joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005dc50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x1005dca3
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
inc ecx
lea ecx, [edx + ecx*4]
mov dword [ebp + 0xc], ecx
cmp edi, esi
jne 0x1005dcbf
mov ecx, esi
jmp 0x1005dcc3
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1005dd13
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx]
je 0x1005dcd5
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
jmp 0x1005dcb7
mov ecx, dword [ebx]
mov edx, eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
nop
cmp edi, esi
jne 0x1005dce8
mov ecx, esi
jmp 0x1005dcec
mov ecx, dword [ebx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1005dcfc
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jne 0x1005dcfc
mov eax, dword [eax]
jmp 0x1005dce0
cmp edx, eax
je 0x1005dd13
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
mov dword [eax + 4], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1005dde0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x1005de33
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x1005de5f
cmp dword [ecx], edi
jne 0x1005de57
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
mov dword [ecx + edx + 4], eax
jmp 0x1005de67
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1005de67
cmp dword [ecx], edi
jne 0x1005de6a
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
call fcn.1000a3a0
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1005e0e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x1005e138
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [ebx + 8]
lea eax, [ecx*8]
mov esi, dword [ebx]
mov dword [esp + 0x14], eax
add eax, edx
mov dword [esp + 0x10], eax
mov eax, dword [eax]
cmp esi, eax
je 0x1005e170
mov esi, dword [esp + 0x10]
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x1005e170
mov eax, dword [edi]
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x1005e1b4
cmp esi, dword [edx + ecx*8]
jne 0x1005e163
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x1005e19a
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [esp + 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x1005e1e4
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x1005e206
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
call fcn.1000a3a0
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x1005e1ec
mov dword [ecx], edi
jmp 0x1005e206
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1005e206
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.1005e220
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1005e420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10096757
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100cf288]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 0x1c]
movss xmm3, dword [ebp + 0x14]
push ebx
push dword [ebp + 0x18]
mov dword [edi], vtable.TextureFont.0
push ecx
push dword [ebp + 8]
lea ecx, [edi + 0xc]
call fcn.10054270
sub esp, 8
mov dword [ebp - 4], 0
lea ecx, [edi + 0x4c]
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
call fcn.1005dba0
sub esp, 8
mov byte [ebp - 4], 1
lea ecx, [edi + 0x6c]
call fcn.1005dba0
push 0
push 0
push 0
mov dword [edi + 0x90], vtable.Locker2.0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 0x94], eax
lea eax, [edi + 0x9c]
mov dword [edi + 0x98], vtable.Locker.0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 4
lea esi, [edi + 0xbc]
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.10062ca1
add esp, 4
test eax, eax
jne 0x1005e50a
call fcn.10061d21
mov dword [esi], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
sub esp, 8
mov byte [ebp - 4], 5
lea ecx, [edi + 0x124]
call fcn.1005dd30
sub esp, 8
mov byte [ebp - 4], 6
lea ecx, [edi + 0x144]
call fcn.1005f710
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 7
mov dword [edi + 0x3c], esi
mov dword [edi + 0x38], eax
mov eax, dword [ebp + 0x20]
imul esi, esi
mov dword [edi + 0x44], eax
mov al, byte [ebp + 0x24]
mov byte [edi + 0x48], al
mov eax, dword [ebp + 0x18]
shl esi, 2
push esi
mov byte [edi + 0xd0], bl
mov dword [edi + 0x40], 0
mov dword [edi + 8], eax
call fcn.10062347
add esp, 4
mov dword [edi + 4], eax
push esi
push 0
push eax
call fcn.1006a450
add esp, 0xc
cmp dword [edi + 0x3c], 0x200
jae 0x1005e59e
mov dword [edi + 0x3c], 0x200
mov eax, dword [edi + 0x3c]
mov ecx, edi
shr eax, 8
mov dword [edi + 0x2c], eax
call fcn.1005f020
mov esi, dword [edi + 0x3c]
xor ecx, ecx
shr esi, 8
mov edx, 4
imul esi, esi
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10062347
add esp, 4
mov dword [edi + 0x8c], eax
lea ecx, [esi*4]
push ecx
push 0
push eax
call fcn.1006a450
add esp, 0xc
mov ecx, edi
call fcn.1005e8f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x1005f020
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10096896
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100cf288]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x100daa24], 0
jne 0x1005f084
push 0x30
call fcn.10062ca1
add esp, 4
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x1005f076
mov ecx, eax
call fcn.1004ff50
jmp 0x1005f078
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x100daa24], eax
lea eax, [ebp - 0x58]
push eax
call fcn.100508d0
mov esi, eax
mov dword [ebp - 4], 1
cmp dword [0x100daa24], 0
jne 0x1005f0c8
push 0x30
call fcn.10062ca1
add esp, 4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x1005f0bd
mov ecx, eax
call fcn.1004ff50
jmp 0x1005f0bf
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x100daa24], eax
lea eax, [ebp - 0x40]
push eax
call fcn.10050bb0
push esi
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.10053730
add esp, 4
cmp dword [ebp - 0x2c], 0x10
jb 0x1005f0f4
push dword [ebp - 0x40]
call fcn.1000a3a0
add esp, 4
cmp dword [ebp - 0x44], 0x10
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jb 0x1005f117
push dword [ebp - 0x58]
call fcn.1000a3a0
add esp, 4
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push str.size_adjust
push str.Font
call esi
cmp dword [ebp - 0x14], 0x10
mov dword [edi + 0xb4], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push str.yoffset_adjust
push str.Font
call esi
cmp dword [ebp - 0x14], 0x10
mov dword [edi + 0xb8], eax
jb 0x1005f16e
push dword [ebp - 0x28]
call fcn.1000a3a0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006249d
mov esp, ebp
pop ebp
ret

Function at 0x100688e6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x402eb8
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x402ed5
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x402ee4
mov ebx, 0x40f0f0
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402ef9
mov ecx, dword [0x424798]
add ecx, eax
push ecx
call fcn.004030e7
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.004030b5
test eax, eax
je 0x403060
test byte [ebp + 0x17], 0x80
je 0x403049
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40b020
mov dword [ebp - 0xc], eax
call fcn.00405d8a
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x4030ab
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402f49
mov esi, dword [ebp + 0x14]
mov edi, 0x40b0f0
push esi
push edi
call fcn.004030b5
test eax, eax
je 0x403060
sub dword [ebp + 0x14], esi
mov dword [0x40b038], edi
mov dword [0x40b03c], esi
mov eax, dword [ebp - 8]
mov ecx, 0x40b020
mov dword [0x40b040], ebx
mov dword [0x40b044], eax
call fcn.00405daa
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x403041
mov esi, dword [0x40b040]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x40929c], 1
mov edi, eax
je 0x402feb
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x402fb8
cmp dword [ebp + 0x14], 0
jne 0x402feb
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x54]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.00404d40
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x403036
cmp dword [ebp + 0x10], eax
jne 0x403014
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403045
cmp dword [ebp - 0x10], esi
jne 0x403045
add dword [ebp - 4], esi
jmp 0x40302a
sub dword [ebp - 8], esi
add dword [ebp - 4], esi
cmp dword [ebp - 8], 1
mov ebx, dword [0x40b040]
jl 0x4030ab
cmp dword [ebp - 0x14], 1
jne 0x402f6c
jmp 0x4030ab
cmp dword [ebp + 0x14], eax
jg 0x402f3c
jmp 0x4030ab
push 0xfffffffffffffffc
jmp 0x403062
push 0xfffffffffffffffe
jmp 0x403062
test edi, edi
je 0x4030a0
cmp dword [ebp + 0x14], esi
jge 0x403055
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.004030b5
test eax, eax
jne 0x4030a8
push 0xfffffffffffffffd
pop eax
jmp 0x4030ae
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403070
mov esi, dword [ebp + 0x14]
mov edi, 0x40b0f0
push esi
push edi
call fcn.004030b5
test eax, eax
je 0x403060
lea eax, [ebp + 0x10]
push 0
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403045
cmp esi, dword [ebp + 0x10]
jne 0x403045
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x403065
jmp 0x4030ab
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x405224
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x422d48], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x405248
test al, 0x10
jne 0x40524b
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x422d48
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405276
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x4052de
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.0040557f
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x405314
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4247c8], eax
jmp 0x405499
mov dword [ebp + 8], ecx
push edi
and dword [ebp + 8], 1
je 0x40532f
test eax, eax
je 0x405444
test cl, 2
je 0x405444
mov esi, 0x421d48
push ebx
push esi
call fcn.004059ac
cmp dword [ebp + 8], 0
je 0x40534e
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405354
push ebx
call fcn.004054e6
push 0x409010
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x40543a
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.004054ca
cmp byte [eax], 0
je 0x4053a5
cmp byte [ebp - 0x18], 0
je 0x4053a5
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x4053bb
mov al, byte [esi + 1]
test al, al
je 0x405419
cmp al, 0x2e
jne 0x4053bb
cmp byte [esi + 2], 0
je 0x405419
push esi
push edi
call fcn.004059ac
test byte [ebp - 0x148], 0x10
je 0x4053e0
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405419
push dword [ebp + 0xc]
push ebx
call fcn.004052de
jmp 0x405419
push ebx
call fcn.00405663
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405411
test byte [ebp + 0xc], 4
je 0x405409
push ebx
push 0xfffffffffffffff1
call fcn.00404d40
push 0
push ebx
call fcn.004056f9
jmp 0x405419
inc dword [0x4247c8]
jmp 0x405419
push ebx
push 0xfffffffffffffff2
call fcn.00404d40
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405383
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405444
and byte [edi - 1], 0
xor esi, esi
pop edi
cmp dword [ebp + 8], esi
je 0x405499
cmp dword [ebp - 8], esi
jne 0x405459
inc dword [0x4247c8]
jmp 0x405499
push ebx
call fcn.00405c81
test eax, eax
je 0x405499
push ebx
call fcn.0040549f
push ebx
call fcn.00405663
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405491
test byte [ebp + 0xc], 4
je 0x405451
push ebx
push 0xfffffffffffffff1
call fcn.00404d40
push esi
push ebx
call fcn.004056f9
jmp 0x405499
push ebx
push 0xffffffffffffffe5
call fcn.00404d40
pop esi
pop ebx
leave
ret 8
Function at 0x40557f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x422148
push esi
call fcn.004059ac
push esi
call fcn.00405532
mov edi, eax
test edi, edi
jne 0x4055a0
xor eax, eax
jmp 0x4055f2
push edi
call fcn.00405be8
test byte [0x424750], 0x80
je 0x4055b9
mov al, byte [edi]
test al, al
je 0x40559c
cmp al, 0x5c
je 0x40559c
sub edi, esi
jmp 0x4055d1
call fcn.00405c81
test eax, eax
je 0x4055cb
test byte [eax], 0x10
je 0x40559c
push esi
call fcn.004054e6
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x4055bd
call fcn.0040549f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405663
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40567f
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x405682
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4056b1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4056f5
test edi, edi
jne 0x4056bc
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4056ef
Function at 0x4056f9
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call fcn.00405cbf
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405725
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405864
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x422ed0], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x422ed0
je 0x405769
push 1
push 0
push esi
call fcn.00405682
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x40586a
cmp eax, edi
jg 0x40586a
mov esi, 0x422948
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x40586a
cmp eax, edi
jg 0x40586a
push esi
push ebp
push str._s_s_r_n
push 0x422548
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call sub.KERNEL32.dll_lstrcatA
push 4
push 0xc0000000
push esi
call fcn.00405682
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405864
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40585d
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40585d
cmp edi, dword [esp + 0x18]
jne 0x40585d
push str._Rename__r_n
push esi
call fcn.004055f7
test eax, eax
jne 0x405871
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.004059ac
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x422548
push eax
call fcn.00405643
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x4247d0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409304
push eax
call fcn.004055f7
test eax, eax
je 0x405828
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405898
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x40588d
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x40582a
Function at 0x4059ce
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jge 0x4059ef
mov ecx, dword [0x423f1c]
lea eax, [ebx*4 + 4]
sub ecx, eax
mov ebx, dword [ecx]
mov eax, dword [0x424778]
mov ecx, dword [ebp + 8]
add ebx, eax
mov eax, 0x4236e0
sub ecx, eax
mov edi, eax
cmp ecx, 0x800
jae 0x405bc2
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405bc2
mov edx, edi
sub edx, eax
cmp edx, 0x400
jge 0x405bcf
inc ebx
cmp cl, 0xfc
jbe 0x405bb5
movsx eax, byte [ebx + 1]
movsx ecx, byte [ebx]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
or ecx, edx
or eax, edx
inc ebx
mov dword [ebp - 0x14], ecx
inc ebx
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 0xc], eax
jne 0x405b60
and dword [ebp + 0xc], 0
and byte [edi], 0
push 4
pop esi
cmp dword [ebp - 0x10], esi
jne 0x405a83
mov dword [ebp + 0xc], str.MicrosoftInternet_ExplorerQuick_Launch
jmp 0x405afb
mov eax, dword [ebp - 0x18]
cmp eax, 0x2b
jne 0x405aa2
push edi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004058a0
jmp 0x405af6
cmp eax, 0x26
jne 0x405ad2
push edi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004058a0
cmp byte [edi], 0
jne 0x405b58
push str.C:Program_Files
push edi
call fcn.004059ac
jmp 0x405af6
cmp eax, 0x25
jne 0x405ae5
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405af6
cmp eax, 0x24
jne 0x405afb
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [edi], 0
jne 0x405b58
cmp dword [0x4247c4], 0
jne 0x405b07
push 2
pop esi
lea eax, [ebp - 4]
dec esi
push eax
push dword [ebp + esi*4 - 0x18]
push dword [0x424744]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405b3d
push edi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call fcn.004051f9
cmp dword [ebp - 8], 0
jne 0x405b44
jmp 0x405b40
and byte [edi], 0
test esi, esi
jne 0x405b07
cmp byte [edi], 0
je 0x405b58
cmp dword [ebp + 0xc], 0
je 0x405b58
push dword [ebp + 0xc]
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call fcn.00405be8
jmp 0x405ba6
cmp byte [ebp + 0xf], 0xfd
jne 0x405b94
cmp esi, 0x1b
jne 0x405b79
push dword [0x424744]
push edi
call fcn.0040590a
jmp 0x405b8a
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.004059ac
add esi, 0xffffffeb
cmp esi, 6
jae 0x405ba6
jmp 0x405b58
cmp byte [ebp + 0xf], 0xff
jne 0x405ba6
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.004059ce
push edi
call sub.KERNEL32.dll_lstrlenA
add edi, eax
mov eax, 0x4236e0
jmp 0x405bc2
jne 0x405bbf
mov cl, byte [ebx]
mov byte [edi], cl
inc edi
inc ebx
jmp 0x405bc2
mov byte [edi], cl
inc edi
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x405a1a
and byte [edi], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405be4
push eax
push dword [ebp + 8]
call fcn.004059ac
leave
ret 8