joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4600f8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4a9c0c]
cmp dword [eax + 0x30], 0
je 0x4601a2
cmp dword [ebx + 0x94], 0
jne 0x46019c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x460088
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46019c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x460162
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46019c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417798
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x460171
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x460c80
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x460cb5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004044d4
jmp 0x460cc2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404438
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x461d78
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x461db9
mov eax, esi
call fcn.00447c3c
test al, al
je 0x461db9
mov eax, dword [ebx + 0x84]
call fcn.00447938
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x461db9
push 0
mov eax, dword [ebx + 0x84]
call fcn.00447938
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x464fdc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00464c40
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404894
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x46503a
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4a8cb0]
mov dl, 1
mov eax, dword [0x464b38]
call fcn.0040be84
call fcn.00403da4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x465044
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404894
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x46509c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4a8f18]
mov dl, 1
mov eax, dword [0x464b38]
call fcn.0040be84
call fcn.00403da4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00464c70
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4684d4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4685ac
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a9c8c], 0
jne 0x468590
lea eax, [ebp - 4]
mov edx, 0x4685c4
call fcn.0040447c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404894
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x468590
mov eax, ebx
call fcn.00402784
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x468589
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x468573
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4685d4
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x468573
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4a9c8c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468590
mov eax, dword [ebp - 0xc]
call fcn.004027a4
ret
mov ebx, dword [0x4a9c8c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4685b3
lea eax, [ebp - 4]
call fcn.004043e4
ret

Function at 0x478c7c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov byte [esp], 0
cmp word [eax + 0x422], 0
je 0x478ca2
push esp
mov esi, eax
mov ecx, ebx
mov edx, eax
mov eax, dword [esi + 0x424]
call dword [esi + 0x420]
cmp byte [esp], 0
jne 0x478cd0
cmp dword [ebx + 0x2c], 0
je 0x478cd0
push 1
push 0
mov eax, dword [ebx + 0x40]
call fcn.00404894
push eax
mov eax, dword [ebx + 0x2c]
call fcn.00404894
push eax
push 0x478cd8
push 0
call sub.shell32.dll_ShellExecuteA
mov al, byte [esp]
pop edx
pop esi
pop ebx
ret

Function at 0x47a978
Capabilities:
Log keystrokes via application hook

Disassembly:
mov dword [0x4a9ca0], eax
push 0
mov eax, dword [0x4a9718]
push eax
mov eax, 0x4773e0
push eax
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4a9c9c], eax
ret
Function at 0x4828a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x482909
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4a7f18]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4828f3
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00482890
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x47fea4]
call fcn.00483758
mov dword [0x4a7f80], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482910
lea eax, [ebp - 8]
call fcn.00406154
ret

Function at 0x4829a8
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffea0
mov esi, 0x4008
test cl, cl
je 0x4829bb
or esi, 2
test dl, dl
je 0x4829c4
or esi, 0
jmp 0x4829c7
or esi, 1
push esi
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
ret
Function at 0x4835e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404884
xor eax, eax
push ebp
push 0x48373c
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x47fc8c]
call fcn.00413884
test eax, eax
jl 0x48364b
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.0048298c
and eax, 0x7f
mov eax, dword [eax*4 + 0x4a7f18]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x4836ae
mov eax, dword [ebx]
call fcn.0040469c
test eax, eax
jle 0x4836ae
mov eax, dword [ebx]
call fcn.0040469c
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x483672
mov eax, ebx
mov edx, 0x483754
call fcn.004046a4
mov eax, dword [ebx]
call fcn.0040469c
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
call fcn.0040524c
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.00482890
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x4836f9
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x4a8a58]
call fcn.00406620
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.00409528
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404438
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x407924]
call fcn.0040bd8c
call fcn.00403da4
mov eax, dword [ebp - 8]
call fcn.0048355c
mov ebx, eax
test edi, edi
je 0x48370e
mov eax, edi
call fcn.004035d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483743
lea eax, [ebp - 0x1c]
call fcn.004043e4
lea eax, [ebp - 0x18]
call fcn.00406154
lea eax, [ebp - 0x14]
call fcn.004043e4
lea eax, [ebp - 4]
call fcn.004043e4
ret

Function at 0x484320
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x3c
call fcn.00402eb4
mov dword [esp], 0x3c
mov eax, dword [0x4a8d2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc
mov eax, dword [ebx + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 5
push esp
call sub.shell32.dll_ShellExecuteExA
add esp, 0x3c
pop ebx
ret
Function at 0x484e3c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x484fa6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a8ee4]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x4a8ee4]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0045f19c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00469f54
xor edx, edx
push ebp
push 0x484f89
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x484ef9
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.00406154
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
call fcn.00482fa4
push eax
mov eax, dword [0x4a8d2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x484eef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00403e50
jmp 0x484f90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x484f35
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00469b34
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00484ccc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x484f11
push 0
mov edx, 0x484c64
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.004696ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484f90
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00469fa0
mov eax, dword [0x4a8ee4]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.0045f19c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484fad
lea eax, [ebp - 0x10]
call fcn.00406154
ret
Function at 0x48baac
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x48bada
mov eax, ebx
call fcn.0048c564
cmp dword [ebx + 0x3c], 0
je 0x48bad3
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x48bb4b
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x48bb3d
cmp dword [ebx + 8], 0
je 0x48bafc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x48bb0e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x48bb3d
cmp dword [ebx + 8], 0
je 0x48baef
cmp eax, 3
je 0x48bb21
dec eax
jne 0x48baef
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48baef
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x48baef
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x48bb69
cmp dword [ebx + 0x10], 0xcc
je 0x48bb69
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0048bb74
pop ebx
ret
Function at 0x404de5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408688
cmp edx, dword [eax]
je 0x404e07
add eax, 8
inc ecx
cmp eax, 0x408718
jl 0x404df8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408688]
jne 0x404f35
mov eax, dword [0x408a48]
cmp eax, 1
je 0x404f0f
test eax, eax
jne 0x404e38
cmp dword [0x4085d4], 1
je 0x404f0f
cmp edx, 0xfc
je 0x404f35
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404e6f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004032f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004033f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404eb2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004033f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4065d0
push edi
call fcn.00405720
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004032f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403300
lea eax, [ebp - 0xa0]
push 0x4065b0
push eax
call fcn.00403300
push dword [esi + 0x40868c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403300
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405697
add esp, 0x2c
pop edi
jmp 0x404f35
lea eax, [ebp + 8]
lea esi, [esi + 0x40868c]
push 0
push eax
push dword [esi]
call fcn.004033f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x4fcf5b89
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x4a4d4f4e
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x41ba71
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x41ba71
lcall 0x5de5, 0x8b10c483
jmp loc.0096a688
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x4015b0
Capabilities:
Read file on windows

Disassembly:
push ebp
sub edx, 0x58
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcr100.dll_fseek
test eax, eax
jne 0x401620
mov eax, dword [ebx]
lea esi, [ebx + 0x10]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x58
mov dword [esp], esi
mov dword [esp + 0xc], eax
call sub.msvcr100.dll_fread
test eax, eax
je 0x401620
mov edi, str.MEI_f_v_n_v
mov ecx, 8
repe cmpsb byte [esi], byte es:[edi]
setne al
lea esp, [ebp - 0xc]
movzx eax, al
pop ebx
neg eax
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4018d0
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov ebx, dword [ecx]
mov edi, dword [ecx + 4]
mov dword [esp], ebx
mov dword [esp + 4], edi
call fcn.00401680
mov dword [esp], ebx
mov esi, eax
call fcn.00404b90
cmp eax, 0xffffffff
je 0x40196a
lea eax, [edi + 0x12]
add ebx, 0x2068
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [ebp - 0x20], eax
call fcn.00404e70
mov ebx, eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ntohl]
sub esp, 4
test ebx, ebx
je 0x40199a
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [ebp - 0x1c], eax
call sub.msvcr100.dll_fwrite
cmp eax, 1
je 0x401958
mov edx, dword [ebp - 0x1c]
test edx, edx
jne 0x401980
mov dword [esp], ebx
call sub.msvcr100.dll_fclose
mov dword [esp], esi
call sub.msvcr100.dll_free
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword [ebp - 0x20]
mov dword [esp], str.Failed_to_write_all_bytes_for__s_n
mov dword [esp + 4], eax
call fcn.00401ee0
mov eax, 0xffffffff
jmp 0x40196a
mov eax, dword [ebp - 0x20]
mov dword [esp], str._s_could_not_be_extracted__n
mov dword [esp + 4], eax
call fcn.00401ee0
mov eax, 0xffffffff
jmp 0x40196a
Function at 0x404aa0
Capabilities:
Create directory
Get common file path

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
mov eax, 0x2048
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
call fcn.0040acf0
mov ebx, 5
sub esp, eax
mov eax, dword [ecx]
lea edi, [ebp - 0x2018]
mov dword [esp], 0x1000
mov dword [esp + 4], edi
mov dword [ebp - 0x203c], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub esp, 8
call sub.msvcr100.dll__getpid
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x2038]
mov dword [esp + 8], str._MEI_d
mov dword [esp + 4], 0x10
mov dword [esp], eax
call fcn.004048d0
lea eax, [ebp - 0x2038]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.msvcr100.dll__wtempnam]
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.msvcr100.dll__wmkdir]
test eax, eax
je 0x404b50
mov dword [esp], esi
call sub.msvcr100.dll_free
sub ebx, 1
jne 0x404b0b
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword [ebp - 0x203c]
mov dword [esp + 4], esi
mov dword [esp + 8], 0x1000
mov dword [esp], eax
call fcn.004055b0
mov dword [esp], esi
call sub.msvcr100.dll_free
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret

Function at 0x404bf0
Capabilities:
Delete directory

Disassembly:
push ebp
mov eax, 0x4450
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
call fcn.0040acf0
sub esp, eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], eax
lea eax, [esp + 0x244e]
mov dword [esp], eax
call fcn.00405770
lea eax, [esp + 0x244e]
mov dword [esp + 4], eax
lea eax, [esp + 0x44c]
mov dword [esp], eax
call sub.msvcr100.dll_wcscpy
lea eax, [esp + 0x44c]
mov dword [esp], eax
call sub.msvcr100.dll_wcslen
mov dword [esp + 0x228], eax
movzx eax, word [esp + eax*2 + 0x44a]
cmp ax, 0x5c
je 0x404c6b
cmp ax, 0x2f
jne 0x404d30
lea eax, [esp + 0x44c]
mov dword [esp + 4], 0x40e2e4
lea ebx, [esp + 0x230]
mov dword [esp], eax
call sub.msvcr100.dll_wcscat
lea eax, [esp + 0x44c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.msvcr100.dll__wfindfirst32]
cmp eax, 0xffffffff
mov dword [esp + 0x22c], eax
je 0x404d16
mov edi, esp
mov esi, ebx
mov ecx, 0x87
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x44c]
mov edx, dword [esp + 0x228]
call fcn.00404d60
jmp 0x404cee
mov edi, esp
mov esi, ebx
mov ecx, 0x87
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x44c]
mov edx, dword [esp + 0x228]
call fcn.00404d60
mov eax, dword [esp + 0x22c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.msvcr100.dll__wfindnext32]
test eax, eax
je 0x404cd0
mov eax, dword [esp + 0x22c]
mov dword [esp], eax
call dword [sym.imp.msvcr100.dll__findclose]
lea eax, [esp + 0x244e]
mov dword [esp], eax
call dword [sym.imp.msvcr100.dll__wrmdir]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x44c]
mov dword [esp + 4], 0x40e2e0
mov dword [esp], eax
call sub.msvcr100.dll_wcscat
add dword [esp + 0x228], 1
jmp 0x404c6b
Function at 0x404d60
Capabilities:
Delete file

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1038
call fcn.0040acf0
sub esp, eax
lea ebx, [edi + 0x14]
mov dword [ebp - 0x102c], edx
mov eax, dword [esp + eax]
mov dword [esp + 4], 0x40e2e8
mov dword [esp], ebx
mov esi, eax
call sub.msvcr100.dll_wcscmp
test eax, eax
jne 0x404db0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov dword [esp + 4], 0x40e2ec
mov dword [esp], ebx
call sub.msvcr100.dll_wcscmp
test eax, eax
je 0x404da0
mov eax, dword [ebp - 0x102c]
xor edx, edx
mov dword [esp + 4], ebx
mov dword [esp], esi
mov word [esi + eax*2], dx
call sub.msvcr100.dll_wcscat
test byte [edi], 0x10
jne 0x404e10
mov dword [esp], esi
mov ebx, dword [sym.imp.msvcr100.dll__wremove]
call ebx
test eax, eax
je 0x404da0
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
mov dword [esp], esi
call ebx
jmp 0x404da0
lea ebx, [ebp - 0x1019]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004055b0
mov dword [esp], ebx
call fcn.00404bf0
jmp 0x404da0

Function at 0x404e70
Capabilities:
Create directory

Disassembly:
push ebp
mov eax, 0x4050
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
call fcn.0040acf0
sub esp, eax
mov eax, dword [ebp + 8]
lea ebx, [esp + 0x50]
lea esi, [esp + 0x1050]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcr100.dll_strcpy
mov eax, dword [ebp + 0xc]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcr100.dll_strcpy
mov dword [esp], esi
mov dword [esp + 4], 0x40e2f2
lea esi, [esp + 0x2050]
call sub.msvcr100.dll_strtok
mov edi, eax
lea eax, [esp + 0x2c]
test edi, edi
mov dword [esp + 0x18], eax
mov eax, dword [sym.imp.msvcr100.dll__wstat32]
mov dword [esp + 0x1c], eax
je 0x404f80
mov ecx, ebx
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x404ee2
mov eax, edx
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea eax, [ecx + 2]
cmove ecx, eax
add dl, dl
sbb ecx, 3
sub ecx, ebx
lea eax, [ebx + ecx + 1]
mov byte [ebx + ecx], 0x5c
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcr100.dll_strcpy
mov dword [esp + 4], 0x40e2f2
mov dword [esp], 0
call sub.msvcr100.dll_strtok
test eax, eax
mov edi, eax
je 0x404f80
mov dword [esp + 8], 0x1000
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00405770
mov eax, dword [esp + 0x18]
mov dword [esp], esi
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
call eax
test eax, eax
jns 0x404ee0
mov dword [esp], esi
call dword [sym.imp.msvcr100.dll__wmkdir]
jmp 0x404ee0
mov dword [esp + 8], 0x1000
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00405770
mov eax, dword [esp + 0x18]
mov dword [esp], esi
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
call eax
test eax, eax
je 0x404fc1
mov dword [esp], ebx
mov dword [esp + 4], 0x40e325
call fcn.004031b0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
mov dword [esp], str.WARNING:_file_already_exists_but_should_not:__s_n
call fcn.00401f50
jmp 0x404fa9