joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f00a
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
push eax
mov edi, edx
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov esi, edi
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x40f035
sub esi, ecx
sar esi, 1
lea ebx, [esi*2 + 0x50]
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40f0f4
movzx ecx, byte [ebp - 5]
movzx eax, byte [ebp - 8]
push ecx
movzx ecx, byte [ebp - 6]
push ecx
movzx ecx, byte [ebp - 7]
push ecx
push eax
movzx eax, byte [ebp - 9]
push eax
movzx eax, byte [ebp - 0xa]
push eax
movzx eax, byte [ebp - 0xb]
push eax
movzx eax, byte [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push edi
push 0x404bc8
push ebx
push esi
call fcn.0040df5a
add esp, 0x3c
xor ebx, ebx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x40f0e5
mov ecx, esi
call fcn.00411562
test eax, eax
jne 0x40f0e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x404c38
push 3
call fcn.0040fadc
add esp, 0x10
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
inc esi
push ecx
push ecx
mov ecx, dword [ebp - 0x1c]
mov edx, edi
push 0
call fcn.00410e44
mov ebx, eax
test ebx, ebx
jne 0x40f177
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x1c]
mov edx, eax
mov dword [ebp - 0x18], eax
call fcn.0040da6c
mov edx, dword [ebp - 0x18]
mov ecx, edi
call fcn.0040da6c
push dword [ebp - 0x18]
push 0x3c
push esi
push edi
push dword [ebp - 0x1c]
push 0x404cc8
push 4
call fcn.0040fadc
add esp, 0x1c
xor edx, edx
mov eax, esi
push 0xa
pop ecx
div ecx
cmp eax, 6
jae 0x40f158
mov eax, dword [eax*4 + 0x403744]
jmp 0x40f15a
xor eax, eax
test eax, eax
je 0x40f165
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SetLastError]
inc esi
lea eax, [esi - 1]
cmp eax, 0x3c
jb 0x40f0f7
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ef80
mov esp, ebp
pop ebp
ret
Function at 0x40f519
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040f5cb
cmp eax, 2
jne 0x40f5a0
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
lea edx, [ebp - 4]
xor esi, esi
call fcn.0040d67c
test eax, eax
je 0x40f55d
push eax
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
test eax, eax
je 0x40f555
movzx esi, word [eax + 4]
lea ecx, [ebp - 0x10]
call fcn.0040dac6
sub esi, 0x14c
je 0x40f58f
sub esi, 0x76
je 0x40f588
sub esi, 0x84a2
je 0x40f581
sub esi, 0x2400
jne 0x40f5a0
push 0x404f78
jmp 0x40f594
push 0x404f48
jmp 0x40f594
push 0x404f60
jmp 0x40f594
push 0x404f08
mov edx, 0x404f30
mov ecx, edi
call fcn.004102eb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f5ac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f5c2
test al, 0x50
jne 0x40f5c2
inc esi
mov eax, esi
pop esi
ret

Function at 0x40f6f1
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, edx
mov ebx, 0x80
push edi
mov edi, ecx
cmp esi, ebx
je 0x40f725
test esi, 0xffffff78
je 0x40f725
push edi
push esi
push 0x404fb8
push 4
xor ebx, ebx
call fcn.0040fadc
add esp, 0x10
push 0x57
jmp 0x40f7a9
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40f766
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
mov edx, esi
call fcn.0040da6c
cmp esi, 2
je 0x40f754
push esi
push edi
push 0x405018
push 3
jmp 0x40f7a0
push edi
push 0x405078
push 2
call fcn.0040fadc
add esp, 0xc
jmp 0x40f7a8
and eax, 0x3120
or eax, esi
or eax, ebx
cmp eax, ebx
je 0x40f778
and eax, 0xffffff7f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, eax
test ebx, ebx
jne 0x40f7af
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
mov edx, esi
call fcn.0040da6c
push esi
push edi
push 0x4050d8
push 4
call fcn.0040fadc
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x40fde5
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x400
xor esi, esi
mov dword [ebp - 8], ecx
and dword [ebp - 4], esi
mov edi, edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x40fe1d
push 8
xor edi, edi
pop esi
jmp 0x40fea8
test edi, edi
jne 0x40fe44
lea ecx, [ebp - 4]
call fcn.0040fed2
mov edi, eax
test edi, edi
jne 0x40fe39
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40fe98
push dword [ebp - 4]
push dword [ebp - 4]
push dword [ebp - 4]
jmp 0x40fe4c
mov eax, 0x405728
push eax
push eax
push eax
push dword [ebp + 8]
push 0x200
push ebx
call dword [sym.imp.msvcrt.dll_swprintf_s]
mov ecx, dword [ebp - 8]
add esp, 0x18
mov edx, ebx
call fcn.00410033
mov edi, eax
test edi, edi
jne 0x40fe98
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x40fe98
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.0040da6c
push esi
push dword [ebp - 8]
push 0x4057a8
push 4
call fcn.0040fadc
add esp, 0x10
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 4], 0
je 0x40feb7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
jne 0x40fec2
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x410728
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, ecx
mov ecx, ebx
mov dword [ebp - 4], ecx
push edi
test esi, esi
je 0x4107ad
test edx, edx
je 0x4107ad
add edx, esi
lea edi, [esi + 0x10040]
mov dword [ebp - 8], edx
cmp edi, edx
jbe 0x410754
mov edi, edx
lea eax, [esi + 0x40]
cmp eax, edi
jae 0x4107ad
mov ecx, dword [eax - 4]
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4107a0
lea eax, [esi + 0xf8]
add eax, ecx
cmp eax, edx
jae 0x4107a0
cmp dword [ecx + esi], 0x4550
jne 0x4107a0
mov eax, 0x14c
cmp word [ecx + esi + 4], ax
jne 0x4107a0
mov ecx, esi
call fcn.004107bf
mov ebx, eax
mov eax, edx
mov ecx, ebx
mov dword [ebp - 4], eax
or ecx, eax
jne 0x4107aa
mov edx, dword [ebp - 8]
add esi, dword [ebp + 8]
lea eax, [esi + 0x40]
cmp eax, edi
jb 0x41075b
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
mov edx, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4107bf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x34
push 0x41f6b0
call fcn.0041f50c
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], eax
or ecx, 1
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x28], 0x10
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x38]
push eax
push 3
lea eax, [ebp - 0x28]
push eax
push ecx
call dword [sym.imp.ntdll.dll_LdrFindResource_U]
jmp 0x410815
push 0xfffffffffffffffe
mov dword [ebp - 0x2c], eax
pop esi
mov dword [ebp - 4], esi
test eax, eax
js 0x41089f
mov dword [ebp - 4], 1
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x34]
call dword [sym.imp.ntdll.dll_LdrAccessResource]
jmp 0x41084e
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], esi
test eax, eax
js 0x41089f
mov dword [ebp - 4], 2
cmp dword [ebp - 0x44], 0x5c
jb 0x41088c
push 0x405b38
mov eax, dword [ebp - 0x30]
add eax, 6
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x41088c
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ecx + 0x34]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], esi
jmp 0x41089f
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
call fcn.0041f554
ret

Function at 0x410b64
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, edx
xor ecx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test esi, esi
je 0x410bf5
test eax, eax
je 0x410bf5
push ebx
lea edx, [esi + eax]
lea ebx, [esi + 0x10040]
mov dword [ebp - 0xc], edx
cmp ebx, edx
jbe 0x410b94
mov ebx, edx
push edi
mov edi, esi
lea eax, [esi + 0x40]
jmp 0x410bef
mov ecx, dword [eax - 4]
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x410be6
lea eax, [edi + 0xf8]
add eax, ecx
cmp eax, edx
jae 0x410be6
cmp dword [ecx + edi], 0x4550
jne 0x410be6
mov eax, 0x14c
cmp word [ecx + edi + 4], ax
jne 0x410be6
mov edx, esi
mov ecx, edi
sub edx, edi
add edx, dword [ebp - 8]
call fcn.00410c03
mov ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x410bf3
mov edx, dword [ebp - 0xc]
jmp 0x410be9
mov ecx, dword [ebp - 4]
add edi, dword [ebp + 8]
lea eax, [edi + 0x40]
cmp eax, ebx
jb 0x410b9c
pop edi
pop ebx
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x410e44
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
xor esi, esi
mov ebx, edx
test ecx, ecx
je 0x410ee9
test ebx, ebx
je 0x410ee9
push edi
xor edx, edx
call fcn.00411a8b
mov edi, eax
test edi, edi
je 0x410ea7
xor edx, edx
mov ecx, ebx
call fcn.00411a8b
mov esi, eax
test esi, esi
je 0x410ea7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x410e94
mov ecx, esi
call fcn.00411562
push dword [ebp + 8]
mov edx, esi
mov ecx, edi
sub esp, 0xc
call fcn.00410f00
mov ebx, eax
jmp 0x410eaa
mov ebx, dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
test edi, edi
je 0x410ec7
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
test esi, esi
je 0x410edc
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x410ef3
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410f00
Capabilities:
Copy file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], eax
mov esi, edx
test edi, 0xffffffe0
je 0x410f31
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4110d5
test edi, 1
je 0x410f3f
xor eax, eax
inc eax
mov dword [ebp - 8], eax
test edi, 8
je 0x410f4f
or eax, 0x1000
mov dword [ebp - 8], eax
xor edx, edx
call fcn.00411a8b
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4110d3
xor edx, edx
mov ecx, esi
call fcn.00411a8b
mov dword [ebp - 0x28], eax
test eax, eax
je 0x4110aa
xor eax, eax
mov dword [ebp - 4], eax
push dword [ebp - 8]
and dword [ebp - 0x14], 0
push 0
push 0
push 0
push esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
mov ebx, eax
test ebx, ebx
jne 0x411030
test edi, 2
je 0x4110aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc dword [ebp - 4]
lea edx, [ebp - 0xc]
and dword [ebp - 0xc], ebx
and dword [ebp - 0x10], ebx
push ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], eax
push ecx
mov ecx, eax
call fcn.004110e3
test eax, eax
je 0x410fe4
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jae 0x4110aa
lea eax, [ebp - 0x1c]
test eax, eax
je 0x410ffa
mov ebx, dword [ebp - 0x10]
jmp 0x410ffd
cmp dword [ebp - 4], 2
jae 0x4110aa
lea eax, [ebp - 0x1c]
mov ebx, 0xbb8
test eax, eax
jne 0x410ffd
mov ebx, dword [ebp - 0x14]
push ebx
push dword [ebp - 0x20]
push esi
push dword [ebp - 0x18]
push 0x405c30
push 0x4000000
push 0x4203b0
call fcn.00410c3d
add esp, 0x1c
test ebx, ebx
je 0x410f7a
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x410f7a
test edi, 4
je 0x4110aa
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, eax
test ebx, ebx
jne 0x4110aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x411059
push 0x1f
pop edi
push edi
push esi
push 0x405cc8
push 0x2000000
push 0x4203b0
call fcn.00410c3d
add esp, 0x14
mov ecx, esi
call fcn.00411562
test eax, eax
jne 0x4110a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41108a
push 0x1f
pop eax
push eax
push esi
push 0x405d68
push 0x2000000
push 0x4203b0
call fcn.00410c3d
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x24]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4110d3
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4118a3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push edi
xor edi, edi
test ecx, ecx
je 0x41190f
xor eax, eax
cmp ax, word [ecx]
je 0x41190f
push ebx
xor edx, edx
call fcn.00411a8b
mov ebx, eax
test ebx, ebx
je 0x41190a
push esi
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4118d7
test al, 0x10
je 0x4118d7
inc edi
jmp 0x4118f2
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x4118ea
mov esi, 0x10b
cmp esi, 2
jne 0x4118f2
push 3
pop esi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebx
mov eax, edi
pop edi
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
ret

Function at 0x411920
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
test ecx, ecx
je 0x4119f8
xor eax, eax
cmp ax, word [ecx]
je 0x4119f8
xor edx, edx
call fcn.00411a8b
mov edi, eax
test edi, edi
je 0x411a00
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4119d5
test eax, 0x800
je 0x4119d0
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4119d5
push esi
push 0x80
push 3
push esi
push 7
push 0xc0010000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x4119d5
xor ecx, ecx
xor edx, edx
push edx
mov word [ebp - 4], cx
lea ecx, [ebp - 0xc]
push ecx
push edx
push edx
push 2
lea ecx, [ebp - 4]
push ecx
push 0x9c040
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4119bd
inc ebx
jmp 0x4119c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4119dd
xor ebx, ebx
inc ebx
jmp 0x4119dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x411a02
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411c75
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor eax, eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
push edi
test esi, esi
je 0x411df9
cmp ax, word [esi]
je 0x411df9
push ebx
lea edx, [ebp - 4]
call fcn.00411a8b
mov ebx, eax
test ebx, ebx
je 0x411de4
xor eax, eax
lea edx, [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push ecx
push eax
mov ecx, ebx
call fcn.00411ee5
test eax, eax
js 0x411da6
cmp dword [ebp - 8], 1
push 0x5c
pop ecx
jne 0x411d46
mov edx, dword [ebp - 0xc]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x14]
jne 0x411ce3
mov eax, dword [ebp - 4]
sub ecx, esi
sar ecx, 1
lea esi, [eax + ecx*2]
test edx, edx
je 0x411d0e
push edx
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x5c
pop ecx
xor edi, edi
push ecx
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
mov esi, eax
pop ecx
mov ecx, ebx
test esi, esi
je 0x411d74
xor eax, eax
mov word [esi], ax
call fcn.004118a3
test eax, eax
jne 0x411d3b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x5c
pop ecx
mov word [esi], cx
add esi, 2
jmp 0x411d13
mov esi, dword [ebp - 4]
movzx eax, word [esi]
cmp eax, 0x61
jb 0x411d56
cmp eax, 0x7a
jbe 0x411d60
cmp eax, 0x41
jb 0x411d11
cmp eax, 0x5a
ja 0x411d11
push 0x3a
pop eax
cmp ax, word [esi + 2]
jne 0x411d11
cmp cx, word [esi + 4]
jne 0x411d11
add esi, 8
jmp 0x411d11
call fcn.004118a3
xor esi, esi
inc esi
cmp eax, esi
je 0x411da1
xor eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
je 0x411da1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push dword [ebp - 0x1c]
push 0x4060c8
jmp 0x411dbf
mov dword [ebp - 0x10], esi
jmp 0x411dd1
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push esi
push 0x406128
push 0x3000000
push 0x4203b0
call fcn.00410c3d
add esp, 0x14
push ebx
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x411dec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x10]
pop ebx
jmp 0x411e03
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414b71
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
mov dword [eax], edi
mov esi, edi
lea eax, [esp + 0xc]
mov dword [esp + 0x14], ecx
push eax
push edi
push ecx
mov dword [ebx], edi
mov dword [esp + 0x18], edi
call fcn.00413776
mov edi, eax
cmp edi, 0xc0000023
jne 0x414bf3
push dword [esp + 0xc]
mov eax, dword fs:[0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
jne 0x414bce
add edi, 0x77
jmp 0x414c0d
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push esi
push ecx
mov ecx, dword [esp + 0x20]
call fcn.00413776
mov edi, eax
test edi, edi
js 0x414bf7
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [ebx], esi
mov dword [ecx], eax
test edi, edi
jns 0x414c0d
test esi, esi
je 0x414c0d
mov eax, dword fs:[0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x414c1d
Capabilities:
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x420004]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x24], ecx
xor esi, esi
mov dword [esp + 0x10], esi
mov ebx, esi
mov dword [esp + 0x14], esi
mov eax, dword [edi + 0x18]
add eax, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], eax
cmp dword [eax], 2
jne 0x414d9f
cmp dword [edi + 0x14], ebx
jne 0x414cd7
mov edx, dword [edi + 0x1c]
mov eax, edx
and eax, 0xf000000
cmp eax, 0x2000000
jne 0x414d9f
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], esi
push eax
push esi
push esi
call fcn.00413776
mov esi, eax
cmp esi, 0xc0000023
jne 0x414da4
push dword [esp + 0x1c]
mov eax, dword fs:[0x30]
xor esi, esi
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
jne 0x414cbc
mov esi, 0xc000009a
jmp 0x414da4
mov edx, dword [edi + 0x1c]
lea eax, [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push eax
push ebx
push esi
call fcn.00413776
mov eax, dword [esp + 0x18]
mov edi, ebx
jmp 0x414ce4
cmp dword [edi + 0x14], 1
jne 0x414d9f
add edi, 0x20
lea esi, [eax + 0x14]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x20]
jne 0x414cec
sub ecx, edx
mov edx, edi
sar ecx, 1
lea eax, [edx + 2]
mov dword [esp + 0x18], eax
mov ax, word [edx]
add edx, 2
cmp ax, word [esp + 0x20]
jne 0x414d06
sub edx, dword [esp + 0x18]
sar edx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
mov word [esp + 0x12], ax
movzx eax, ax
push eax
xor eax, eax
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x414d4d
mov esi, 0xc000009a
jmp 0x414dc1
push esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
push edi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
lea eax, [esp + 0x10]
mov dword [esp + 0x28], 0x18
mov dword [esp + 0x30], eax
xor edi, edi
lea eax, [esp + 0x40]
mov dword [esp + 0x2c], edi
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x38], 0x40
push eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
call dword [sym.imp.ntdll.dll_ZwQueryAttributesFile]
mov esi, eax
jmp 0x414da6
mov esi, 0xc00000bb
xor edi, edi
cmp dword [esp + 0x14], 0
je 0x414dc1
push dword [esp + 0x14]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
je 0x414dd8
push ebx
xor eax, eax
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [esp + 0x6c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041ef80
mov esp, ebp
pop ebp
ret