joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe40d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xe40d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xe40d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xe40d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xe40d94
push eax
push esi
call fcn.00e4320b
add esp, 8
pop esi
ret 0x10

Function at 0xe40da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xe40e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xe40e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xe59320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00e42dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xe40dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xe40e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xe40ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xe40eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xe59320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00e42dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xe40eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xe40e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xe41000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xe41131
push esi
call fcn.00e44145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00e33080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xe41131
push 0
push ebp
call fcn.00e333a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00e33260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xe4108b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00e332f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xe41121
push 0xe59918
push edi
call fcn.00e423f0
push eax
push ebx
push esi
call fcn.00e40f60
push 0xe598f8
push edi
call fcn.00e423f0
push eax
push ebx
push esi
call fcn.00e40f60
push 0xe598d8
push edi
call fcn.00e423f0
push eax
push ebx
push esi
call fcn.00e40f60
push 0xe598c0
push edi
call fcn.00e423f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00e40f60
push 0xe598a0
push edi
call fcn.00e423f0
push eax
push ebx
push esi
call fcn.00e40f60
push 0xe59888
push edi
call fcn.00e423f0
push eax
push ebx
push esi
call fcn.00e40f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xe421b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00e42140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00e42140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00e42140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00e42140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xe42bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xe42c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xe5487c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xe42c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xe42c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp int.00401219
Function at 0x40a0c0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x4f5470]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, ecx
push esi
push edi
lea edi, [ebx + 8]
push edi
call fcn.0040c5a0
add esp, 4
lea eax, [esp + 0x10]
lea esi, [ebx + 0xc]
mov ecx, esi
push eax
call fcn.004096c0
mov eax, dword [0x4f9f54]
test eax, eax
je 0x40a129
lea ecx, [esp + 0x10]
push ecx
push dword [ebx + 0xa0]
push dword [ebx + 0xa8]
push dword [ebx + 0xa4]
push dword [ebx]
call eax
add esp, 0x14
test al, al
jne 0x40a2ab
test byte [0x4f6a20], 2
je 0x40a149
cmp dword [esp + 0x24], 0x10
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x40a14e
cmp dword [ebx], 2
jl 0x40a189
cmp dword [esp + 0x24], 0x10
lea edi, [esp + 0x10]
mov esi, dword [esp + 0x20]
cmovae edi, dword [esp + 0x10]
call fcn.004aa90c
add eax, 0x40
push eax
push 1
push esi
push edi
call fcn.004aad31
call fcn.004aa90c
add eax, 0x40
push eax
call fcn.004aaa9b
lea edi, [ebx + 8]
add esp, 0x14
lea esi, [ebx + 0xc]
test byte [0x4f6a20], 1
je 0x40a228
xor edx, edx
xor ecx, ecx
call fcn.00409a70
cmp dword [0x4f9f44], 0
jne 0x40a1b8
push 0xffffffffffffffff
push dword [0x4f9f3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40a1c4
push dword [0x4f9f38]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.00409be0
test al, al
je 0x40a205
push 2
push 0
push 0
push dword [0x4f9f34]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x24], 0x10
lea ecx, [esp + 0xc]
push 0
push ecx
push dword [esp + 0x28]
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
push eax
push dword [0x4f9f34]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [0x4f9f44], 0
jne 0x40a21c
push dword [0x4f9f3c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40a228
push dword [0x4f9f38]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebx], 3
jne 0x40a2ab
mov ecx, 0x400
lea eax, [esp + 0x10]
cmp dword [esp + 0x20], ecx
cmovb ecx, dword [esp + 0x20]
cmp dword [esp + 0x24], 0x10
cmovae eax, dword [esp + 0x10]
test ecx, ecx
je 0x40a25c
push ecx
push eax
lea eax, [esp + 0x48]
push eax
call fcn.004a7e60
add esp, 0xc
lea eax, [esp + 0x40]
push eax
call fcn.00426bb0
add esp, 4
cmp dword [0x4f9f50], 0
je 0x40a2a1
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.004096c0
lea eax, [esp + 0x28]
push eax
call dword [0x4f9f50]
add esp, 4
cmp dword [esp + 0x3c], 0x10
jb 0x40a2ab
push dword [esp + 0x28]
call fcn.004a733a
add esp, 4
jmp 0x40a2ab
cmp byte [0x4fa020], 0
jne 0x40a2f8
int3
cmp dword [esp + 0x24], 0x10
jb 0x40a2be
push dword [esp + 0x10]
call fcn.004a733a
add esp, 4
push dword [ebx + 0xac]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea esi, [edi + 0x50]
mov ecx, esi
call fcn.00406e60
push esi
mov dword [esi], 0x4ef9d8
call fcn.004ca1fb
mov ecx, dword [esp + 0x448]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a7e44
mov esp, ebp
pop ebp
ret
push 1
call fcn.004a9fbe
int3
Function at 0x40d070
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
cmp eax, 0x104
jb 0x40d08e
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x40d099
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
jne 0x40d0f1
lea ecx, [esp + 8]
call fcn.004182a0
lea eax, [esp + 8]
push eax
push esi
call fcn.0040de80
add esp, 8
test al, al
je 0x40d0da
cmp byte [esp + 0x10], 0
je 0x40d0da
cmp dword [esi + 0x14], 8
jb 0x40d0c9
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x40d0e4
mov eax, dword [esi]
jmp 0x40d0e6
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40d092
mov ecx, esi
call fcn.0040e2f0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d5e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x40d5ee
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x40d600
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x40d60e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40d622
shr eax, 4
and eax, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x40d630
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
mov eax, dword [0x4f5470]
xor eax, esp
mov dword [esp + 0x260], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x50]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x40d71e
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x3c]
call fcn.0040aa10
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x10]
call fcn.004055c0
mov ecx, eax
call fcn.00406120
cmp esi, eax
je 0x40d6a2
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00407ca0
cmp dword [esp + 0x34], 8
jb 0x40d6b5
push dword [esp + 0x20]
call fcn.004a733a
add esp, 4
xor eax, eax
mov dword [esp + 0x34], 7
cmp dword [esp + 0x1c], 8
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
jb 0x40d6df
push dword [esp + 8]
call fcn.004a733a
add esp, 4
xor eax, eax
mov dword [esp + 0x1c], 7
cmp dword [esp + 0x4c], 8
mov dword [esp + 0x18], 0
mov word [esp + 8], ax
jb 0x40d709
push dword [esp + 0x38]
call fcn.004a733a
add esp, 4
mov al, 1
pop esi
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.004a7e44
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x264]
xor al, al
pop esi
xor ecx, esp
call fcn.004a7e44
mov esp, ebp
pop ebp
ret
Function at 0x40d740
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x4f5470]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
mov esi, ecx
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40d7b1
cmp word [ebp - 0x210], 0
je 0x40d7b1
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.0040aa10
lea eax, [ebp - 0x228]
mov ecx, esi
push eax
call fcn.004055c0
cmp dword [ebp - 0x214], 8
jb 0x40d8b4
push dword [ebp - 0x228]
jmp 0x40d8ac
xor eax, eax
mov dword [ebp - 0x22c], 7
mov word [ebp - 0x240], ax
lea eax, [ebp - 0x240]
push eax
mov dword [ebp - 0x230], 0
call fcn.0040d630
add esp, 4
test al, al
je 0x40d80a
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov word [esi], ax
lea eax, [ebp - 0x240]
push eax
call fcn.00407ca0
jmp 0x40d89d
push 0x4efae4
lea ecx, [ebp - 0x228]
call fcn.0040aa10
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov word [esi], ax
lea eax, [ebp - 0x228]
push eax
call fcn.00407ca0
push 1
push 0
lea eax, [ebp - 0x244]
mov dword [ebp - 0x244], 0
push eax
mov ecx, esi
call fcn.00407e90
cmp eax, 0xffffffff
je 0x40d869
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.00406b60
cmp dword [ebp - 0x214], 8
jb 0x40d880
push dword [ebp - 0x228]
call fcn.004a733a
add esp, 4
xor eax, eax
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
cmp dword [ebp - 0x22c], 8
jb 0x40d8b4
push dword [ebp - 0x240]
call fcn.004a733a
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004a7e44
mov esp, ebp
pop ebp
ret
Function at 0x40d960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x4f5470]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x474], 0
cmp dword [ecx + 0x14], 8
push esi
mov esi, edx
jb 0x40d988
mov ecx, dword [ecx]
lea eax, [ebp - 0x218]
push eax
push 0
push 0x4efaec
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40d9b2
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7e44
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x104
ja 0x40da5f
test eax, eax
je 0x40da5f
xor ecx, ecx
mov dword [ebp - 0x444], 7
push eax
lea eax, [ebp - 0x428]
mov word [ebp - 0x458], cx
push eax
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x448], 0
call fcn.00408730
lea eax, [ebp - 0x458]
push eax
lea ecx, [ebp - 0x470]
call fcn.004055c0
cmp esi, eax
je 0x40da30
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00407ca0
cmp dword [ebp - 0x45c], 8
jb 0x40da47
push dword [ebp - 0x470]
call fcn.004a733a
add esp, 4
cmp dword [ebp - 0x444], 8
jb 0x40db37
push dword [ebp - 0x458]
jmp 0x40db2f
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x470]
call fcn.0040aa10
xor eax, eax
mov dword [ebp - 0x42c], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x440], ax
lea ecx, [ebp - 0x440]
lea eax, [ebp - 0x470]
mov dword [ebp - 0x430], 0
push eax
call fcn.00407ca0
push 1
push 0
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], 0
push eax
lea ecx, [ebp - 0x440]
call fcn.00407e90
cmp eax, 0xffffffff
je 0x40dad6
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x440]
call fcn.00406b60
lea eax, [ebp - 0x440]
cmp esi, eax
je 0x40daec
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00407ca0
cmp dword [ebp - 0x42c], 8
jb 0x40db03
push dword [ebp - 0x440]
call fcn.004a733a
add esp, 4
xor eax, eax
mov dword [ebp - 0x42c], 7
cmp dword [ebp - 0x45c], 8
mov dword [ebp - 0x430], 0
mov word [ebp - 0x440], ax
jb 0x40db37
push dword [ebp - 0x470]
call fcn.004a733a
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004a7e44
mov esp, ebp
pop ebp
ret
Function at 0x40db50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x4f5470]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [esp + 0x10], eax
xor eax, eax
push edi
mov dword [esp + 0xc], ecx
xor edi, edi
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jmp 0x40dba0
xor eax, eax
mov dword [esp + 0x38], 7
push 0xffffffffffffffff
push eax
push ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x40], 0
mov word [esp + 0x30], ax
call fcn.00407ca0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [esp + 0x54]
call fcn.0041cbd0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.00407bd0
cmp dword [esp + 0x68], 8
jb 0x40dbfa
push dword [esp + 0x54]
call fcn.004a733a
add esp, 4
cmp dword [esp + 0x38], 8
lea ecx, [esp + 0x24]
mov eax, dword [esp + 0x34]
cmovae ecx, dword [esp + 0x24]
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x24]
cmovae ecx, dword [esp + 0x24]
test eax, eax
je 0x40dc20
sub eax, ecx
sar eax, 1
push 0x5f
push 1
push eax
lea ecx, [esp + 0x30]
call fcn.0040e760
mov edi, edi
lea ecx, [esp + 0x18]
call fcn.0042cd00
cmp dword [esp + 0x1c], 0xffffffff
ja 0x40dc30
mov edx, dword [esp + 0x18]
jb 0x40dc4e
cmp edx, 0xffff7fff
ja 0x40dc30
and edx, 0x7fff
lea ecx, [esp + 0x54]
call fcn.0041cbd0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.00407bd0
cmp dword [esp + 0x68], 8
jb 0x40dc82
push dword [esp + 0x54]
call fcn.004a733a
add esp, 4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.00405dd0
lea ecx, [esp + 0x3c]
cmp ecx, eax
je 0x40dca7
push 0xffffffffffffffff
push 0
push eax
call fcn.00407ca0
cmp dword [esp + 0x68], 8
jb 0x40dcba
push dword [esp + 0x54]
call fcn.004a733a
add esp, 4
cmp dword [esp + 0x50], 8
lea eax, [esp + 0x3c]
push 0
cmovae eax, dword [esp + 0x40]
push eax
call ebx
test eax, eax
jne 0x40dcf6
cmp dword [esp + 0x38], 8
jb 0x40dce4
push dword [esp + 0x24]
call fcn.004a733a
add esp, 4
mov ecx, dword [esp + 0xc]
inc edi
cmp edi, 0x32
jl 0x40dba0
xor bl, bl
jmp 0x40dd23
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x3c]
cmp eax, ecx
je 0x40dd0e
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.00407ca0
cmp dword [esp + 0x38], 8
jb 0x40dd21
push dword [esp + 0x24]
call fcn.004a733a
add esp, 4
mov bl, 1
cmp dword [esp + 0x50], 8
jb 0x40dd36
push dword [esp + 0x3c]
call fcn.004a733a
add esp, 4
mov ecx, dword [esp + 0x6c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a7e44
mov esp, ebp
pop ebp
ret
Function at 0x40dd50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x4f5470]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], 0
cmp dword [edi + 0x14], 8
jb 0x40dd7f
mov ebx, dword [edi]
jmp 0x40dd81
mov ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ddc3
test al, 0x10
je 0x40dda5
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a7e44
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x40ddaf
mov dword [esi], 0xfffffff7
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a7e44
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.00405c20
cmp dword [edi + 0x14], 8
jb 0x40ddd9
mov eax, dword [edi]
jmp 0x40dddb
mov eax, edi
push dword [edi + 0x10]
lea ecx, [esp + 0x18]
push eax
push dword [esp + 0x2c]
push 0
call fcn.004080b0
test eax, eax
jne 0x40de00
test esi, esi
je 0x40de4d
mov dword [esi], 0xfffffffc
xor bl, bl
jmp 0x40de53
lea eax, [esp + 0x14]
push esi
push eax
call fcn.0040dd50
add esp, 8
test al, al
jne 0x40de16
xor bl, bl
jmp 0x40de53
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40de51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xb7
jne 0x40de40
push edi
call fcn.0040d600
add esp, 4
test al, al
jne 0x40de51
test esi, esi
je 0x40de4d
mov ecx, ebx
call fcn.00425120
mov dword [esi], eax
xor bl, bl
jmp 0x40de53
mov bl, 1
cmp dword [esp + 0x28], 8
jb 0x40de66
push dword [esp + 0x14]
call fcn.004a733a
add esp, 4
mov ecx, dword [esp + 0x2c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a7e44
mov esp, ebp
pop ebp
ret

Function at 0x40e060
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [esp + 0x10], 0
cmp dword [eax + 0x14], 8
push edi
mov edi, dword [ebp + 0x10]
jb 0x40e085
mov eax, dword [eax]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x10], 0
test esi, esi
je 0x40e11c
lea ecx, [esp + 0x10]
call fcn.0040e6f0
cmp esi, 0xffffffff
je 0x40e0f3
mov dword [esp + 0x10], esi
call fcn.0041a580
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 4]
mov ecx, dword [0x4f9ff0]
mov dword [esp + 0x1c], eax
test ecx, ecx
jne 0x40e0e0
call fcn.0041a640
mov ecx, dword [0x4f9ff0]
push dword [esp + 0x18]
mov eax, dword [ecx]
lea edx, [esp + 0x14]
push dword [esp + 0x20]
push edx
push esi
call dword [eax + 4]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40e11c
cmp eax, 0xffffffff
je 0x40e11c
push 0
lea ecx, [esp + 0x18]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40e11c
mov esi, dword [esp + 0x14]
cmp esi, edi
je 0x40e11f
or esi, 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0040e6f0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret