joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov ebx, dword [ebp + 0xc]
mov dword [esp], ebx
call sym.___wine_dbg_get_channel_flags
movzx ecx, byte [ebp + 8]
movzx eax, al
sar eax, cl
test al, 1
je 0x401c48
mov edx, dword [0x404084]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edx
je 0x401c38
test byte [0x402018], 8
jne 0x401be0
lea edi, [esp + 0x28]
mov esi, edi
test byte [0x402028], 8
jne 0x401ba0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov ecx, str._04x:
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401afb
cmp dword [ebp + 8], 3
jbe 0x401b60
mov dword [esp], 2
mov ebx, edi
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov esi, dword [ebx]
add ebx, 4
lea ecx, [esi - 0x1010101]
not esi
and ecx, esi
and ecx, 0x80808080
je 0x401b0a
mov dword [esp + 0xc], eax
mov esi, ecx
mov eax, 1
mov dword [esp + 4], eax
shr esi, 0x10
test ecx, 0x8080
mov dword [esp], edi
cmove ecx, esi
lea esi, [ebx + 2]
mov dl, cl
cmove ebx, esi
add dl, cl
sbb ebx, 3
sub ebx, edi
mov dword [esp + 8], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0x10]
add eax, esi
inc ebx
mov dword [esp + 0x10], ebx
mov dword [esp], eax
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx*4 + 0x40311c]
mov edx, str._s:_s:_s
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov ecx, edi
sub ecx, eax
add ecx, 0xc8
mov dword [esp + 4], ecx
call sym._snprintf.constprop.0
jmp 0x401afb
mov dword [esp], 0x402028
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x401ad0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov ecx, str._04x:
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sym._sprintf
add esi, eax
jmp 0x401ad0
mov dword [esp], 0x402018
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x401abd
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov esi, str._3u._03u:
mov dword [esp + 4], esi
lea edi, [esp + 0x28]
mov dword [esp], edi
mov ecx, eax
mul edx
shr edx, 6
mov dword [esp + 8], edx
imul eax, edx, 0x3e8
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea esi, [edi + eax]
jmp 0x401ac3
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x401b58
Function at 0x401cd0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete dl
movzx edx, dl
inc edx
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x2965717c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0x6caa2070
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x47e177
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x47e10d
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x47e12b
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
add byte [eax], al
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x47e189
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x47e170
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x47e179
or byte [eax + ecx], 2
or byte [edx], al
cmp dword [ebp + 0x10], ebx
je 0x47e183
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x47e165
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x47e0ef
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x47e1d6
dec eax
je 0x47e1cd
sub eax, 3
je 0x47e1c4
mov dword [ebp - 4], 0x40
jmp 0x47e1f3
mov dword [ebp - 4], 4
jmp 0x47e1d9
mov dword [ebp - 4], 0x20
jmp 0x47e1d9
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x47e225
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x47e1a5
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0047da36
add al, 0xb8
dec edx
xor edi, edi
jne 0x47e230
push 1
push esi
call edi
mov eax, esi
jmp 0x47e231
rcr byte [edi + 0x5e], 0x5b

Function at 0x4853c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
push 5
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x485417
push edi
push esi
call fcn.0041f425
mov edi, eax
test edi, edi
je 0x485407
mov ebx, dword [ebx + 0x20]
cmp ebx, esi
je 0x485404
mov eax, esi
cmp ebx, eax
je 0x48541f
push eax
call fcn.0041dcf4
test eax, eax
jne 0x4853f6
mov ebx, dword [ebp - 4]
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x4853e1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0x18000000
cmp dword [ebp + 8], 0
jne 0x485449
cmp eax, 0x10000000
jne 0x485404
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [edi + 0x60], 2
jmp 0x485404
test eax, eax
jne 0x485404
test byte [edi + 0x60], 2
mov ebx, dword [ebp - 4]
je 0x485407
cmp dword [ebx + 0xe0], eax
jne 0x485407
push 4
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [edi + 0x60], 0xfffffffd
jmp 0x485407
Function at 0x5527fe
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x5f98cc
push str.FlsAlloc
push 0
call fcn.00552777
mov esi, eax
add esp, 0x10
test esi, esi
je 0x552830
push dword [ebp + 8]
mov ecx, esi
call fcn.0054ada1
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x552872
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x5f98f0
push str.FlsGetValue
push 2
call fcn.00552777
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x5528a3
mov ecx, esi
call fcn.0054ada1
call esi
jmp 0x5528a9
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x5528ac
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x5f9904
push str.FlsSetValue
push 3
call fcn.00552777
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x5528e0
mov ecx, esi
call fcn.0054ada1
call esi
jmp 0x5528e6
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x569be0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056989f

Function at 0x569beb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00569a22

Function at 0x56d7b8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056d0d0

Function at 0x56d7c3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056d30f
Function at 0x40134a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
pushal
std
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea edi, [esi + ecx + 7]
push esi
push ecx
lea esi, [esi + ecx]
dec esi
rep movsb byte es:[edi], byte [esi]
pop ecx
pop esi
lea eax, [ecx + 8]
mov dword [ebp - 4], eax
mov edi, esi
xor eax, eax
test cl, 3
je 0x401376
inc eax
shr ecx, 2
add ecx, eax
shl ecx, 2
call fcn.00401494
cld
stosd dword es:[edi], eax
mov edx, eax
lea eax, [ecx + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
stosd dword es:[edi], eax
shr ecx, 2
mov esi, edi
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
mov edx, eax
loop 0x401396
popal
mov eax, dword [ebp - 8]
leave
ret 8

Function at 0x40145c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
cld
mov esi, dword [ebp + 8]
mov edi, esi
lodsd eax, dword [esi]
mov edx, eax
lodsd eax, dword [esi]
mov ecx, eax
xor eax, eax
test cl, 3
je 0x401477
inc eax
sub ecx, 8
mov dword [ebp - 4], ecx
shr ecx, 2
add ecx, eax
lodsd eax, dword [esi]
mov ebx, eax
xor eax, edx
stosd dword es:[edi], eax
mov edx, ebx
loop 0x401482
popal
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x401d19
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
pushal
mov dword [ebp - 8], 0
cmp dword [ebp + 0x14], 1
jne 0x401d34
mov dword [ebp + 0x14], 3
push 0
push pe_nt_image_headers32
push 2
push 0
push dword [ebp + 0x14]
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
inc eax
je 0x401d72
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.kernel32.dll_WriteFile]
mov dword [ebp - 8], eax
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
popal
mov eax, dword [ebp - 8]
leave
ret 0x10
Function at 0x401e41
Capabilities:
Get file attributes
Get file size
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0x64
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
push pe_nt_image_headers32
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
inc eax
je 0x401efa
push 0
push ebx
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ecx, dword [ebp + 0x14]
jecxz 0x401ea0
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
jecxz 0x401ea7
mov eax, ecx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x401ec0
push dword [ebp + 0x10]
push 0x40
call dword [sym.imp.kernel32.dll_LocalAlloc]
test eax, eax
je 0x401f1e
mov esi, eax
mov edi, esi
lea eax, [ebp - 0xc]
push 0
push eax
push dword [ebp + 0x10]
push esi
push ebx
call dword [sym.imp.kernel32.dll_ReadFile]
mov eax, dword [ebp - 0xc]
sub dword [ebp + 0x10], eax
je 0x401ef5
test eax, eax
je 0x401ef5
add esi, eax
dec dword [ebp - 8]
jne 0x401ec4
cmp dword [ebp + 0xc], 0
je 0x401f1e
push edi
call dword [sym.imp.kernel32.dll_LocalFree]
mov dword [ebp - 0x10], edi
jmp 0x401f1e
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
inc eax
jne 0x401e90
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
popal
mov eax, dword [ebp - 0x10]
leave
ret 0x10

Function at 0x401ff1
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
pushal
call 0x40202a
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x40206f
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
inc ebx
jne 0x402090
jb 0x402085
outsb dx, byte [esi]
je 0x402079
jb 0x402099
imul ebp, dword [edi + 0x6e], 0x85c75e00
invalid
mov dword [ebp - 4], 0x186a0
add dword [eax], eax
push 0
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push dword [ebp - 0x10c]
mov ch, 0xf8
invalid
call dword [sym.imp.advapi32.dll_RegEnumKeyExA]
cmp eax, 0x103
add byte [eax], al
je 0x402101
lea edx, [ebp - 0x104]
push edx
call fcn.00401f86
cmp eax, 1
je 0x4020b6
inc dword [ebp - 0x108]
jmp 0x40206a
cmp dword [ebp + 8], 0
je 0x4020f7
lea edx, [ebp - 0x104]
push edx
push esi
call fcn.004012ea
push dword [ebp + 8]
push eax
call fcn.004010d7
cmp dword [ebp + 0xc], 0
je 0x4020f7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 8
push 0
push 0
push dword [ebp - 0x10c]
call dword [sym.imp.advapi32.dll_RegGetValueA]
cmp eax, 0
jne 0x402101
mov dword [ebp - 0x110], 1
push dword [ebp - 0x10c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
popal
mov eax, dword [ebp - 0x110]
leave
ret 0xc
Function at 0x40202a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
pushal
call 0x40202a
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x40206f
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
inc ebx
jne 0x402090
jb 0x402085
outsb dx, byte [esi]
je 0x402079
jb 0x402099
imul ebp, dword [edi + 0x6e], 0x85c75e00
invalid
mov dword [ebp - 4], 0x186a0
add dword [eax], eax
push 0
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push dword [ebp - 0x10c]
mov ch, 0xf8
invalid
call dword [sym.imp.advapi32.dll_RegEnumKeyExA]
cmp eax, 0x103
add byte [eax], al
je 0x402101
lea edx, [ebp - 0x104]
push edx
call fcn.00401f86
cmp eax, 1
je 0x4020b6
inc dword [ebp - 0x108]
jmp 0x40206a
cmp dword [ebp + 8], 0
je 0x4020f7
lea edx, [ebp - 0x104]
push edx
push esi
call fcn.004012ea
push dword [ebp + 8]
push eax
call fcn.004010d7
cmp dword [ebp + 0xc], 0
je 0x4020f7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 8
push 0
push 0
push dword [ebp - 0x10c]
call dword [sym.imp.advapi32.dll_RegGetValueA]
cmp eax, 0
jne 0x402101
mov dword [ebp - 0x110], 1
push dword [ebp - 0x10c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
popal
mov eax, dword [ebp - 0x110]
leave
ret 0xc

Function at 0x4023bd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
pushal
mov edi, 0x413108
push 0
push 0xa
push edi
call fcn.004013f7
push edi
call fcn.0040127a
add edi, eax
lea edx, [eax + 1]
inc edi
push edi
mov esi, 0x4091ad
mov ecx, 0x14
rep movsb byte es:[edi], byte [esi]
mov esi, 0x409149
mov ecx, 0x64
rep movsb byte es:[edi], byte [esi]
mov esi, 0x4091c1
mov ecx, 0x4188
rep movsb byte es:[edi], byte [esi]
pop edi
lea eax, [edx + 0x4200]
push eax
push 0x413108
call fcn.0040134a
mov edi, eax
push section..bss
call fcn.0040236d
push 0
push section..bss
push 0x40d4ce
call fcn.004021bb
push 1
push 0
push 0
push 0
call fcn.0040248b
push section..bss
push 0x40d3f5
call fcn.004012ea
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
cmp eax, 0
jne 0x402488
push edi
push 0x413108
push 3
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegSetValueExA]
popal
leave
ret
Function at 0x40248b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
pushal
push 0
push pe_nt_image_headers32
push 4
push 0
push 0
push 0xc0000000
push str.C__
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 0x410], eax
inc eax
je 0x40266a
push 0
push 0x400
lea edx, [ebp - 0x408]
push edx
call fcn.0040122d
push 2
push 0
push 0
push dword [ebp - 0x410]
call dword [sym.imp.kernel32.dll_SetFilePointer]
cmp dword [ebp + 0x14], 1
je 0x4025cf
mov dword [ebp - 8], 0x20
mov dword [ebp - 4], 0x22
push 0x405076
lea edx, [ebp - 0x408]
push edx
call fcn.004010d7
lea edx, [ebp - 8]
push edx
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
push dword [ebp + 8]
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
lea edx, [ebp - 8]
push edx
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
push dword [ebp + 0xc]
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
push section..data
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
push str._6WZE2____r
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
push dword [ebp + 0x10]
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
push section..data
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
jmp 0x402635
push 0x40501d
lea edx, [ebp - 0x408]
push edx
call fcn.004010d7
push section..bss
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
push 0x405072
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
push section..data
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
push 0x40507b
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
push section..data
lea edx, [ebp - 0x408]
push edx
call fcn.0040120e
lea edx, [ebp - 0x408]
push edx
call fcn.0040127a
push 0
lea edx, [ebp - 0x40c]
push edx
push eax
lea edx, [ebp - 0x408]
push edx
push dword [ebp - 0x410]
call dword [sym.imp.kernel32.dll_WriteFile]
push dword [ebp - 0x410]
call dword [sym.imp.kernel32.dll_CloseHandle]
popal
leave
ret 0x10

Function at 0x4027f2
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov dword [ebp - 0x108], 0
push 0x104
lea edx, [ebp - 0x104]
push edx
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
je 0x40288d
push 0x40d3a8
push 0
push 0
lea edx, [ebp - 0x104]
push edx
call fcn.00401e41
test eax, eax
je 0x40288d
cld
mov ecx, dword [0x40d3a8]
mov esi, eax
lodsd eax, dword [esi]
cmp ax, 0x4558
jne 0x402850
rol eax, 0x10
cmp ax, 0x5952
je 0x402857
sub esi, 3
loop 0x402840
jmp 0x40288d
sub ecx, 4
push ecx
push esi
push 0x40d62a
push 0x40d624
push 0x42bac4
call fcn.00401d7a
test eax, eax
je 0x40288d
push 2
push 0x42bac4
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
push 0
push 0x42bac4
call fcn.0040414d
popal
mov eax, dword [ebp - 0x108]
leave
ret
Function at 0x4035dd
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
mov dword [ebp - 7], 0
mov dword [ebp - 0xf], 0
mov dword [ebp - 0xb], 0
xor ebx, ebx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00404776
mov esi, eax
mov edi, dword [ebp + 0xc]
push 0
push 0x39
lea edx, [ebp - 0x48]
push edx
call fcn.0040122d
mov ecx, esi
lea edx, [ebp - 0x48]
call fcn.004014c9
test eax, eax
jne 0x40364d
mov edx, dword [ebp + 0xc]
add edx, ebx
push edx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x24]
push dword [ebp + 8]
call fcn.004046b2
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp + 0x10]
cmp ecx, eax
jbe 0x403697
sub eax, edx
jmp 0x40368c
cmp byte [ebp - 0x30], 0xcc
jne 0x403658
inc dword [ebp - 0xf]
jmp 0x403687
mov ecx, dword [ebp - 0xf]
jecxz 0x403687
cmp ecx, dword [ebp + 0x14]
jb 0x403680
mov eax, edi
sub eax, ecx
push ecx
push eax
push dword [ebp + 0x18]
call fcn.0040356a
cmp eax, 1
jne 0x403697
add dword [ebp - 0xb], ecx
mov eax, dword [ebp - 0xb]
cmp eax, dword [ebp + 0x28]
jae 0x403697
mov dword [ebp - 0xf], 0
xor eax, eax
mov al, byte [ebp - 0x48]
add esi, eax
add edi, eax
add ebx, eax
cmp ebx, dword [ebp + 0x10]
jb 0x40361a
popal
mov eax, dword [ebp - 0xb]
leave
ret 0x24
Function at 0x40393d
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
pushal
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
push 0x40f23a
push 0x40f12c
push dword [ebp + 8]
call fcn.00402bbf
cmp eax, 0
je 0x403b95
push dword [ebp + 8]
call fcn.004038b2
mov dword [ebp - 4], eax
push eax
call fcn.00403916
push 0
push 0x40f12c
push 0x40513e
call fcn.004021bb
push 0
push 0x40f23a
push 0x405134
call fcn.004021bb
lea edx, [ebp - 0x88]
push edx
push 0
push 0
push dword [ebp + 8]
call fcn.00401e41
test eax, eax
je 0x403b95
mov dword [ebp - 0x8c], eax
push 0x10000
call fcn.00401c84
test eax, eax
je 0x403b95
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x60]
push edx
lea edx, [ebp - 0x7c]
push edx
lea edx, [ebp - 0x80]
push edx
lea edx, [ebp - 0x84]
push edx
lea edx, [ebp - 0x6c]
push edx
lea edx, [ebp - 0x78]
push edx
push dword [ebp - 0x8c]
call fcn.00402b46
cmp dword [ebp - 0x84], 0
je 0x403b95
push dword [ebp - 4]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x10]
push edx
push 0xa6
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push dword [ebp - 0x6c]
push dword [ebp - 0x84]
push dword [ebp - 0x8c]
call fcn.004032e8
push dword [ebp - 0xc]
push 0x40d4d7
call fcn.0040369f
push dword [ebp - 0x10]
push 0x40d4f5
call fcn.0040369f
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push dword [ebp - 0x84]
push dword [ebp - 0x8c]
call fcn.004036c3
push eax
push 0x40d509
call fcn.0040369f
cmp eax, dword [ebp - 0xc]
jae 0x403a9a
jmp 0x403b95
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push dword [ebp - 0x84]
push dword [ebp - 0x8c]
call fcn.00403771
test eax, eax
je 0x403b95
mov byte [0x42cfd9], 0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0xa6
push 0x40d9b0
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x8c]
call fcn.004030c0
push eax
push 0x40d51b
call fcn.0040369f
cmp eax, 0
je 0x403b95
push dword [ebp + 8]
push 0x40d35b
call fcn.00401c15
push 0x40f12c
push 0x40d36b
call fcn.00401c15
push dword [ebp - 0x14]
call fcn.00401ca1
push dword [ebp - 0x18]
call fcn.00401ca1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
push 0x40f12c
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_MoveFileA]
push 0
push dword [ebp + 8]
push 0x40f12c
call dword [sym.imp.kernel32.dll_CopyFileA]
push 0
push 0x42cfd9
push dword [ebp + 8]
push 0x40f12c
call fcn.0040248b
push 0
push dword [ebp - 0x88]
push dword [ebp - 0x8c]
push dword [ebp + 8]
call fcn.00401d19
test eax, eax
je 0x403b95
push dword [ebp - 0x84]
push 0x40f23a
call fcn.004041e8
mov dword [ebp - 0xa0], 1
cmp dword [ebp - 0x14], 0
je 0x403ba3
push dword [ebp - 0x14]
call fcn.00401ca1
cmp dword [ebp - 0x18], 0
je 0x403bb1
push dword [ebp - 0x18]
call fcn.00401ca1
popal
mov eax, dword [ebp - 0xa0]
leave
ret 4