joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3459
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4b8494
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4cb6c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0049f1ef
mov dword [ebp - 0x14], eax
cmp dword [0xaca86c], esi
jne 0x4b8587
push 0x800
push esi
push 0xabf48c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4b8514
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4b8667
push esi
push esi
push 0xabf48c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4b8667
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b8667
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xaca86c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xaca870], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xaca874], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaca87c], eax
test eax, eax
je 0x4b8584
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaca878], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4b85ac
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4b859f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4b85c1
push 4
pop eax
jmp 0x4b8669
cmp dword [ebp - 0x14], esi
je 0x4b85c1
push dword [0xaca86c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4b85a6
mov eax, dword [0xaca878]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4b861f
cmp dword [0xaca87c], edi
je 0x4b861f
push eax
call ebx
push dword [0xaca87c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4b861f
test eax, eax
je 0x4b861f
call ecx
test eax, eax
je 0x4b8614
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4b8614
test byte [ebp - 8], 1
jne 0x4b861f
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4b864f
mov eax, dword [0xaca870]
cmp eax, edi
je 0x4b864c
push eax
call ebx
test eax, eax
je 0x4b864c
call eax
mov esi, eax
test esi, esi
je 0x4b864c
mov eax, dword [0xaca874]
cmp eax, edi
je 0x4b864c
push eax
call ebx
test eax, eax
je 0x4b864c
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xaca86c]
call ebx
test eax, eax
je 0x4b8667
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4b8669
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049e2fb
mov esp, ebp
pop ebp
ret
Function at 0x404ed0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.CAudio.0
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x44]
test edx, edx
je 0x404f57
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.WINMM.dll_waveInStop]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.WINMM.dll_waveInReset]
mov dword [ebp - 0xc], 0
jmp 0x404f19
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 2
jge 0x404f3b
push 0x20
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx*4 + 0x30]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.WINMM.dll_waveInUnprepareHeader]
jmp 0x404f10
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.WINMM.dll_waveInClose]
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x45]
test eax, eax
je 0x404fb0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.WINMM.dll_waveOutReset]
mov dword [ebp - 0x10], 0
jmp 0x404f81
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x404fa3
push 0x20
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x30]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
jmp 0x404f78
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.WINMM.dll_waveOutClose]
mov dword [ebp - 8], 0
jmp 0x404fc2
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 2
jge 0x405034
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax*4 + 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.mfc140u.dll_operator]
add esp, 4
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x30]
mov dword [ebp - 0x18], eax
push 0x20
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00410307
add esp, 8
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx*4 + 0x10]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.mfc140u.dll_operator]
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax*4 + 0x38]
mov dword [ebp - 0x20], edx
push 0x20
mov eax, dword [ebp - 0x20]
push eax
call fcn.00410307
add esp, 8
jmp 0x404fb9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x405100
Capabilities:
Capture microphone audio
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
test eax, eax
jne 0x40511a
xor al, al
jmp 0x405233
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 4
mov ecx, dword [ebp - 4]
push ecx
push 0x405240
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
push 0x20000
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x46
push ecx
push 0xffff
mov edx, dword [ebp - 4]
add edx, 0x18
push edx
call dword [sym.imp.WINMM.dll_waveInOpen]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x405174
xor al, al
jmp 0x405233
mov dword [ebp - 8], 0
jmp 0x405186
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x4051f3
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x30]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx*4 + 8]
mov dword [eax], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx*4 + 0x30]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x30]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x30]
mov dword [eax + 0x14], 0
push 0x20
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x30]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
jmp 0x40517d
push 0x20
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x30]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x44], 1
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x405ad0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x405b00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret
Function at 0x4068b0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41a014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x208], ecx
mov eax, dword [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ecx, dword [ebp - 0x208]
mov dword [ecx + 0x2c], 0x101
mov edx, dword [ebp - 0x208]
mov eax, dword [ebp - 0x208]
mov ecx, dword [eax + 0x44]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x208]
mov eax, dword [ebp - 0x208]
mov ecx, dword [eax + 0x48]
mov dword [edx + 0x40], ecx
mov edx, dword [ebp - 0x208]
mov eax, dword [ebp - 0x208]
mov ecx, dword [eax + 0x48]
mov dword [edx + 0x3c], ecx
xor edx, edx
mov eax, dword [ebp - 0x208]
mov word [eax + 0x30], dx
xor ecx, ecx
mov word [ebp - 0x204], cx
push 0x1fe
push 0
lea edx, [ebp - 0x202]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x200
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x415364
lea ecx, [ebp - 0x204]
push ecx
call fcn.00406ca0
add esp, 8
mov edx, dword [ebp - 0x208]
add edx, 0x54
push edx
mov eax, dword [ebp - 0x208]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x4069b2
push str.cmd.exe
call fcn.00406d00
add esp, 4
mov edx, dword [ebp - 0x208]
mov eax, dword [edx + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004102f6
mov esp, ebp
pop ebp
ret
Function at 0x4069d0
Capabilities:
Create pipe
Create two anonymous pipes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1830
call fcn.00411250
mov eax, dword [0x41a014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x1814], ecx
mov dword [ebp - 0x1818], 0
mov byte [ebp - 0x404], 0
push 0x3ff
push 0
lea eax, [ebp - 0x403]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x1824], 0xc
mov dword [ebp - 0x1820], 0
mov dword [ebp - 0x181c], 1
push 0
lea ecx, [ebp - 0x1824]
push ecx
mov edx, dword [ebp - 0x1814]
add edx, 0x48
push edx
mov eax, dword [ebp - 0x1814]
add eax, 0x4c
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x1830], 0xc
mov dword [ebp - 0x182c], 0
mov dword [ebp - 0x1828], 1
push 0
lea ecx, [ebp - 0x1830]
push ecx
mov edx, dword [ebp - 0x1814]
add edx, 0x50
push edx
mov eax, dword [ebp - 0x1814]
add eax, 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0x1004
push 0
lea ecx, [ebp - 0x180c]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x180c], 0x16
mov edx, 1
test edx, edx
je 0x406b8f
push 0x400
push 0
lea eax, [ebp - 0x404]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
lea ecx, [ebp - 0x1818]
push ecx
push 0x3ff
lea edx, [ebp - 0x404]
push edx
mov eax, dword [ebp - 0x1814]
mov ecx, dword [eax + 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406b09
jmp 0x406b8f
push 0x404
push 0
lea edx, [ebp - 0x808]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push 0x400
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
mov dword [ebp - 0x808], 0
mov ecx, 0x101
lea esi, [ebp - 0x808]
lea edi, [ebp - 0x1808]
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x180d], 1
lea edx, [ebp - 0x180d]
push edx
push 0x1004
lea eax, [ebp - 0x180c]
push eax
mov ecx, dword [ebp - 0x1814]
mov edx, dword [ecx + 0x64]
push edx
mov ecx, dword [ebp - 0x1814]
add ecx, 0x68
call fcn.0040a000
jmp 0x406ab8
push str.CMD_Send_Thread_Over__n
call fcn.00406d00
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004102f6
mov esp, ebp
pop ebp
ret
Function at 0x406bb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], str.exit_r_n
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx]
mov byte [ebp - 1], dl
mov eax, dword [ebp - 0x10]
cmp dl, byte [eax]
jne 0x406c0a
cmp byte [ebp - 1], 0
je 0x406c01
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 1]
mov byte [ebp - 2], dl
mov eax, dword [ebp - 0x10]
cmp dl, byte [eax + 1]
jne 0x406c0a
add dword [ebp - 0xc], 2
add dword [ebp - 0x10], 2
cmp byte [ebp - 2], 0
jne 0x406bcd
mov dword [ebp - 0x18], 0
jmp 0x406c12
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
jne 0x406c38
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 3], cl
add dword [ebp - 8], 1
cmp byte [ebp - 3], 0
jne 0x406c47
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x28], edx
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x406c93
push 0x41541c
call fcn.00406d00
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x406dc0
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1064
call fcn.00411250
mov eax, dword [0x41a014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x1048], ecx
cmp dword [ebp + 8], 0xffffffff
jne 0x406dea
jmp 0x407013
mov eax, 0x42
mov word [ebp - 0x1034], ax
jmp 0x406e0a
mov cx, word [ebp - 0x1034]
add cx, 1
mov word [ebp - 0x1034], cx
movzx edx, word [ebp - 0x1034]
cmp edx, 0x5a
jg 0x407013
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
push 0x1004
push 0
lea ecx, [ebp - 0x1030]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x105c], xmm0
xorps xmm0, xmm0
movlpd qword [ebp - 0x1054], xmm0
xorps xmm0, xmm0
movlpd qword [ebp - 0x1064], xmm0
mov dx, word [ebp - 0x1034]
mov word [ebp - 0xc], dx
mov eax, 0x3a
mov word [ebp - 0xa], ax
xor ecx, ecx
mov word [ebp - 8], cx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x1040], eax
mov eax, dword [ebp - 0x1040]
mov dword [ebp - 0x103c], eax
cmp dword [ebp - 0x103c], 2
je 0x406ec7
cmp dword [ebp - 0x103c], 3
je 0x406ebe
cmp dword [ebp - 0x103c], 5
je 0x406ed0
jmp 0x406ed9
mov dword [ebp - 0x14], 0
jmp 0x406ede
mov dword [ebp - 0x14], 1
jmp 0x406ede
mov dword [ebp - 0x14], 2
jmp 0x406ede
jmp 0x406df8
mov cx, word [ebp - 0x1034]
mov word [ebp - 0x2c], cx
lea edx, [ebp - 0x1064]
push edx
lea eax, [ebp - 0x1054]
push eax
lea ecx, [ebp - 0x105c]
push ecx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [ebp - 0x1044], eax
cmp dword [ebp - 0x1044], 0
je 0x406f75
mov edx, dword [ebp - 0x1050]
mov ecx, dword [ebp - 0x1054]
call fcn.00411590
divsd xmm0, qword [0x416c50]
divsd xmm0, qword [0x416c50]
divsd xmm0, qword [0x416c50]
movsd qword [ebp - 0x24], xmm0
mov edx, dword [ebp - 0x1058]
mov ecx, dword [ebp - 0x105c]
call fcn.00411590
divsd xmm0, qword [0x416c50]
divsd xmm0, qword [0x416c50]
divsd xmm0, qword [0x416c50]
movsd qword [ebp - 0x1c], xmm0
jmp 0x406f8f
movsd xmm0, qword [0x416c30]
movsd qword [ebp - 0x24], xmm0
movsd xmm0, qword [0x416c30]
movsd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1030], 3
mov ecx, 8
lea esi, [ebp - 0x2c]
lea edi, [ebp - 0x102c]
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x1035], 1
lea eax, [ebp - 0x1035]
push eax
push 0x1004
lea ecx, [ebp - 0x1030]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x1048]
call fcn.0040a000
mov dword [ebp - 0x104c], eax
movzx eax, byte [ebp - 0x1035]
test eax, eax
jne 0x406ff9
mov ecx, dword [ebp - 0x104c]
push ecx
push 0x415430
call fcn.00406d00
add esp, 8
jmp 0x40700e
movzx edx, word [ebp - 0x1034]
push edx
push 0x415454
call fcn.00406d00
add esp, 8
jmp 0x406df8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004102f6
mov esp, ebp
pop ebp
ret 4
Function at 0x407580
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov byte [ebp - 2], 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0xc
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
jne 0x4075c1
mov byte [ebp - 1], 1
jmp 0x4075c5
mov byte [ebp - 1], 0
mov cl, byte [ebp - 1]
mov byte [ebp - 2], cl
mov edx, dword [ebp + 0xc]
mov al, byte [ebp - 2]
mov byte [edx], al
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov esp, ebp
pop ebp
ret 8
Function at 0x407b60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411819
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x41a014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_8182]
movzx eax, al
test eax, eax
je 0x407bd2
mov dword [ebp - 0x14], 0x57
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, dword [ebp - 0x18]
jmp 0x407c54
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x407c16
push 0x415554
call fcn.00406d00
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], edx
push 0x418038
lea eax, [ebp - 0x1c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
jmp 0x407c23
push 0x415564
call fcn.00406d00
add esp, 4
jmp 0x407c2b
mov dword [ebp - 4], 0
jmp 0x407c3b
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x407c70
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x407ca1
push 0x415574
call fcn.00406d00
add esp, 4
jmp 0x407cae
push 0x415588
call fcn.00406d00
add esp, 4
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov esp, ebp
pop ebp
ret 4
Function at 0x408160
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41190b
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x41a014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
push 0x41560c
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
push 0x415610
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
add esp, 0xc
push 0x5c
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
add edx, 1
push edx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x24]
push edx
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x415618
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov byte [ebp - 4], 2
lea eax, [ebp + 0x210]
push eax
push 0x41561c
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
add esp, 0xc
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.00408790
add esp, 0xc
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea edx, [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x408262
push 0x415624
call fcn.00406d00
add esp, 4
jmp 0x40826f
push 0x415638
call fcn.00406d00
add esp, 4
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x414
Function at 0x409900
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1220
call fcn.00411250
mov eax, dword [0x41a014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x1220], ecx
push 0x20a
push 0
lea eax, [ebp - 0x210]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1004
push 0
lea ecx, [ebp - 0x1214]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x1214], 8
push 1
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0x415688
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x121c], eax
cmp dword [ebp - 0x121c], 0x20
jbe 0x409981
mov byte [ebp - 8], 1
jmp 0x409985
mov byte [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
mov ecx, 0x82
lea esi, [ebp - 0x210]
lea edi, [ebp - 0x1210]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov byte [ebp - 0x1215], 1
lea edx, [ebp - 0x1215]
push edx
push 0x1004
lea eax, [ebp - 0x1214]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x1220]
call fcn.0040a000
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004102f6
mov esp, ebp
pop ebp
ret 8