joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019c0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4350c0], 0x24e1
mov eax, dword [0x4350c0]
sub eax, 0x24e1
mov dword [0x4350c0], eax
mov ecx, 1
test ecx, ecx
je 0x401a6b
mov edx, dword [0x4350c0]
cmp edx, dword [ebp + 0xc]
jb 0x4019f7
jmp 0x401a6b
cmp dword [0x4350c0], 0
jne 0x401a15
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401a15
xor eax, eax
jmp 0x401a6b
mov eax, dword [ebp + 8]
add eax, dword [0x4350c0]
mov ecx, dword [eax]
add ecx, dword [0x4350c0]
mov edx, dword [ebp + 8]
add edx, dword [0x4350c0]
mov dword [edx], ecx
mov dword [ebp - 4], 9
mov eax, dword [0x4350c0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4350c0]
push eax
call fcn.004011d0
add esp, 8
mov ecx, dword [0x4350c0]
add ecx, 4
mov dword [0x4350c0], ecx
jmp 0x4019dd
mov esp, ebp
pop ebp
ret

Function at 0x401a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str._ffffffffffffffff
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401aea
cmp dword [ebp - 0x118], 0
je 0x401aea
jmp 0x401b4c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x401b4c
mov dword [ebp - 0x120], 0x3c41
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4350b4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4350d0], edx
mov dword [ebp - 0x120], 0x3c41
mov dword [ebp - 0x120], 0x3c41
call fcn.004011c0
mov eax, dword [ebp + 8]
mov dword [0x4350cc], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401980
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x401aea
mov esp, ebp
pop ebp
ret

Function at 0x8e1074
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e107a
pop ebp
sub ebp, 6
sub ebp, 0x4e1074
jmp 0x8e10d8
jmp 0x8e10e1
mov eax, 0x4e1074
add eax, ebp
add eax, 0x93
mov ecx, 0x631
mov edx, 0x985f43e
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e10f8
jmp 0x8e110b
push esp
jle 0x8e1164
push esi
adc bh, byte ds:[esi]
mov edi, 0x13bebdce
sbb byte [edi + 0x13bebdce], bh
sbb byte [0xabc16efe], cl
add ch, byte [edi + 0x7a]
outsb dx, byte ds:[esi]
mov ch, 0xf3
mov ch, 0xb7
add bh, byte [esi]
mov edi, 0x3e3ec6ff
cmp eax, 0x3e3886f3
test byte ds:[esi], dl
leave
fdivr qword [0x32bfb5f6]
cmp eax, 0xcf566efb
or esi, dword [edi]
push esi
mov esi, 0x3f3e7ae4
adc bl, byte [edx]
push esi
salc
salc
cmp edi, dword [esi]
xlatb
push ss
imul esi, dword ds:[ebp + 0x36bbb5d2], 0x3e
mov ch, 0xab
xor bh, byte [esi]
mov ch, 0xb3
notrack call edi
cmp al, 0xf
cmp al, 0xbd
cld
cmp dh, byte [edi + 0x31]
mov ebx, 0xc1c1c1ca
arpl sp, di
xor bh, byte [esi]
mov ch, 0xb2
sbb bh, byte [edx]
push esi
iretd
Function at 0x40168d
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x467fd0]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00433420
add esp, 0xc
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x4016e1
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call esi
test eax, eax
je 0x4016f1
mov eax, dword [ebp - 0x70]
dec eax
dec eax
jne 0x4016f1
cmp dword [ebp - 0x7c], 6
jb 0x4016f1
inc eax
jmp 0x4016f3
xor eax, eax
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
pop esi
call fcn.00433304
add ebp, 0xa0
leave
ret

Function at 0x401ae2
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3004
call fcn.004339f0
mov eax, dword [0x467fd0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x5c], 0
push edi
mov edi, dword [ebp + 0xc]
jne 0x401b96
test byte [esi + 0x58], 8
je 0x401b96
xor eax, eax
push 0xffe
push eax
mov word [ebp - 0x1004], ax
lea eax, [ebp - 0x1002]
push eax
call fcn.00433420
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x1004]
push eax
call fcn.00433584
xor eax, eax
push 0x1ffe
push eax
mov word [ebp - 0x3004], ax
lea eax, [ebp - 0x3002]
push eax
call fcn.00433420
lea eax, [ebp - 0x1004]
push eax
push edi
lea eax, [ebp - 0x3004]
push 0x44c840
push eax
call fcn.0040174f
add esp, 0x34
cmp byte [esi + 0x5d], 0
lea eax, [ebp - 0x3004]
push eax
je 0x401b90
mov ecx, esi
call fcn.0040192b
jmp 0x401b96
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00433304
leave
ret

Function at 0x401ef2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401f7a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.EnableLUA
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x401f5e
push str.UACCheck___RegQueryValueEx__EnableLUA___Fail___
push str._SOM_
push 0x469370
call fcn.00401ae2
add esp, 0xc
cmp dword [ebp - 4], esi
je 0x401f7a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
cmp dword [ebp - 4], esi
je 0x401f7a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
leave
ret
Function at 0x4029e6
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0c
mov eax, dword [0x467fd0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0xa0c], ax
lea eax, [ebp - 0xa0a]
push eax
call fcn.00433420
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00433420
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004028da
add esp, 0x20
cmp word [ebp - 0x20c], 0
je 0x402ac3
push esi
xor esi, esi
push esi
push str.DXTP
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa0c]
push str._s_s_03d.tsp
push eax
call fcn.0043407a
lea eax, [ebp - 0xa0c]
push 0x44ca60
push eax
call fcn.00434063
add esp, 0x1c
test eax, eax
je 0x402a93
push eax
call fcn.00433f21
inc esi
cmp esi, 0x64
pop ecx
jl 0x402a50
lea eax, [ebp - 0xa0c]
push 0x44ca58
push eax
call fcn.00434063
pop ecx
pop ecx
pop esi
test eax, eax
je 0x402ac3
push eax
call fcn.00433f21
pop ecx
lea eax, [ebp - 0xa0c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x402ac6
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00433304
leave
ret
Function at 0x4030bb
Capabilities:
Compare security identifiers

Disassembly:
push ebp
lea ebp, [esp - 0xf98]
mov eax, 0x1018
call fcn.004339f0
mov eax, dword [0x467fd0]
xor eax, ebp
mov dword [ebp + 0xf94], eax
push ebx
xor ebx, ebx
push 0xfff
lea eax, [ebp - 0x6b]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
mov byte [ebp - 0x6c], bl
call fcn.00433420
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push 8
mov byte [ebp - 0x74], bl
mov byte [ebp - 0x73], bl
mov byte [ebp - 0x72], bl
mov byte [ebp - 0x71], bl
mov byte [ebp - 0x70], bl
mov byte [ebp - 0x6f], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402c6b
lea eax, [ebp - 0x80]
push eax
push 0x1000
lea eax, [ebp - 0x6c]
push eax
push 2
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x402bec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CExecuteEnvironMent::QueryIfUserIsAdmin:_GetTokenInformation_Fail___d_
jmp 0x402c77
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x402c1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CExecuteEnvironMent::QueryIfUserIsAdmin:_AllocateAndInitializeSid_Fail___d_
jmp 0x402c77
push esi
xor esi, esi
cmp dword [ebp - 0x6c], ebx
jbe 0x402c45
push edi
lea edi, [ebp - 0x68]
push dword [edi]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x402c41
inc esi
add edi, 8
cmp esi, dword [ebp - 0x6c]
jb 0x402c27
jmp 0x402c44
xor ebx, ebx
inc ebx
pop edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push ebx
push str.CExecuteEnvironMent::QueryIfUserIsAdmin:_EqualSid___d_
push 0x44c94c
push 0x469a10
call fcn.00401ae2
add esp, 0x10
mov eax, ebx
pop esi
jmp 0x402c8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CExecuteEnvironMent::QueryIfUserIsAdmin:_OpenProcessToken_Fail___d_
push 0x44c94c
push 0x469a10
call fcn.00401ae2
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp + 0xf94]
xor ecx, ebp
pop ebx
call fcn.00433304
add ebp, 0xf98
leave
ret
push esi
mov esi, ecx
call fcn.0040259c
mov ecx, esi
test eax, eax
je 0x4030cf
pop esi
jmp 0x402b57
call fcn.004029e6
neg eax
sbb eax, eax
inc eax
pop esi
ret
Function at 0x403c50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1804
call fcn.004339f0
mov eax, dword [0x467fd0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
cmp byte [esi + 0x5c], bl
jne 0x403cfb
test byte [esi + 0x58], 8
je 0x403cfb
push 0x7ff
lea eax, [ebp - 0x803]
push ebx
push eax
mov byte [ebp - 0x804], bl
call fcn.00433420
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x804]
push eax
call fcn.004346de
push 0xfff
lea eax, [ebp - 0x1803]
push ebx
push eax
mov byte [ebp - 0x1804], bl
call fcn.00433420
lea eax, [ebp - 0x804]
push eax
push edi
lea eax, [ebp - 0x1804]
push str.__s___s
push eax
call fcn.004345e3
add esp, 0x34
lea eax, [ebp - 0x1804]
push eax
cmp byte [esi + 0x5d], bl
je 0x403cf5
mov ecx, esi
call fcn.0040361b
jmp 0x403cfb
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00433304
leave
ret

Function at 0x4044d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
jle 0x404511
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
sub edi, esi
mov al, byte [esi]
xor al, 0x80
mov byte [edi + esi], al
movsx ecx, byte [esi]
push ecx
movsx eax, al
push eax
push str.CExtractManager::XorKeyValue__x___x_
push 0x44c94c
push 0x46afb0
call fcn.00401ae2
add esp, 0x14
inc esi
dec ebx
jne 0x4044e5
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x404690
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x467fd0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 7
mov esi, ecx
pop ecx
mov byte [ebp - 0x3c], 0
lea edi, [ebp - 0x3b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
push 7
mov byte [ebp - 0x5c], 0
pop ecx
lea edi, [ebp - 0x5b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov ebx, dword [ebp + 8]
mov byte [ebp - 0xc], 0
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x1c], 0
xor eax, eax
lea edi, [ebp - 0x1b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x44ca60
push ebx
stosb byte es:[edi], al
call fcn.00434063
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x40471f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.CExtractManager::InitSomInfo:_fopen_error__s___d_
push 0x44c94c
push 0x46afb0
call fcn.00401ae2
add esp, 0x14
xor eax, eax
jmp 0x404842
push 0
push 0x3e8
push edi
call fcn.00436069
push edi
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 0x3c]
push 0x11
push eax
call fcn.0043638e
push edi
push ebx
lea eax, [ebp - 0x5c]
push 7
push eax
call fcn.0043638e
push edi
push ebx
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.0043638e
push edi
push ebx
lea eax, [ebp - 0x1c]
push 0x10
push eax
call fcn.0043638e
add esp, 0x4c
push edi
call fcn.00433f21
push 0x11
lea eax, [ebp - 0x3c]
push str.SOMDOCUMENTNORMAL
xor edi, edi
push eax
mov dword [esi + 0x1450], edi
call fcn.0043495f
add esp, 0x10
test eax, eax
jne 0x404792
mov dword [esi + 0x1450], edi
jmp 0x4047eb
push 0x11
lea eax, [ebp - 0x3c]
push str.SOMDOCUMENTOLESOM
push eax
call fcn.0043495f
add esp, 0xc
test eax, eax
jne 0x4047b1
mov dword [esi + 0x1450], ebx
jmp 0x4047eb
push 0x11
lea eax, [ebp - 0x3c]
push str.SOMDOCUMENTSIMPLE
push eax
call fcn.0043495f
add esp, 0xc
test eax, eax
jne 0x4047d4
mov dword [esi + 0x1450], 2
jmp 0x4047eb
push str.CExtractManager::InitSomInfo:_somType_Check_Error__
push 0x44c94c
push 0x46afb0
call fcn.00401ae2
add esp, 0xc
cmp byte [ebp - 0xc], 0x52
mov dword [esi + 0x1454], edi
jne 0x4047ff
mov dword [esi + 0x1454], edi
jmp 0x404824
cmp byte [ebp - 0xc], 0x41
jne 0x40480d
mov dword [esi + 0x1454], ebx
jmp 0x404824
push str.CExtractManager::InitSomInfo:_somEncType_Check_Error__
push 0x44c94c
push 0x46afb0
call fcn.00401ae2
add esp, 0xc
cmp dword [esi + 0x1454], ebx
jne 0x404840
push 0x10
lea eax, [esi + 0x145c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.004044d0
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00433304
leave
ret 4
Function at 0x405309
Capabilities:
Get common file path

Disassembly:
push 0x938
mov eax, 0x4495f2
call fcn.0043337c
mov ebx, dword [ebp + 8]
mov esi, 0x104
push esi
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00433420
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00403a7f
add esp, 0x14
lea eax, [ebp - 0x32c]
push eax
mov dword [ebp - 0x32c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40543d
cmp dword [ebp - 0x31c], 2
lea eax, [ebp - 0x218]
jne 0x4053b0
push esi
push edi
push eax
call fcn.00433420
add esp, 0xc
push 1
push 0x1c
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push str.SOM_
push eax
call fcn.00434151
lea eax, [ebp - 0x218]
push eax
call fcn.0043658f
add esp, 0xc
jmp 0x40543d
push ecx
mov ecx, esp
mov dword [ebp - 0x944], esp
push eax
call fcn.004032dc
lea ecx, [ebp - 0x93c]
call fcn.0040f520
push esi
lea eax, [ebp - 0x218]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.00433420
add esp, 0xc
lea eax, [ebp - 0x940]
push eax
lea ecx, [ebp - 0x93c]
call fcn.0040f750
push dword [eax]
lea eax, [ebp - 0x218]
push eax
call fcn.0043417f
pop ecx
pop ecx
mov ecx, dword [ebp - 0x940]
add ecx, 0xfffffff0
call fcn.004026da
lea eax, [ebp - 0x218]
push 0x44e190
push eax
call fcn.00434151
lea eax, [ebp - 0x218]
push eax
call fcn.0043658f
or dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0x93c]
call fcn.0040f4d0
lea eax, [ebp - 0x218]
push eax
push ebx
call fcn.0043417f
pop ecx
pop ecx
call fcn.004333ff
ret 4
Function at 0x4059c3
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea ebp, [ebx + 0xc20]
push ebp
call fcn.00405309
push 0x44e5c4
push ebp
call fcn.00434151
push ebp
call fcn.0043658f
add esp, 0xc
mov edi, 0x44c94c
mov esi, 0x46afb0
test eax, eax
jne 0x405a07
push ebp
push str.CExtractManager::SetDirectory:_set_TEMP___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
push str.image_
push ebp
call fcn.00434151
push ebp
call fcn.0043658f
add esp, 0xc
test eax, eax
jne 0x405a2f
push ebp
push str.CExtractManager::SetDirectory:_set_TEMP_image___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
push 0x208
push 0
push ebp
call fcn.00433420
add esp, 0xc
push ebp
mov ecx, ebx
call fcn.00405309
push ebp
push str.CExtractManager::SetDirectory:_TEMP___s_
push edi
push esi
call fcn.00401ae2
lea ebp, [ebx + 0x810]
push 0x104
push ebp
call fcn.00403a7f
push 0x44e5c4
push ebp
call fcn.00434151
push ebp
call fcn.0043658f
add esp, 0x24
test eax, eax
jne 0x405a8d
push ebp
push str.CExtractManager::SetDirectory:_set_WIN___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
push ebp
push str.CExtractManager::SetDirectory:_WIN___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
push 0x104
lea ebp, [ebx + 0xa18]
push ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x44e5c4
push ebp
call fcn.00434151
push ebp
call fcn.0043658f
add esp, 0xc
test eax, eax
jne 0x405ad7
push ebp
push str.CExtractManager::SetDirectory:_set_SYS32___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
push ebp
push str.CExtractManager::SetDirectory:_SYS32___s_
push edi
push esi
call fcn.00401ae2
lea ebp, [ebx + 0xe28]
push 0x104
push ebp
call fcn.00403a7f
push str.Softcamp
push ebp
call fcn.00434151
push ebp
call fcn.0043658f
add esp, 0x24
test eax, eax
jne 0x405b1d
push ebp
push str.CExtractManager::SetDirectory:_set_SDS___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
push str._sds_
push ebp
call fcn.00434151
push ebp
call fcn.0043658f
add esp, 0xc
test eax, eax
jne 0x405b45
push ebp
push str.CExtractManager::SetDirectory:_set_SDS___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
push ebp
push str.CExtractManager::SetDirectory:_SDS___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
lea ebp, [ebx + 0x1030]
push ebp
mov ecx, ebx
call fcn.0040495f
push ebp
push str.CExtractManager::SetDirectory:_CUR___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x406cd3
Capabilities:
Check if file exists
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, 0x80
cmp eax, 1
jne 0x406d00
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push esi
push 2
push ebx
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x406d41
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.CreateSomFile:_CreateError__FileName:__s___x_
push 0x44c94c
push 0x46b010
call fcn.00401ae2
add esp, 0x14
xor eax, eax
jmp 0x406e57
mov edi, dword [ebp + 0x14]
lea eax, [edi + 0x10]
push eax
call fcn.0041513d
mov esi, eax
lea eax, [edi + 0x10]
push eax
push ebx
push esi
mov dword [ebp + 0x14], esi
call fcn.00433420
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00436069
add esp, 0x1c
test eax, eax
je 0x406d7b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406d3a
push dword [ebp + 8]
push edi
push 1
push esi
call fcn.0043638e
add esp, 0x10
push ebx
lea eax, [ebp - 8]
push eax
push 0xa
push str.SCDSSS02
push dword [ebp - 4]
mov byte [esi + edi], bl
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
call esi
test eax, eax
jne 0x406dc4
push dword [ebp + 0xc]
push str.CreateSomFile:_WriteError_HEADER_FileName:__s_
push 0x44c94c
push 0x46b010
call fcn.00401ae2
add esp, 0x10
jmp 0x406d70
push ebx
lea eax, [ebp - 8]
push eax
push 0x10
push dword [ebp + 0x18]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x406de1
push dword [ebp + 0xc]
push str.CreateSomFile:_WriteError_HEADER_SIZE_FileName:__s_
jmp 0x406db0
push ebx
lea eax, [ebp - 8]
push eax
push 0x10
push dword [ebp + 0x1c]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x406dfe
push dword [ebp + 0xc]
push str.CreateSomFile:_WriteError_Key_FileName:__s_
jmp 0x406db0
push ebx
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x406e1a
push dword [ebp + 0xc]
push str.CreateSomFile:_WriteError_Data_FileName:__s_
jmp 0x406db0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x14]
call fcn.00415148
mov eax, dword [ebp - 0xc]
push dword [ebp + 0xc]
add eax, 4
push eax
call fcn.0043417f
push dword [ebp + 0xc]
push str.CreateSomFile:_Success__FileName:__s_
push 0x44c94c
push 0x46b010
call fcn.00401ae2
xor eax, eax
add esp, 0x1c
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x4085eb
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x467fd0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x208
lea eax, [esi + 0x210]
push 0
push eax
mov dword [ebp - 0x430], eax
call fcn.00433420
mov edi, dword [esi]
add esp, 0xc
test edi, edi
je 0x4086c2
and dword [ebp - 0x42c], 0
push 0x424
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.00433420
add esp, 0xc
push edi
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4086c2
lea eax, [ebp - 0x42c]
push eax
push edi
mov dword [ebp - 0x42c], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x4086bb
add esi, 8
lea eax, [ebp - 0x40c]
push eax
push esi
call fcn.00433e17
pop ecx
pop ecx
test eax, eax
je 0x408699
lea eax, [ebp - 0x42c]
push eax
push edi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x408673
jmp 0x4086bb
lea eax, [ebp - 0x20c]
push eax
call fcn.004337f0
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x430]
call fcn.00436a6d
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00433304
leave
ret 4

Function at 0x4089b2
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x467fd0]
xor eax, ebp
mov dword [ebp + 0x1b0], eax
push esi
push edi
mov edi, ecx
call fcn.0040871b
xor esi, esi
push 0x228
lea eax, [ebp - 0x78]
push esi
push eax
mov dword [ebp - 0x7c], esi
call fcn.00433420
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x80], eax
cmp eax, 0xffffffff
jne 0x408a01
xor eax, eax
jmp 0x408a76
lea ecx, [ebp - 0x7c]
push ecx
push eax
mov dword [ebp - 0x7c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x408a6b
push ebx
lea ebx, [edi + 4]
push 0x418
call fcn.0041510e
pop ecx
mov esi, eax
push esi
mov ecx, ebx
call fcn.0040890b
mov eax, dword [ebp - 0x74]
mov dword [esi], eax
mov eax, dword [ebp - 0x68]
mov dword [esi + 4], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [esi + 8]
push 0x44fa2c
push eax
call fcn.0043407a
add esp, 0xc
push esi
mov ecx, edi
call fcn.004085eb
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x408a1a
xor esi, esi
inc esi
pop ebx
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp + 0x1b0]
pop edi
xor ecx, ebp
pop esi
call fcn.00433304
add ebp, 0x1b4
leave
ret
Function at 0x40a2f2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
mov dword [ebp - 4], esi
mov edi, 0x20019
call fcn.0040a2b9
cmp eax, 1
jne 0x40a311
mov edi, 0x20219
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a34f
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], esi
je 0x40a34a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x40a35f
cmp dword [ebp - 4], esi
je 0x40a35d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
leave
ret