joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x5e20e6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5e2101
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124a7326]
pop edx
test eax, eax
je 0x5e21d3
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5e21c2
test dword [ebp - 0x2a8], 1
jne 0x5e21c2
and dword [ebp - 0x2a8], 0x100
jne 0x5e21c2
push esi
push edx
push 4
push esi
call dword [edx + 0x122d3a16]
pop edx
pop esi
test eax, eax
je 0x5e2165
jmp 0x5e21c2
cmp word [esi], 0x5a4d
jne 0x5e21c2
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5e21c2
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d38e2]
pop edx
test eax, eax
je 0x5e21c2
lea eax, [ebp - 0x28c]
push eax
call fcn.005e2042
test eax, eax
jne 0x5e21bb
jmp 0x5e21c2
mov eax, esi
jmp 0x5e21d3
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5e2101
pop esi
leave
ret 4
Function at 0x40283d
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
mov edx, 0x14
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402844
mov edx, dword [esp + 0x5c]
lea ecx, [esp]
call fcn.004030f0
mov edx, dword [esp + 0x60]
lea ecx, [esp + 4]
call fcn.004030f0
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
call fcn.004030f0
lea eax, [esp + 0xc]
lea ebp, [esp + 0xc]
mov dword [ebp], 0x3c
mov dword [ebp + 4], 0x140
mov dword [ebp + 0x1c], 0
mov eax, 0x40a0f6
mov dword [ebp + 0xc], eax
mov eax, dword [esp]
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 8]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 4]
mov dword [ebp + 0x18], eax
lea eax, [esp + 0xc]
push eax
call sub.SHELL32.dll_ShellExecuteExA
mov dword [esp + 0x48], eax
push 0x19
call sub.KERNEL32.dll_Sleep
lea eax, [esp + 0x4c]
push eax
lea ebp, [esp + 0x10]
push dword [ebp + 0x38]
call sub.KERNEL32.dll_GetExitCodeProcess
and eax, eax
je 0x4028eb
mov ebx, dword [esp + 0x4c]
cmp ebx, 0x103
je 0x4028eb
jmp 0x4028ed
jmp 0x4028be
mov eax, 1
jmp 0x4028f6
push dword [esp]
call fcn.00407830
push dword [esp + 4]
call fcn.00407830
push dword [esp + 8]
call fcn.00407830
add esp, 0x50
pop ebx
pop ebp
ret 0xc

Function at 0x403afa
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x403b12
push dword [esp + 4]
push 0x403a93
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x403b4f
push esi
mov esi, dword [0x40b0d8]
test esi, esi
je 0x403b4e
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x403b46
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x40b0d8
call fcn.00406afd
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x403b1f
pop edi
pop ebx
pop esi
ret 4

Function at 0x403f37
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
push 0x64
pop edi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call esi
test eax, eax
je 0x403fdb
mov eax, dword [ebp - 0xc]
dec eax
je 0x403fbe
dec eax
jne 0x403fdb
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x403fba
dec eax
je 0x403fb6
dec eax
je 0x403f9c
dec eax
jne 0x403fdb
push 0x46
pop edi
lea eax, [ebp - 0xb8]
push eax
mov dword [ebp - 0xb8], 0x9c
call esi
test eax, eax
je 0x403fdb
cmp byte [ebp - 0x1e], 1
je 0x403fdb
push 0x4b
jmp 0x403fda
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x403fb2
dec eax
je 0x403fae
dec eax
jne 0x403fdb
push 0x41
jmp 0x403fda
push 0x3c
jmp 0x403fda
push 0x32
jmp 0x403fda
push 0x14
jmp 0x403fda
push 5
jmp 0x403fda
cmp dword [ebp - 0x14], 0
je 0x403fd8
cmp dword [ebp - 0x14], 0xa
je 0x403fd4
cmp dword [ebp - 0x14], 0x5a
jne 0x403fdb
push 0x28
jmp 0x403fda
push 0x1e
jmp 0x403fda
push 0xa
pop edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret
Function at 0x405f9c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 9
call esi
test al, al
jns 0x40600a
push 0x11
call esi
test al, al
js 0x40600a
push 0x10
call esi
test al, al
js 0x40600a
push 0x12
call esi
test al, al
js 0x40600a
mov esi, dword [sym.imp.USER32.dll_GetFocus]
push 5
lea eax, [ebp - 8]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
push 4
lea eax, [ebp - 8]
push 0x4090b4
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x40600a
push eax
push eax
push 0x44e
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test ax, 0x800
je 0x40602e
push 0x409078
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x40602e
dec eax
push eax
push dword [0x40b344]
call fcn.00406970
mov eax, dword [eax + 8]
jmp 0x406030
xor eax, eax
pop esi
leave
ret 4

Function at 0x4061f3
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x406266
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x406248
lea ecx, [eax - 1]
mov dl, byte [ecx]
cmp dl, 0x20
je 0x406246
cmp dl, 0x5c
je 0x406246
cmp dl, 0x2f
jne 0x406252
mov eax, ecx
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x406232
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x406268
xor eax, eax
leave
ret 4

Function at 0x406270
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x4062a5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x406530
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
mov dword [esp + 4], eax
je 0x406579
cmp byte [esi], al
je 0x406579
mov eax, dword [esp + 0xc]
mov ecx, dword [0x40b354]
push eax
push ecx
call fcn.00406970
test eax, eax
je 0x4065a7
cmp dword [eax + 4], 0
mov ecx, esi
push edi
lea edi, [ecx + 1]
je 0x406580
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x406565
sub ecx, edi
push ecx
push esi
push eax
call fcn.00406610
pop edi
pop esi
pop ecx
ret 8
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x406580
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
sub ecx, edi
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8
Function at 0x408860
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4231b8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00403a40
test al, al
je 0x40889d
xor al, al
jmp 0x4089d1
push esi
lea ecx, [ebp - 0x28]
call fcn.00403ad0
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.00408400
lea ecx, [ebp - 0x28]
call fcn.00404480
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4089be
lea ecx, [ebp - 0x40]
call fcn.00403ab0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040b380
test al, al
je 0x4088fe
lea ecx, [ebp - 0x40]
call fcn.00404480
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00403a50
cmp esi, 0xffffffff
jne 0x4089be
lea ecx, [ebp - 0x28]
call fcn.00403bc0
cmp eax, 2
jbe 0x4089ba
lea ecx, [ebp - 0x28]
call fcn.00403bc0
lea ecx, [ebp - 0x28]
lea ebx, [eax - 1]
call fcn.00403bb0
mov esi, eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x408943
mov ecx, dword [esi]
cmp word [ecx + ebx*2], 0x5c
je 0x408962
lea ecx, [ebp - 0x28]
call fcn.00403bc0
cmp dword [esi + 0x14], 8
jb 0x40895a
mov esi, dword [esi]
cmp word [esi + eax*2 - 2], 0x2f
jne 0x4089ba
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.00408400
lea ecx, [ebp - 0x28]
call fcn.00404480
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4089be
lea ecx, [ebp - 0x40]
call fcn.00403ab0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040b380
test al, al
je 0x4089a9
lea ecx, [ebp - 0x40]
call fcn.00404480
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00403a50
cmp esi, 0xffffffff
jne 0x4089be
xor bl, bl
jmp 0x4089c0
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403a50
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fa19
mov esp, ebp
pop ebp
ret
Function at 0x4089f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4231b8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00403a40
test al, al
je 0x408a2d
xor al, al
jmp 0x408b67
push esi
lea ecx, [ebp - 0x28]
call fcn.00403ad0
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.00408400
lea ecx, [ebp - 0x28]
call fcn.00404480
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x408a9b
lea ecx, [ebp - 0x40]
call fcn.00403ab0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040b380
test al, al
je 0x408a8a
lea ecx, [ebp - 0x40]
call fcn.00404480
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00403a50
cmp ebx, 0xffffffff
je 0x408aa4
test bl, 0x10
je 0x408b54
lea ecx, [ebp - 0x28]
call fcn.00403bc0
cmp eax, 2
jbe 0x408b50
lea ecx, [ebp - 0x28]
call fcn.00403bc0
lea ecx, [ebp - 0x28]
lea ebx, [eax - 1]
call fcn.00403bb0
mov esi, eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x408ad4
mov ecx, dword [esi]
cmp word [ecx + ebx*2], 0x5c
je 0x408af3
lea ecx, [ebp - 0x28]
call fcn.00403bc0
cmp dword [esi + 0x14], 8
jb 0x408aeb
mov esi, dword [esi]
cmp word [esi + eax*2 - 2], 0x2f
jne 0x408b50
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.00408400
lea ecx, [ebp - 0x28]
call fcn.00404480
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x408b4b
lea ecx, [ebp - 0x40]
call fcn.00403ab0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040b380
test al, al
je 0x408b3a
lea ecx, [ebp - 0x40]
call fcn.00404480
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00403a50
cmp ebx, 0xffffffff
je 0x408b50
test bl, 0x10
je 0x408b54
xor bl, bl
jmp 0x408b56
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403a50
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fa19
mov esp, ebp
pop ebp
ret
Function at 0x408b90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4231f0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00403a40
test al, al
je 0x408bcc
xor al, al
jmp 0x408c56
push esi
lea ecx, [ebp - 0x28]
call fcn.00403ad0
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.00408400
lea ecx, [ebp - 0x28]
call fcn.00404480
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x408c3a
lea ecx, [ebp - 0x40]
call fcn.00403ab0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040b380
test al, al
je 0x408c29
lea ecx, [ebp - 0x40]
call fcn.00404480
push eax
call esi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00403a50
cmp ebx, 0xffffffff
je 0x408c43
test bl, 0x10
je 0x408c43
mov bl, 1
jmp 0x408c45
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403a50
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fa19
mov esp, ebp
pop ebp
ret
Function at 0x408de0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423290
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00403a40
test al, al
je 0x408e1d
xor al, al
jmp 0x408fc9
mov ecx, edi
call fcn.00408b90
test al, al
je 0x408e2f
mov al, 1
jmp 0x408fc9
push 0
mov ecx, edi
call fcn.00404480
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call ebx
test eax, eax
jne 0x408e7e
lea ecx, [ebp - 0x28]
call fcn.00403ab0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.0040b380
test al, al
je 0x408e6f
push 0
lea ecx, [ebp - 0x28]
call fcn.00404480
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403a50
mov ecx, edi
call fcn.00408b90
test al, al
jne 0x408e28
mov ecx, edi
call fcn.00403bc0
xor esi, esi
mov dword [ebp - 0x44], eax
test eax, eax
je 0x408f6e
mov ecx, edi
call fcn.00403bb0
mov ebx, eax
mov ecx, dword [ebx + 0x14]
mov eax, ebx
cmp ecx, 8
jb 0x408eb2
mov eax, dword [ebx]
mov edx, 0x2f
cmp dx, word [eax + esi*2]
mov edx, 0x5c
je 0x408ed5
mov eax, ebx
cmp ecx, 8
jb 0x408ecb
mov eax, dword [ebx]
cmp dx, word [eax + esi*2]
jne 0x408f5e
push esi
push 0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.00404c90
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00403a40
test al, al
jne 0x408f4f
lea ecx, [ebp - 0x28]
call fcn.00408860
test al, al
jne 0x408f4f
push 0
lea ecx, [ebp - 0x28]
call fcn.00404480
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x408f4f
lea ecx, [ebp - 0x40]
call fcn.00403ab0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040b380
test al, al
je 0x408f43
push 0
lea ecx, [ebp - 0x40]
call fcn.00404480
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00403a50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403a50
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x408ea6
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, edi
call fcn.00408860
test al, al
jne 0x408fc2
push 0
mov ecx, edi
call fcn.00404480
push eax
call ebx
test eax, eax
jne 0x408fc2
lea ecx, [ebp - 0x40]
call fcn.00403ab0
mov dword [ebp - 4], 3
lea edx, [ebp - 0x40]
mov ecx, edi
call fcn.0040b380
test al, al
je 0x408fb3
push 0
lea ecx, [ebp - 0x40]
call fcn.00404480
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00403a50
mov ecx, edi
call fcn.00408b90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fa19
mov esp, ebp
pop ebp
ret
Function at 0x40af20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x43800c]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x40afa2
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x40afa2
test ecx, ecx
je 0x40af9e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x40af60
xor eax, eax
jmp 0x40afa7
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x40afb1
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040fa19
add esp, 0xc
ret 0xc
Function at 0x40b5a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x435b88
push 0x411170
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x43800c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x20], 0x100
mov eax, dword [ecx]
mov edi, dword [eax + 0x28]
mov dword [ebp - 0x40], edi
test edi, edi
jne 0x40b609
xor eax, eax
jmp 0x40b77f
mov dword [ebp - 4], ebx
push str.InitializeSecurityDescriptor
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b74a
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x40b74a
push str.AllocateAndInitializeSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b74a
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x24]
push ecx
call eax
test eax, eax
je 0x40b74a
push str.GetLengthSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b74a
push dword [ebp - 0x28]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x40b74a
push str.InitializeAcl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b74a
push 2
push dword [ebp - 0x30]
push esi
call eax
test eax, eax
je 0x40b74a
push str.AddAccessAllowedAce
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b74a
push dword [ebp - 0x28]
push 0x10000000
push 2
push esi
call eax
test eax, eax
je 0x40b74a
push str.SetSecurityDescriptorDacl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x40b74a
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x40b733
push 0
push ecx
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x40b720
mov ebx, 1
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x2c], 0
je 0x40b730
jmp 0x40b74a
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
push 0
push esi
push 1
push dword [ebp - 0x34]
call eax
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.0040b7a6
test ebx, ebx
jne 0x40b77d
test esi, esi
je 0x40b76f
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x40b77d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0040fa19
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40b990
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x43800c]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x40b9f5
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b9d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40b9f5
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0040fa19
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.0040fa19
add esp, 8
ret 4
Function at 0x40d3f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423e70
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x30], ecx
test esi, esi
je 0x40d571
cmp byte [esi + 0x54], 0
je 0x40d571
add esi, 0x1c
xor bl, bl
mov dword [ebp - 0x40], esi
mov byte [ebp - 0x3c], bl
test esi, esi
je 0x40d470
mov eax, dword [esi]
test eax, eax
je 0x40d46d
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40d464
cmp eax, 0x80
je 0x40d464
xor bl, bl
jmp 0x40d46a
mov byte [esi + 4], 1
mov bl, 1
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 0x3c], bl
push ecx
mov edx, ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00409ea0
add esp, 4
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00403bb0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [edi]
cmp dword [eax + 0x14], 8
jb 0x40d4af
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40d4fd
push 2
push 0
push 0
push edi
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x40d531
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d527
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d58f
push edx
push ecx
call fcn.0040fa5a
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 6
test esi, esi
je 0x40d563
test bl, bl
je 0x40d563
mov eax, dword [esi]
test eax, eax
je 0x40d55f
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 4], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040fa19
mov esp, ebp
pop ebp
ret 4
call fcn.00413b29
int3