joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403bd0
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub esp, 0x458
push ebp
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], eax
mov ecx, 0xff
mov dword [esp + 0x14], eax
lea edi, [esp + 0x65]
mov dword [esp + 0x18], eax
lea edx, [esp + 0x64]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x64], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x468]
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x20], 0x44
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x64]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x414428
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x474]
mov ecx, ebp
and ecx, 3
test edx, edx
rep movsb byte es:[edi], byte [esi]
je 0x403ca3
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x403ca3
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebp, [esp + 0x64]
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x403cdc
mov al, byte [esp + 0x46c]
lea edx, [esp + 0x64]
test al, al
mov edi, str.__register
jne 0x403cbc
mov edi, str.__unregister
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
lea edx, [esp + 0x80]
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403d73
mov eax, dword [esp + 0x470]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x403d4f
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
jmp 0x403d5d
mov edx, dword [esp + 0x10]
xor esi, esi
push esi
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x458
ret 0x10
Function at 0x404070
Capabilities:
Query service status
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x40fbe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebp
push esi
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0
call sub.MFC42.DLL_CString::TrimLeft
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CString::TrimRight
mov eax, dword [esp + 0x38]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4040d5
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
call fcn.0040f288
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
jne 0x404110
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
call fcn.0040f288
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
mov ecx, dword [esp + 0x38]
push 0xf003f
push ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
mov byte [esp + 8], 0
test esi, esi
jne 0x404175
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x40413e
mov byte [esp + 8], 1
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [esp + 8]
lea ecx, [esp + 0x38]
and esi, 0xff
mov dword [esp + 0x30], 0xffffffff
call fcn.0040f288
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4041c1
cmp dword [esp + 0x10], 1
jne 0x4041c1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebp
call esi
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
call fcn.0040f288
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
push ebx
lea eax, [esp + 0x10]
push edi
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40420f
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x63
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4041f7
cmp dword [esp + 0x18], 1
je 0x40420a
push 0x1f4
mov byte [esp + 0x14], 0
call ebx
dec edi
test edi, edi
jg 0x4041e0
jmp 0x40420f
mov byte [esp + 0x10], 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebp
call esi
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x40]
and esi, 0xff
mov dword [esp + 0x38], 0xffffffff
call fcn.0040f288
mov ecx, dword [esp + 0x30]
pop edi
mov eax, esi
pop ebx
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x4077e0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
lea ecx, [esp + 4]
mov dword [esp + 8], eax
lea edx, [esp + 0x14]
mov dword [esp + 0xc], eax
push ecx
push edx
push eax
push eax
push 0x8000020
push eax
push eax
mov dword [esp + 0x2c], eax
push eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], 0x44
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
jne 0x407836
or eax, 0xffffffff
add esp, 0x54
ret
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x407867
mov ecx, dword [esp]
push esi
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
pop esi
xor eax, eax
add esp, 0x54
ret
mov ecx, dword [esp]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
add esp, 0x54
ret
Function at 0x407cb0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x407cdd
cmp byte [ecx + ebx - 1], 0x5c
jne 0x407cdd
mov byte [ecx + ebx - 1], 0
mov edi, 0x4143b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
ret

Function at 0x407e50
Capabilities:
Move file

Disassembly:
sub esp, 0x108
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x110]
lea eax, [esp + 8]
push eax
push 1
push 0x414418
push 0x41441c
push ecx
call fcn.00407d10
add esp, 0x14
test eax, eax
pop edi
jne 0x407ea6
add esp, 0x108
ret
push esi
lea ecx, [esp + 4]
call fcn.00401130
lea edx, [esp + 8]
lea ecx, [esp + 4]
push edx
call fcn.00401140
push 0
push 0x4119e8
mov esi, eax
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jne 0x407ef1
push 0x416344
push 0x4119e8
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
mov eax, esi
pop esi
add esp, 0x108
ret
xor esi, esi
mov eax, esi
pop esi
add esp, 0x108
ret
Function at 0x408320
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x30c
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push 0x4119d8
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x416344
lea eax, [esp + 0x10]
push str._s_s
push eax
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11d]
mov byte [esp + 0x11c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x11c]
push 0x103
push ecx
stosb byte es:[edi], al
call fcn.00407770
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x229]
mov byte [esp + 0x228], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0x18
lea edx, [esp + 0x10c]
stosb byte es:[edi], al
push 0x4119d8
push edx
lea eax, [esp + 0x218]
push str._s_s
push eax
call esi
lea ecx, [esp + 0x18]
push 0
push ecx
call dword [sym.imp.MSVCRT.dll__access]
add esp, 0x18
test eax, eax
pop edi
pop esi
jne 0x4083e1
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp]
push 0
lea ecx, [esp + 0x20c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x30c
ret
Function at 0x408400
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x410
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x114]
push 0x103
rep stosd dword es:[edi], eax
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x114]
test ecx, ecx
je 0x4085bd
lea edi, [esp + 0x114]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4085bd
mov ecx, 0x40
lea edi, [esp + 0x11]
mov byte [esp + 0x10], al
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x114]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x14]
push str._s_rzxinstall.log
push eax
call ebp
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x225]
mov byte [esp + 0x224], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, dword [sym.imp.MSVCRT.dll_time]
mov ecx, 0x41
stosb byte es:[edi], al
xor eax, eax
lea edi, [esp + 0x224]
rep stosd dword es:[edi], eax
push eax
call ebx
add esp, 0x10
lea ecx, [esp + 0x114]
lea edx, [esp + 0x218]
push eax
push ecx
push str._s_rzxinstall.log__d
push edx
call ebp
lea eax, [esp + 0x228]
push 0x415984
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x4085bd
push esi
push 0x416344
call dword [sym.imp.MSVCRT.dll_fputs]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
lea ecx, [esp + 0x1c]
push 0
push ecx
call dword [sym.imp.MSVCRT.dll__access]
mov esi, dword [sym.imp.MSVCRT.dll_rename]
add esp, 0x14
test eax, eax
jne 0x40859b
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x31d]
mov byte [esp + 0x31c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x31c]
push eax
rep stosd dword es:[edi], eax
call ebx
add esp, 4
lea edx, [esp + 0x10]
push eax
push edx
lea eax, [esp + 0x324]
push str._s_bak._d
push eax
call ebp
lea ecx, [esp + 0x32c]
lea edx, [esp + 0x20]
push ecx
push edx
call esi
add esp, 0x18
lea eax, [esp + 0x10]
lea ecx, [esp + 0x218]
push eax
push ecx
call esi
add esp, 8
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x410
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x410
ret
Function at 0x408890
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x32c
push ebx
mov ebx, dword [esp + 0x334]
push ebp
push esi
test ebx, ebx
push edi
jne 0x4088b2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x32c
ret
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x13d]
mov byte [esp + 0x13c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x13c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, dword [sym.imp.MSVCRT.dll_tolower]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x408942
mov eax, ebx
lea ecx, [esp + 0x13c]
sub eax, ecx
mov dword [esp + 0x10], eax
jmp 0x40891e
mov eax, dword [esp + 0x10]
lea edi, [esp + esi + 0x13c]
movsx edx, byte [eax + edi]
push edx
call ebp
mov byte [edi], al
add esp, 4
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jb 0x40891a
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40895f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x32c
ret
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x10], 1
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x128
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4089fb
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4089bf
movsx ecx, byte [esp + esi + 0x38]
push ecx
call ebp
mov byte [esp + esi + 0x3c], al
add esp, 4
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jb 0x40899d
lea edx, [esp + 0x13c]
lea eax, [esp + 0x38]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4089ea
lea ecx, [esp + 0x14]
push ecx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4089fb
jmp 0x40898b
mov edx, dword [esp + 0x1c]
push edx
call fcn.00408ad0
add esp, 4
mov dword [esp + 0x10], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x32c
ret
Function at 0x408ad0
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411a10
push 0x40f520
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x20]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x408b34
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nOpen_Current_Process_Token_failed:_d
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
jmp 0x408ba3
push 1
push str.SeDebugPrivilege
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00408a20
add esp, 0xc
mov edi, dword [ebp + 8]
push edi
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, ebx
jne 0x408b78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._nOpen_Process__d_failed:_d
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 0xc
jmp 0x408ba3
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x408b9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nTerminateProcess_failed:_d
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
jmp 0x408ba3
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
call fcn.00408bc8
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409080
Capabilities:
Create directory

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
test eax, eax
jne 0x40908f
xor al, al
pop esi
pop ecx
ret
push eax
call dword [sym.imp.MSVCRT.dll__strdup]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4090a4
xor al, al
pop esi
pop ecx
ret
push ebx
push ebp
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor ebp, ebp
mov edx, ecx
mov byte [esp + 0x18], 1
test edx, edx
mov dword [esp + 0x10], edx
jle 0x409127
mov bl, byte [esi + ebp]
cmp bl, 0x5c
je 0x4090d1
cmp bl, 0x2f
jne 0x409106
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov byte [esi + ebp], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x409106
push eax
push esi
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
cmp eax, 0xffffffff
jne 0x409102
push esi
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
cmp eax, 0xffffffff
je 0x409122
mov edx, dword [esp + 0x10]
mov byte [esi + ebp], bl
inc ebp
cmp ebp, edx
jl 0x4090c4
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov al, byte [esp + 0x1c]
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
mov byte [esp + 0x18], 0
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov al, byte [esp + 0x1c]
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
Function at 0x409960
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
pop edi
jl 0x4099fe
mov edx, dword [esp + 0x110]
lea ecx, [esp + 4]
push ecx
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x4099f4
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x4099e5
mov edx, dword [esp + 0x118]
mov ecx, dword [esp + 0x114]
lea eax, [esp + 8]
push edx
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov eax, 1
add esp, 0x10c
ret 0xc
mov eax, dword [esp]
mov ecx, dword [esp + 4]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp]
push eax
mov edx, dword [eax]
call dword [edx + 8]
xor eax, eax
add esp, 0x10c
ret 0xc

Function at 0x40b5a0
Capabilities:
Create directory
Set file attributes

Disassembly:
sub esp, 0x64
push ebx
mov ebx, dword [esp + 0x6c]
push esi
push edi
mov esi, ecx
push ebx
call fcn.0040b4f0
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 0xc0]
lea ecx, [esp + 0xc]
push eax
push str._temp_ld_
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__access]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x40b629
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
pop ebx
add esp, 0x64
ret 4
Function at 0x40bd40
Capabilities:
Get common file path

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
push 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
movsx ecx, byte [esp + 4]
mov edx, dword [esp + 0x40c]
mov eax, dword [esp + 0x408]
push ecx
push str._c:Program_Files
push edx
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
pop edi
add esp, 0x400
ret 8

Function at 0x40bf00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ff40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push esi
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], esp
call fcn.0040f31e
mov eax, dword [0x41644c]
push 0
push 0x3021
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CFile::Open
test eax, eax
je 0x40c07d
mov edx, dword [ebp - 0x2c]
push 2
push 0
lea ecx, [ebp - 0x2c]
call dword [edx + 0x30]
lea eax, [ebp - 0x1c]
push eax
call sub.MFC42.DLL_CTime::GetTickCount
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
push 0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CTime::GetLocalTm
mov edx, dword [eax]
push 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x30], edx
call sub.MFC42.DLL_CTime::GetLocalTm
mov eax, dword [eax + 4]
push 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x1c], eax
call sub.MFC42.DLL_CTime::GetLocalTm
mov ebx, dword [eax + 8]
push 0
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CTime::GetLocalTm
mov edi, dword [eax + 0xc]
push 0
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CTime::GetLocalTm
mov esi, dword [eax + 0x10]
push 0
lea ecx, [ebp - 0x14]
inc esi
call sub.MFC42.DLL_CTime::GetLocalTm
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x30]
mov eax, dword [eax + 0x14]
push ecx
mov ecx, dword [ebp - 0x1c]
push edx
push ecx
push ebx
add eax, 0x76c
push edi
push esi
push eax
lea edx, [ebp - 0x18]
push str._04d__02d__02d__02d:_02d:_02d____s_r_n
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [ebp - 0x18]
add esp, 0x24
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CFile::Write
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CFile::Flush
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CFile::Close
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0040f288
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CFile::CFile
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CFile::CFile
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40f58c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4124c0
push 0x40f520
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x416484], 0xffffffff
or dword [0x416488], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x416468]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x416464]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x416480], eax
call fcn.0040f6cf
cmp dword [0x416328], 0
jne 0x40f60f
push 0x40f6cc
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0040f6ba
push 0x414014
push 0x414010
call sub.MSVCRT.dll__initterm
mov eax, dword [0x416460]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x41645c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x41400c
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.004085d0
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret