joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401120
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
mov eax, dword [0x41b004]
xor eax, esp
mov dword [esp + 0x150], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
mov edx, 0x41887c
nop dword [eax + eax]
lea ebx, [ecx + 1]
mov eax, ebx
push str._0x_08xL__s
and eax, 0x80000007
jns 0x401168
dec eax
or eax, 0xfffffff8
add eax, 1
mov eax, 0x4188ec
cmove eax, edx
push eax
mov eax, dword [ecx*4 + 0x4188f0]
xor eax, 0x55555555
push eax
push str._0x_08xL__s
push 0
push 0
call fcn.00401390
add esp, 0x18
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401191
mov edi, 0x41c568
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4011a0
mov ecx, eax
mov edx, 0x41887c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
cmp ecx, 0x100
jl 0x401150
mov edi, dword [esp + 0xc]
push 0x844
mov dword [0x4213a8], edi
call fcn.0040458b
add esp, 4
mov dword [0x41c558], eax
test eax, eax
je 0x40135f
push 0x844
push 0
push eax
call fcn.00402640
add esp, 0xc
test eax, eax
je 0x40135f
push 0x104
push dword [0x41c558]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [0x41c558]
movq xmm0, qword [str.D:RdpZapper]
push 0x100
push 0
movq qword [ecx + 0x258], xmm0
mov eax, dword [0x418888]
mov dword [ecx + 0x260], eax
mov al, byte [0x41888c]
mov byte [ecx + 0x264], al
lea eax, [esp + 0x54]
push eax
mov dword [esp + 0x44], 0x11c
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
call fcn.00402640
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
xor eax, eax
mov word [esp + 0x14e], ax
mov dword [esp + 0x150], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call esi
push edx
push eax
call esi
push edx
push eax
call esi
push edx
push eax
push 0x23
lea eax, [esp + 0x44]
mov dword [esp + 0x48], 6
xor ecx, ecx
mov dword [esp + 0x4c], 2
push eax
mov word [esp + 0x15c], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x4012e4
mov eax, dword [0x41c558]
push 0x30
add eax, 0x12c
push eax
push str.This_program_requires_Windows_8_or_higher
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40135f
lea eax, [esp + 0x10]
push eax
push 0x8002
push dword [0x4213a8]
call dword [sym.imp.USER32.dll_GetClassInfoA]
mov eax, dword [0x4213a8]
push str.rdpicon
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x3c], 0x4188bc
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x40133b
push dword [0x41c558]
call fcn.00404570
add esp, 4
jmp 0x40135f
mov eax, dword [0x41c55c]
test eax, eax
je 0x40134a
cmp dword [eax + 4], 0
jne 0x40135f
push 0
push section..text
push 0
push str.PinDialog
push edi
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov ecx, dword [esp + 0x15c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040149b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406df8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406e37
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406e37
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406e37
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406e37
cmp dword [ecx + 0x74], 0xe
jbe 0x406e37
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x409b3d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x414b38
push 0x414b30
push str.FlsAlloc
push 0x1f
call fcn.00409a59
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409b71
push dword [ebp + 8]
mov ecx, esi
call dword [0x41313c]
call esi
jmp 0x409b77
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x409bbb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x414b48
push 0x414b40
push str.FlsGetValue
push 0x21
call fcn.00409a59
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409bf2
push dword [ebp + 8]
mov ecx, esi
call dword [0x41313c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x409bfa
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x414b50
push 0x414b48
push str.FlsSetValue
push 0x22
call fcn.00409a59
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409c34
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41313c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40b21c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b2b9
push ebx
push esi
call fcn.0040b1e5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b179
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b266
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b2b8
push edi
push eax
call fcn.0040778c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b286
call fcn.00407752
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b2b7
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b179
add esp, 0x20
test eax, eax
jne 0x40b2a5
push edi
call fcn.00407752
jmp 0x40b2ad
push ebx
call fcn.00407752
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x406ef0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x406f09
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406f44
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x406f40
lea ebx, [ebx]
cmp esi, eax
jae 0x406f44
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x406f30
cmp esi, eax
jb 0x406f4a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x407460
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
mov ebp, dword [esp + 0x214]
push esi
push edi
push 0x103
lea eax, [esp + 0x115]
push 0
push eax
mov byte [esp + 0x11c], 0
call fcn.0042ea40
add esp, 0xc
push 0
push 0x23
lea ecx, [esp + 0x118]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x103
lea edx, [esp + 0x11]
push 0
push edx
mov byte [esp + 0x18], 0
call fcn.0042ea40
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x110]
mov byte [esp + eax + 0xc], cl
inc eax
test cl, cl
jne 0x4074d0
lea edi, [esp + 0xc]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4074e5
mov ecx, 7
mov esi, str.Net_Protector_npav4PopUpB.ini
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xc]
push eax
push 0
movsw word es:[edi], word [esi]
push ebp
push str.POP_UP_BLOCK
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [esp + 0x214]
dec eax
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
xor ecx, esp
inc eax
call fcn.0042ea25
add esp, 0x20c
ret

Function at 0x407530
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push esi
push 0
push str.Common_AppData
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0x104
mov byte [esi], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
dec esi
mov eax, esi
pop esi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407562
mov ecx, dword [str.Net_Protector]
mov dword [eax], ecx
mov edx, dword [0x45bcac]
mov dword [eax + 4], edx
mov ecx, dword [0x45bcb0]
mov dword [eax + 8], ecx
mov dx, word [0x45bcb4]
mov word [eax + 0xc], dx
mov cl, byte [0x45bcb6]
mov byte [eax + 0xe], cl
pop ecx
ret
Function at 0x4075a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
push str.SOFTWAREVB_and_VBA_Program_SettingsSPYWAREPROTECTIONConfig
push SysReAllocString
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4075ed
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
push esi
push eax
push eax
push str.ZVpath
push edx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret

Function at 0x4075f0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x108
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x104], eax
lea eax, [esp]
push eax
mov byte [esp + 4], 0
call fcn.004075a0
lea eax, [esp + 4]
add esp, 4
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407620
mov ecx, dword [str.CReport.Dll]
mov edx, dword [0x45bd68]
mov dword [eax], ecx
mov ecx, dword [0x45bd6c]
mov dword [eax + 4], edx
mov dl, byte [0x45bd70]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x407670
xor eax, eax
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0042ea25
add esp, 0x108
ret
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x407659
push str.AddEntry_OnLine
push eax
mov dword [0x46f734], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x104]
xor edx, edx
test eax, eax
setne dl
mov dword [0x46f734], eax
xor ecx, esp
mov eax, edx
call fcn.0042ea25
add esp, 0x108
ret

Function at 0x4077c0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4077f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcessToken_failed_with__d_n
call fcn.0042e239
add esp, 8
xor eax, eax
add esp, 0x1c
ret
lea ecx, [esp + 4]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x407824
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LookupPrivilegeValue_failed_with__d_n
call fcn.0042e239
add esp, 8
xor eax, eax
add esp, 0x1c
ret
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
push 0
push 0
push 0x10
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x14]
push 0
push edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x407880
call esi
push eax
push str.AdjustTokenPrivileges_failed_with__d_n
call fcn.0042e239
add esp, 8
xor eax, eax
pop esi
add esp, 0x1c
ret
mov eax, 1
pop esi
add esp, 0x1c
ret
Function at 0x407890
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
push 0x9c
lea eax, [esp + 8]
push 0
push eax
call fcn.0042ea40
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x9c
call esi
test eax, eax
jne 0x4078e5
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x94
call esi
test eax, eax
je 0x407952
cmp dword [esp + 0x14], 2
jne 0x407952
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x407942
mov ecx, dword [esp + 0xc]
mov eax, 1
cmp ecx, eax
jne 0x407922
mov dword [0x47013c], eax
mov dword [0x470140], eax
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0042ea25
add esp, 0xa0
ret
cmp ecx, 2
jne 0x407952
mov dword [0x47013c], eax
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0042ea25
add esp, 0xa0
ret
cmp eax, 6
jne 0x407952
mov eax, 1
cmp dword [esp + 0xc], eax
je 0x407907
mov ecx, dword [esp + 0xa0]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0042ea25
add esp, 0xa0
ret

Function at 0x4079c0
Capabilities:
Delete file
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x104
lea eax, [esp + 4]
push 0
push eax
call fcn.0042ea40
lea ecx, [esp + 0xc]
push 0x104
push ecx
call fcn.00407970
push 0x104
lea edx, [esp + 0x11c]
push 0
push edx
call fcn.0042ea40
add esp, 0x20
push str.c:zvcryp_inf.ini
push 0x104
lea eax, [esp + 0x10c]
push eax
push 0x45be70
lea ecx, [esp + 0x10]
push ecx
push 0x45be6c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x104]
push 0x45be68
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x407a6d
push str.c:zvcryp_inf.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0042ea25
add esp, 0x20c
ret
mov ecx, dword [esp + 0x208]
xor ecx, esp
mov al, 1
call fcn.0042ea25
add esp, 0x20c
ret
Function at 0x407c90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x378
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x374], eax
push 0x104
lea eax, [esp + 0x6c]
push 0
push eax
call fcn.0042ea40
lea ecx, [esp + 0x74]
push ecx
call fcn.004075a0
lea eax, [esp + 0x78]
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407cd0
sub eax, edx
je 0x407e42
lea edx, [esp + 0x68]
push edx
call fcn.004302ba
lea eax, [esp + 0x6c]
push str.ZVSCAN
push eax
call fcn.0042efa0
add esp, 0xc
test eax, eax
je 0x407e42
push esi
push edi
lea edi, [esp + 0x70]
mov byte [eax], 0
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407d10
mov ecx, 9
mov esi, str.FASTSCANpassmacleaner.exe__SCANPC
push 0x44
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x30]
push 0
push ecx
call fcn.0042ea40
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x90]
push ecx
push 0
mov dword [esp + 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
test eax, eax
je 0x407e42
xor eax, eax
lea edx, [esp]
push edx
mov dword [0x470150], 1
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x104
lea eax, [esp + 0x274]
push 0
push eax
call fcn.0042ea40
movzx ecx, word [esp + 0xc]
movzx edx, word [esp + 0xe]
movzx eax, word [esp + 0x12]
push ecx
push edx
push eax
lea ecx, [esp + 0x288]
push str._02d:_02d:_04d
push ecx
call fcn.0042ebd6
lea edx, [esp + 0x18c]
push edx
call fcn.00407530
lea eax, [esp + 0x190]
add esp, 0x24
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407df5
mov ecx, dword [str._npav4.ini]
mov edx, dword [0x45beb0]
mov dword [eax], ecx
mov cx, word [0x45beb4]
mov dword [eax + 4], edx
mov dl, byte [0x45beb6]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [esp + 0x16c]
push eax
lea ecx, [esp + 0x274]
push ecx
push 0x45bea8
push 0x45bea4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [esp + 0x374]
xor ecx, esp
call fcn.0042ea25
add esp, 0x378
ret
Function at 0x407e60
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x324
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x320], eax
lea eax, [esp + 0x14]
push eax
call fcn.00407530
lea eax, [esp + 0x18]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407e88
sub eax, edx
jne 0x407ea8
mov ecx, dword [esp + 0x320]
xor ecx, esp
call fcn.0042ea25
add esp, 0x324
ret
lea eax, [esp + 0x14]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407eb0
mov ecx, dword [str._npav4.ini]
mov edx, dword [0x45beb0]
mov dword [eax], ecx
mov cx, word [0x45beb4]
mov dword [eax + 4], edx
mov dl, byte [0x45beb6]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [esp + 0x14]
push eax
push 0x104
lea ecx, [esp + 0x224]
push ecx
push 0x45b5a5
push 0x45bea8
push 0x45bea4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor eax, eax
lea edx, [esp]
push edx
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x104
lea eax, [esp + 0x11c]
push 0
push eax
call fcn.0042ea40
movzx ecx, word [esp + 0xc]
movzx edx, word [esp + 0xe]
movzx eax, word [esp + 0x12]
push ecx
push edx
push eax
lea ecx, [esp + 0x130]
push str._02d:_02d:_04d
push ecx
call fcn.0042ebd6
lea edx, [esp + 0x138]
push edx
lea eax, [esp + 0x240]
push eax
call fcn.0045306b
mov ecx, dword [esp + 0x348]
add esp, 0x28
neg eax
sbb eax, eax
xor ecx, esp
neg eax
call fcn.0042ea25
add esp, 0x324
ret
Function at 0x407f90
Capabilities:
Check if file exists
Copy file
Move file

Disassembly:
sub esp, 0x314
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x310], eax
call fcn.00407b00
push 0x104
lea eax, [esp + 8]
push 0
push eax
call fcn.0042ea40
lea ecx, [esp + 0x10]
push ecx
call fcn.004075a0
lea eax, [esp + 0x14]
add esp, 0x10
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407fd0
sub eax, edx
je 0x408133
push 0x104
lea edx, [esp + 0x10c]
push 0
push edx
call fcn.0042ea40
add esp, 0xc
xor eax, eax
jmp 0x408000
mov cl, byte [esp + eax + 4]
mov byte [esp + eax + 0x108], cl
inc eax
test cl, cl
jne 0x408000
lea eax, [esp + 4]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x408015
mov ecx, dword [str.lClean.dll]
mov edx, dword [0x45bf10]
mov dword [eax], ecx
mov ecx, dword [0x45bf14]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
lea eax, [esp + 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x408040
mov edx, dword [str.lClean2.dll]
mov ecx, dword [0x45bf00]
mov dword [eax], edx
mov edx, dword [0x45bf04]
mov dword [eax + 4], ecx
mov cl, byte [0x45bf08]
mov dword [eax + 8], edx
lea edx, [esp + 0x108]
push edx
mov byte [eax + 0xc], cl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x408133
push 0x104
lea eax, [esp + 0x210]
push 0
push eax
call fcn.0042ea40
add esp, 0xc
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 4]
mov byte [esp + eax + 0x20c], cl
inc eax
test cl, cl
jne 0x4080a0
lea eax, [esp + 0x20c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4080b8
mov ecx, dword [str..npav4]
mov dx, word [0x45bef8]
mov dword [eax], ecx
mov cl, byte [0x45befa]
mov word [eax + 4], dx
push 1
lea edx, [esp + 0x210]
mov byte [eax + 6], cl
push edx
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.00407e60
test eax, eax
je 0x408129
call fcn.00407c90
mov ecx, dword [esp + 0x310]
xor ecx, esp
call fcn.0042ea25
add esp, 0x314
ret
mov dword [0x470150], 1
mov ecx, dword [esp + 0x310]
xor ecx, esp
call fcn.0042ea25
add esp, 0x314
ret
Function at 0x408150
Capabilities:
Check if file exists
Create process on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x108], eax
push 0x104
lea eax, [esp + 8]
push 0
push eax
call fcn.0042ea40
lea ecx, [esp + 0x10]
push ecx
call fcn.004075a0
lea eax, [esp + 0x14]
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408190
sub eax, edx
je 0x40821a
lea edx, [esp + 4]
push edx
call fcn.004302ba
add esp, 4
push str.ZVSCAN
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x4081bf
mov byte [eax], 0
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4081db
push str.td.exe_not_found_
call fcn.004073f0
add esp, 4
lea eax, [esp + 4]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4081e0
mov edx, dword [str._td.exe__d]
mov ecx, dword [0x45bf1c]
mov dword [eax], edx
mov dx, word [0x45bf20]
mov dword [eax + 4], ecx
mov cl, byte [0x45bf22]
mov word [eax + 8], dx
push 0
lea edx, [esp + 8]
push edx
mov byte [eax + 0xa], cl
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0042ea25
add esp, 0x10c
ret

Function at 0x408230
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x368
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x364], eax
push esi
mov esi, dword [esp + 0x370]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408251
sub eax, edx
je 0x40836f
push str.Going_shell
call fcn.004073f0
push esi
call fcn.004073f0
push 0x103
lea eax, [esp + 0x69]
push 0
push eax
mov byte [esp + 0x70], 0
call fcn.0042ea40
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x17e]
push edx
mov word [esp + 0x180], cx
call fcn.0042ea40
push esi
lea eax, [esp + 0x184]
push 0x45bf4c
push eax
call fcn.00406ed0
push 0x44
lea ecx, [esp + 0x48]
push 0
push ecx
call fcn.0042ea40
xor eax, eax
lea edx, [esp + 0x198]
push edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x98]
push 0x45bf48
push eax
mov dword [esp + 0x5c], 0x44
call fcn.0042ebd6
lea ecx, [esp + 0xa0]
add esp, 0x44
push ecx
call fcn.004073f0
add esp, 4
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [esp + 0x180]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40835b
push str.Shell_Failed...
call fcn.004073f0
add esp, 4
pop esi
mov ecx, dword [esp + 0x364]
xor ecx, esp
call fcn.0042ea25
add esp, 0x368
ret
mov edx, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
mov ecx, dword [esp + 0x368]
pop esi
xor ecx, esp
call fcn.0042ea25
add esp, 0x368
ret