - 0x18], 0x26b2fbcb
sub dword [ebp - 0x18], 0x26b2fbcb
lea eax, [ebp - 0x24]
push eax
mov eax, 0x60fdbdd6
sub eax, 0x60bb8d62
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xe2bd3c5e
add dword [ebp - 0x24], 0x91b52cf8
mov dword [ebp - 0x20], 0xe11d3e6c
add dword [ebp - 0x20], 0x604f2309
mov dword [ebp - 0x1c], 0x915522d9
add dword [ebp - 0x1c], 0xd21a4993
mov dword [ebp - 0x18], 0xe16e0b33
sub dword [ebp - 0x18], 0xe16e0b33
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x79c99654
sub eax, 0x79876530
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x42728
push 0
call eax
mov ecx, 0x490ca2a4
add ecx, 0xb6f3b84b
mov esi, eax
mov edx, 0x2939e5cf
add edx, 0xd7095e31
add edx, dword [ebp - 0x14]
mov ebx, 0xbabbb3c5
add ebx, 0xfebc2120
xor dword [ebp - 0x10], ebx
mov edi, dword [edx]
xor dword [ebp - 0xc], 0x2acd28ca
add edi, ebx
add dword [ebp - 4], edi
mov dword [esi], edi
add dword [ebp - 4], esi
add esi, 0x51ce588b
sub esi, 0x51ce5887
add edx, 0x8885472b
add edx, 0x777ab8d9
loop 0x401efb
add eax, 0x4ca6f3c4
sub eax, 0x4ca59535
mov ebx, eax
add eax, 0x23d59965
sub eax, 0x23d59960
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x402a20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4207f7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x427138]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0x4237ec
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.00403c40
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.004044f0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x42955c]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4044f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4202bb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x427138]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00409663
push 4
mov dword [esp + 0x20], 0
call fcn.00409cff
mov edi, eax
add esp, 4
test edi, edi
je 0x40456e
call fcn.004094d4
mov dword [edi], eax
call fcn.00409302
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00409624
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x404563
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0040964c
jmp 0x404570
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x4054c0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x474
mov eax, dword [0x427138]
xor eax, esp
mov dword [esp + 0x46c], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x62]
push ecx
mov word [esp + 0x64], ax
call fcn.0040e740
add esp, 0xc
push 0
push 0
lea edx, [esp + 0x60]
push edx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.environment.txt
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x58
lea ecx, [esp + 4]
push 0
push ecx
call fcn.0040e740
add esp, 0xc
lea eax, [esp + 0x260]
push eax
lea edx, [esp + 0x5c]
push 0x104
mov dword [esp + 8], 0x58
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], str.environment_files_.txt_
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0x208
mov dword [esp + 0x44], 0x4238d4
mov dword [esp + 0x3c], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp]
push ecx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x4055af
lea edx, [esp + 0x260]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [esp + 0x58]
push eax
mov ecx, 0x429e10
call fcn.004088b0
push 0
push 0x4238dc
test al, al
je 0x4055a3
push 0x4238fc
jmp 0x4055a8
push 0x423918
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x46c]
xor ecx, esp
call fcn.00409a6d
add esp, 0x474
ret
Function at 0x4059c0
Capabilities:
Check mutex on windows
Get common file path

Disassembly:
push str.BISHOP_Launcher
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
jne 0x4059ea
push str.CreateMutex
push eax
xor edx, edx
xor ecx, ecx
call fcn.00406de0
add esp, 8
xor eax, eax
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4059e5
push str.YKTIE_BISHOP
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x4059e5
push 0x429b88
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x405a27
or eax, 0xffffffff
ret 0x10
push esi
push 0x429b88
push 0x429568
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.manualindex.html
push 0x429568
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov eax, dword [esp + 8]
push 0
push 0x405a80
push 0
push 0x84
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
ret 0x10

Function at 0x406f00
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x118
mov eax, dword [0x427138]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push ebp
push edi
lea eax, [esp + 0xc]
push eax
mov edi, ecx
mov dword [esp + 0x10], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x1c], 1
jne 0x406f65
cmp word [0x429778], 0
je 0x406f4b
push 0x429778
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x406fbb
pop edi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00409a6d
add esp, 0x118
ret
push 0
push 0x1c
push esi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x406f4b
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.BISHOP
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x406fa1
call ebp
cmp eax, 0xb7
jne 0x406f4b
push str.YKTIE
push esi
call edi
push 0
push esi
call ebx
test eax, eax
jne 0x406fbb
call ebp
cmp eax, 0xb7
jne 0x406f4b
mov ecx, dword [esp + 0x120]
pop edi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.00409a6d
add esp, 0x118
ret
Function at 0x407000
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 8
cmp word [0x429980], 0
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, eax
je 0x407029
push 0x429980
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop esi
mov al, 1
pop ebp
add esp, 8
ret
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SoftwareBishop_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40705f
push esi
push ebp
xor edx, edx
mov ecx, eax
call fcn.00406de0
add esp, 8
pop esi
xor al, al
pop ebp
add esp, 8
ret
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea ecx, [esp + 0x14]
push ecx
push esi
push 0
push 0
push str.DataPath
push edx
mov dword [esp + 0x2c], 0
call ebx
mov edi, eax
cmp edi, 0xea
jne 0x4070a7
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push esi
push 0
push 0
push str.DataPath
push ecx
call ebx
mov edi, eax
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
test edi, edi
jne 0x4070bf
cmp dword [esp + 0x14], 4
jae 0x407131
mov ecx, ebp
call fcn.00406f00
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareBishop_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4070f8
pop edi
pop ebx
pop esi
xor al, al
pop ebp
add esp, 8
ret
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x10]
inc eax
lea ecx, [eax + eax]
push ecx
push esi
push 1
push 0
push str.DataPath
push edx
mov dword [esp + 0x2c], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov eax, dword [esp + 0x10]
push eax
call ebx
push esi
mov ecx, 0x429e10
call fcn.00406d60
test edi, edi
pop edi
pop ebx
pop esi
sete al
pop ebp
add esp, 8
ret
Function at 0x4078b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x138
mov eax, dword [0x427138]
xor eax, esp
mov dword [esp + 0x134], eax
mov eax, dword [esp + 0x13c]
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4079a1
push 0
lea eax, [esp + 0xc]
push eax
push 0x100
lea ecx, [esp + 0x48]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40799a
push str.BSP_067
push str.code:_s
lea edx, [esp + 0x24]
push 0x20
push edx
call fcn.0040ae29
add esp, 0x10
push 0
push 0
push 0x10
lea eax, [esp + 0x18]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x40]
push eax
call fcn.00413d49
add esp, 8
test eax, eax
jne 0x40799a
lea eax, [esp + 0x3c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407965
push esi
sub eax, edx
push 1
push str.disk:_02d
lea edx, [esp + 0x18]
mov esi, eax
call fcn.00408410
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + esi + 0x4d]
push edx
call fcn.00413d49
add esp, 0x10
pop esi
test eax, eax
jne 0x40799a
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
pop edi
mov al, bl
pop ebx
xor ecx, esp
call fcn.00409a6d
add esp, 0x138
ret

Function at 0x4079c0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x2a8
mov eax, dword [0x427138]
xor eax, esp
mov dword [esp + 0x2a4], eax
push ebp
push esi
push edi
lea eax, [esp + 0xb0]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor esi, esi
mov dword [esp + 0xc], eax
test eax, eax
jbe 0x407ae7
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, edi
cmp word [esp + esi*2 + 0xb0], 0
lea edi, [esp + esi*2 + 0xb0]
je 0x407ae7
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x407a33
inc esi
cmp word [esp + esi*2 + 0xb0], 0
jne 0x407a22
jmp 0x407adc
push 0
push 0
push 0
push 0
push 0
push 0x40
lea ecx, [esp + 0x48]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x407adc
push str.YKTIE
lea eax, [esp + 0x34]
xor edx, edx
push eax
mov word [esp + 0xb6], dx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x407a7f
inc esi
cmp word [esp + esi*2 + 0xb0], 0
jne 0x407a71
jmp 0x407adc
mov cx, word [edi]
mov edx, 0x3a
mov word [ebx + 2], dx
mov word [ebx], cx
push ebx
lea edx, [esp + 0x14]
mov eax, 0x5c
xor ecx, ecx
push edx
mov word [ebx + 4], ax
mov word [ebx + 6], cx
call ebp
push str.disk.ini
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [esp + 0x10]
push ecx
call fcn.004078b0
add esp, 4
test al, al
jne 0x407b06
jmp 0x407ad0
inc esi
cmp word [esp + esi*2 + 0xb0], 0
jne 0x407ad0
inc esi
cmp esi, dword [esp + 0xc]
jb 0x407a00
pop edi
xor edx, edx
pop esi
mov word [ebx], dx
xor al, al
pop ebp
mov ecx, dword [esp + 0x2a4]
xor ecx, esp
call fcn.00409a6d
add esp, 0x2a8
ret
mov ecx, dword [esp + 0x2b0]
pop edi
pop esi
pop ebp
xor ecx, esp
mov al, 1
call fcn.00409a6d
add esp, 0x2a8
ret
Function at 0x407b20
Capabilities:
Set current directory

Disassembly:
sub esp, 0x44
mov eax, dword [0x427138]
xor eax, esp
mov dword [esp + 0x40], eax
cmp word [0x429778], 0
push esi
mov esi, ecx
jne 0x407c24
xor eax, eax
push ebx
xor ecx, ecx
push edi
lea ebx, [esp + 0xc]
mov word [esp + 0xc], ax
mov dword [esp + 0xe], eax
mov dword [esp + 0x12], eax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
mov word [esp + 0x2c], cx
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov dword [esp + 0x46], eax
mov word [esp + 0x4a], ax
call fcn.004079c0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
test al, al
jne 0x407bae
push 0x423868
mov edx, ebx
push edx
call edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
push ecx
call edi
push str.setup.exe
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop edi
pop ebx
cmp eax, 0xffffffff
je 0x407c01
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x24]
push ecx
push str.setup.exe
jmp 0x407c66
push 0
push 0x4238dc
push 0x424188
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00409a6d
add esp, 0x44
ret
push 0x429778
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x407c55
push 0x429778
push esi
xor edx, edx
xor ecx, ecx
call fcn.00406de0
add esp, 8
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00409a6d
add esp, 0x44
ret
call fcn.00407140
test eax, eax
jne 0x407c7f
mov edx, dword [0x428158]
push eax
push edx
call fcn.004084c0
add esp, 8
test al, al
je 0x407c7f
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x44]
pop esi
xor ecx, esp
call fcn.00409a6d
add esp, 0x44
ret
Function at 0x407c90
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
sub esp, 0x674
mov eax, dword [0x427138]
xor eax, esp
mov dword [esp + 0x66c], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
mov ebx, ecx
push 0x206
push eax
lea ecx, [esp + 0x47a]
push ecx
mov dword [esp + 0x20], ebx
mov word [esp + 0x47c], ax
call fcn.0040e740
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x27e]
push eax
mov word [esp + 0x280], dx
call fcn.0040e740
push ebx
lea eax, [esp + 0x48c]
call fcn.00407000
add esp, 0x1c
test al, al
jne 0x407d0e
push 0
push 0x4238dc
push 0x4241c0
push ebx
jmp 0x407e70
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [esp + 0x470]
push ecx
lea edx, [esp + 0x26c]
push edx
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.save_
lea eax, [esp + 0x26c]
push eax
call esi
lea ecx, [esp + 0x268]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x407d5e
push eax
push 0x4238dc
push 0x4241e4
push ebx
jmp 0x407e70
lea edx, [esp + 0x470]
push edx
lea eax, [esp + 0x26c]
push eax
call edi
push str.savecommon.dat
lea ecx, [esp + 0x26c]
push ecx
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x268]
push edx
call ebp
lea eax, [esp + 0x470]
push eax
lea ecx, [esp + 0x26c]
push ecx
call edi
push str.save_no
lea edx, [esp + 0x26c]
push edx
call esi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x26c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407e30
lea ebx, [ebx]
cmp word [esp + 0x44], 0x2e
je 0x407e19
test byte [esp + 0x18], 0x10
jne 0x407e19
lea edx, [esp + 0x470]
push edx
lea eax, [esp + 0x26c]
push eax
call edi
push str.save
lea ecx, [esp + 0x26c]
push ecx
call esi
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x26c]
push eax
call esi
lea ecx, [esp + 0x268]
push ecx
call ebp
lea edx, [esp + 0x18]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407dd0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x470]
push eax
lea ecx, [esp + 0x26c]
push ecx
call edi
push str.save_
lea edx, [esp + 0x26c]
push edx
call esi
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x14]
push 0
push 0x4238dc
push 0x424248
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x67c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00409a6d
add esp, 0x674
ret
Function at 0x407ff0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4208d7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x427138]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0x424270
mov dword [edi + 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 4]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.004081c0
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
call fcn.004044f0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x42955c]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4084c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x40
push ebp
mov ebp, dword [esp + 0x4c]
push 0x38
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0040e740
mov ecx, dword [esp + 0x54]
add esp, 0xc
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x3c
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], str.open
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], 1
mov dword [esp + 0x10], 0x440
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x408538
cmp dword [esp + 0x28], 0x20
jle 0x408538
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
setne al
pop ebp
add esp, 0x40
ret
push ebx
push esi
push edi
push 0
push 0x200
lea ecx, [esp + 0x60]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov edx, dword [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov esi, eax
shr esi, 1
je 0x4085a3
cmp esi, 0x7fffffff
ja 0x4085a3
mov ebx, dword [esp + 0x58]
lea edi, [esp + 0x10]
mov ecx, esi
mov edx, ebx
call fcn.00408430
test eax, eax
jl 0x4085a7
mov eax, dword [esp + 0x10]
mov ecx, esi
sub ecx, eax
lea edx, [ebx + eax*2]
mov eax, 0x4242e4
call fcn.00408470
mov ebx, dword [esp + 0x58]
test ebp, ebp
jne 0x4085b0
mov ebp, str._current_dir_
test esi, esi
je 0x408619
cmp esi, 0x7fffffff
ja 0x4085e3
lea edi, [esp + 0x10]
mov ecx, esi
mov edx, ebx
call fcn.00408430
test eax, eax
jl 0x4085e3
mov eax, dword [esp + 0x10]
mov ecx, esi
sub ecx, eax
lea edx, [ebx + eax*2]
mov eax, ebp
call fcn.00408470
mov ebx, dword [esp + 0x58]
test esi, esi
je 0x408619
cmp esi, 0x7fffffff
ja 0x408619
lea edi, [esp + 0x10]
mov ecx, esi
mov edx, ebx
call fcn.00408430
test eax, eax
jl 0x408619
mov eax, dword [esp + 0x10]
mov ecx, esi
sub ecx, eax
lea edx, [ebx + eax*2]
mov eax, str.__r_nexe:__
call fcn.00408470
mov ebx, dword [esp + 0x58]
mov ebp, dword [esp + 0x54]
test ebp, ebp
jne 0x408626
mov ebp, str._unknown_application_
test esi, esi
je 0x40868f
cmp esi, 0x7fffffff
ja 0x408659
lea edi, [esp + 0x54]
mov ecx, esi
mov edx, ebx
call fcn.00408430
test eax, eax
jl 0x408659
mov eax, dword [esp + 0x54]
mov ecx, esi
sub ecx, eax
lea edx, [ebx + eax*2]
mov eax, ebp
call fcn.00408470
mov ebx, dword [esp + 0x58]
test esi, esi
je 0x40868f
cmp esi, 0x7fffffff
ja 0x40868f
lea edi, [esp + 0x54]
mov ecx, esi
mov edx, ebx
call fcn.00408430
test eax, eax
jl 0x40868f
mov eax, dword [esp + 0x54]
mov ecx, esi
sub ecx, eax
lea edx, [ebx + eax*2]
mov eax, 0x424354
call fcn.00408470
mov ebx, dword [esp + 0x58]
push 0x40
push 0x423db8
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
xor al, al
pop ebp
add esp, 0x40
ret