joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f140
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4f600c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
push str.Unspecified_error.
call fcn.004773a0
add esp, 4
push 0x44
push 0
lea eax, [ebp - 0x268]
push eax
call fcn.004924b0
add esp, 0xc
mov dword [ebp - 0x268], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x224]
push ecx
call fcn.004924b0
add esp, 0xc
mov dx, word [0x4e1fdc]
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.004924b0
add esp, 0xc
push 0x4e3450
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004a1bb3
add esp, 0xc
push 0
mov ecx, dword [ebp - 0x210]
add ecx, 0x9c
call fcn.004794d0
push eax
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.004a1bb3
add esp, 0xc
push 0x4d746c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.004a1bb3
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.004a1bb3
add esp, 0xc
push 0x4e3450
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.004a1bb3
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x268]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x210]
add ecx, 0x9c
call fcn.0048fe90
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x220], 0
je 0x47f2a4
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x220], 0
cmp dword [ebp - 0x214], 0
jne 0x47f2c1
push str.Error_creating_CrashSender_process.
call fcn.004773a0
add esp, 4
mov eax, 1
jmp 0x47f315
cmp dword [ebp + 0xc], 0
je 0x47f2dc
push 0xffffffffffffffff
mov edx, dword [ebp - 0x210]
mov eax, dword [edx + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x10], 0
je 0x47f2ef
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x224]
mov dword [ecx], edx
jmp 0x47f306
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x224], 0
push 0x4d6238
call fcn.004773a0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467552
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48b590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfcc3
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4f600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
call fcn.0048cdf0
push 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x48b5ee
mov eax, 1
jmp 0x48b63c
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x228]
call fcn.00478ea0
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x224], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x224]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00485c00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.004790a0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00467552
mov esp, ebp
pop ebp
ret
Function at 0x48bf80
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfe78
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00478f40
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp + 0xc]
call fcn.0048fe90
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x48c099
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 0
lea ecx, [ebp + 0xc]
call fcn.0048fe90
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x48c099
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0x4d67c4
mov edx, dword [ebp - 0x24]
push edx
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
shr ecx, 0x10
and ecx, 0xffff
mov word [ebp - 0x1c], cx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x10]
and eax, 0xffff
mov word [ebp - 0x18], ax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x14]
shr edx, 0x10
and edx, 0xffff
mov word [ebp - 0x14], dx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x14]
and ecx, 0xffff
mov word [ebp - 0x10], cx
movzx edx, word [ebp - 0x10]
push edx
movzx eax, word [ebp - 0x14]
push eax
movzx ecx, word [ebp - 0x18]
push ecx
movzx edx, word [ebp - 0x1c]
push edx
push str._u._u._u._u
lea eax, [ebp - 0x28]
push eax
call fcn.00486480
add esp, 0x18
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 8]
call fcn.00485680
mov eax, dword [ebp - 0x30]
or eax, 1
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004790a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004790a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x48c0f0
Capabilities:
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfeab
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00478f40
mov byte [ebp - 4], 1
push 0
push 0x3a
lea ecx, [ebp + 8]
call fcn.0048ce30
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x48c146
mov eax, dword [ebp - 0x18]
add eax, 2
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x5c
lea ecx, [ebp + 8]
call fcn.0048ce30
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x48c171
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.00485c00
jmp 0x48c1a6
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp + 8]
call fcn.00486bb0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00485c00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.004790a0
push 0
lea ecx, [ebp - 0x14]
call fcn.0048fe90
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x48c1f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x48c1f4
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004790a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004790a0
mov eax, dword [ebp - 0x2c]
jmp 0x48c270
lea ecx, [ebp - 0x14]
call fcn.0048fe90
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
and edx, 0x10
jne 0x48c235
mov dword [ebp - 0x34], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004790a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004790a0
mov eax, dword [ebp - 0x34]
jmp 0x48c270
cmp dword [ebp - 0x10], 0xffffffff
jne 0x48c23d
jmp 0x48c24b
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x48c14c
mov dword [ebp - 0x38], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004790a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004790a0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x48cfb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 0x10], 0
je 0x48cfc8
mov dword [ebp - 8], 1
jmp 0x48cfcf
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
xor ecx, ecx
jne 0x48cfd5
cmp dword [ebp - 0x14], 0
jne 0x48cfe9
push 0x80004005
call fcn.00432bb0
xor edx, edx
jne 0x48cfb9
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x48d130
cmp dword [ebp + 8], 0
je 0x48d130
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jbe 0x48d11f
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jbe 0x48d105
cmp dword [ebp - 4], 2
jbe 0x48d056
cmp dword [ebp - 4], 7
je 0x48d09b
jmp 0x48d105
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x48d07b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 - 2]
test edx, edx
je 0x48d096
mov eax, 2
imul ecx, eax, 0
xor edx, edx
mov eax, dword [ebp + 8]
mov word [eax + ecx], dx
mov eax, 0xd
jmp 0x48d133
jmp 0x48d11d
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x48d0eb
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
cmp eax, 1
jb 0x48d0eb
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shr edx, 1
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
jne 0x48d0eb
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
cmp eax, 1
jbe 0x48d103
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shr edx, 1
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 - 4]
test ecx, ecx
je 0x48d103
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 8]
mov word [edx + eax], cx
mov eax, 0xd
jmp 0x48d133
jmp 0x48d11d
mov eax, 2
imul ecx, eax, 0
xor edx, edx
mov eax, dword [ebp + 8]
mov word [eax + ecx], dx
mov eax, 0xd
jmp 0x48d133
jmp 0x48d130
mov ecx, 2
imul edx, ecx, 0
xor eax, eax
mov ecx, dword [ebp + 8]
mov word [ecx + edx], ax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48de20
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cffd8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00478f40
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00478db0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 8], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x48e0e0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor edx, edx
div dword [ecx + 8]
mov eax, dword [ebp + 8]
sub eax, edx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
push 6
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0x18
call fcn.0048f9e0
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x4a5a26
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a58a5

Function at 0x4a7692
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a7000

Function at 0x4a769d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a723b

Function at 0x4b2b55
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x572eb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x86], 0
je 0x572ed7
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x29]
inc eax
xor byte [edx], cl
cmp eax, 0x85
jb 0x572ec0
mov byte [esi + 0x86], 0
mov eax, esi
pop esi
ret

Function at 0x572ee0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x57], 0
je 0x572f02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x29]
inc eax
xor byte [edx], cl
cmp eax, 0x56
jb 0x572ef0
mov byte [esi + 0x57], 0
mov eax, esi
pop esi
ret
Function at 0x41611e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x41612d
pop dword [ebp - 0x44]
mov eax, 0xcb5a039
add eax, 0xf38bc0f4
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3b03e
push 0
mov eax, 0x5f304e92
add eax, 0xa1119382
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x65f3c826
sub ecx, 0x65f38f3e
mov esi, eax
mov edi, 0x438000
add edi, dword [ebp - 0x44]
mov edx, 0x5d6c45f4
add edx, 0x64e141c9
add dword [ebp - 0x40], 0xa0dd2c23
mov ebx, dword [edi]
xor dword [ebp - 0x24], 0x9a3454e4
add ebx, edx
sub dword [ebp - 0x38], eax
mov dword [esi], ebx
sub dword [ebp - 0x34], ecx
add esi, 0xb5b84bc6
add esi, 0x4a47b43e
add edi, 0xcbfb9ee4
sub edi, 0xcbfb9ee0
loop 0x416186
add eax, 0xd673
xor ebx, ebx
add ebx, eax
add eax, 0x8044b83e
add eax, 0x7fbb47c7
mov ecx, 0x5891f7d
add ecx, 0xfab6e083
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x40531a
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004055c5
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x40534e
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42f0a8], eax
jmp 0x4054df
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x40536c
test eax, eax
je 0x405484
test byte [ebp + 0xc], 2
je 0x405484
mov esi, 0x42b4a0
push edi
push esi
call fcn.004059d8
test ebx, ebx
je 0x405389
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x40538f
push edi
call fcn.0040552c
push 0x409010
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40547a
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405510
cmp byte [eax], 0
je 0x4053e0
cmp byte [ebp - 0x18], 0
je 0x4053e0
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x4053f6
mov al, byte [esi + 1]
test al, al
je 0x405459
cmp al, 0x2e
jne 0x4053f6
cmp byte [esi + 2], 0
je 0x405459
push esi
push ebx
call fcn.004059d8
mov eax, dword [ebp - 0x148]
test al, 0x10
je 0x40541c
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405459
push dword [ebp + 0xc]
push edi
call fcn.0040531a
jmp 0x405459
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405451
test byte [ebp + 0xc], 4
je 0x405449
push edi
push 0xfffffffffffffff1
call fcn.00404d7b
push 0
push edi
call fcn.00405720
jmp 0x405459
inc dword [0x42f0a8]
jmp 0x405459
push edi
push 0xfffffffffffffff2
call fcn.00404d7b
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4053be
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x405484
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4054df
cmp dword [ebp - 8], esi
jne 0x405499
inc dword [0x42f0a8]
jmp 0x4054df
push edi
call fcn.00405cad
test eax, eax
je 0x4054df
push edi
call fcn.004054e5
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4054d7
test byte [ebp + 0xc], 4
je 0x405491
push edi
push 0xfffffffffffffff1
call fcn.00404d7b
push esi
push edi
call fcn.00405720
jmp 0x4054df
push edi
push 0xffffffffffffffe5
call fcn.00404d7b
pop edi
pop esi
leave
ret 8
Function at 0x4055c5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42b8a0
push esi
call fcn.004059d8
push esi
call fcn.00405578
mov edi, eax
test edi, edi
jne 0x4055e6
xor eax, eax
jmp 0x405638
push edi
call fcn.00405c14
test byte [0x42f030], 0x80
je 0x4055ff
mov al, byte [edi]
test al, al
je 0x4055e2
cmp al, 0x5c
je 0x4055e2
sub edi, esi
jmp 0x405617
call fcn.00405cad
test eax, eax
je 0x405611
test byte [eax], 0x10
je 0x4055e2
push esi
call fcn.0040552c
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405603
call fcn.004054e5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4056a9
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4056d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40571c
test edi, edi
jne 0x4056e3
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405716
Function at 0x405720
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call fcn.00405ceb
test eax, eax
mov esi, dword [esp + 0x18]
je 0x40574c
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405892
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x42c628], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x42c628
je 0x405790
push 1
push 0
push esi
call fcn.004056a9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405898
cmp eax, edi
jg 0x405898
mov esi, 0x42c0a0
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405898
cmp eax, edi
jg 0x405898
push esi
push ebp
push str._s_s_r_n
push 0x42bca0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call sub.KERNEL32.dll_lstrcatA
xor eax, eax
push eax
push 0x8000080
push 4
push eax
push eax
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x405892
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40588b
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40588b
cmp edi, dword [esp + 0x18]
jne 0x40588b
push str._Rename__r_n
push esi
call fcn.0040563d
test eax, eax
jne 0x40589f
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.004059d8
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x42bca0
push eax
call fcn.00405689
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x42f0b0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409308
push eax
call fcn.0040563d
test eax, eax
je 0x405856
inc eax
lea edx, [esi + edi]
cmp eax, edx
mov ecx, eax
jae 0x4058c8
mov dl, byte [ecx]
mov byte [ecx + ebx], dl
inc ecx
lea edx, [esi + edi]
cmp ecx, edx
jb 0x4058bb
sub eax, esi
jmp 0x405858
Function at 0x4058cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405930
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40591f
cmp dword [ebp + 0x14], 1
je 0x405921
cmp dword [ebp + 0x14], 2
je 0x405921
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10