joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407730
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x407750
jl 0x407747
cmp dword [ebp + 0xc], 0
ja 0x407750
xor eax, eax
xor edx, edx
jmp 0x407887
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x407772
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.00407890
jmp 0x407887
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call fcn.00404e20
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x4077e1
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.004022e0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.00406370
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00405c70
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.00406280
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x407878
mov ecx, dword [ebp - 8]
call fcn.004054f0
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x407851
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0040e3d3
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x40784f
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x407887
jmp 0x4077fd
cmp dword [ebp - 4], 0
jbe 0x407878
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.0040e3d3
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41522f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004150a5
Function at 0x4027b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41e289
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
mov dword [esp + 0x10], 0
mov eax, dword [0x429054]
push esi
push edi
mov dword [esp + 0x14], eax
mov ebp, 1
push 0xf
mov dword [esp + 0x28], ebp
call fcn.0041563f
mov cl, byte [esp + 0x38]
mov dword [eax], ebp
mov byte [eax + 0xe], 0
mov ebx, 2
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
add eax, 0xc
mov byte [eax], cl
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov byte [eax + 1], 0
call fcn.00401800
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esi - 8], eax
mov byte [eax + esi], 0
mov ecx, dword [esi - 8]
mov edx, dword [esp + 0x30]
mov eax, dword [edx]
push esi
push ecx
push eax
mov eax, dword [eax - 8]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x34], bl
call fcn.00401a90
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx - 0xc]
test eax, eax
mov ecx, dword [esp + 0x2c]
lea edi, [ebx - 0xc]
jl 0x402867
push edi
mov dword [ecx], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x402875
mov edx, dword [0x429054]
push ebx
mov dword [ecx], edx
call fcn.004019c0
mov ecx, dword [0x429050]
lea eax, [esi - 0xc]
cmp eax, ecx
mov dword [esp + 0x18], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov byte [esp + 0x24], 1
je 0x4028a4
add esi, 0xfffffff4
push esi
call ebp
test eax, eax
jg 0x4028a4
push esi
call fcn.0041563a
add esp, 4
mov eax, dword [0x429050]
add ebx, 0xfffffff4
cmp ebx, eax
mov byte [esp + 0x24], 0
je 0x4028c5
push edi
call ebp
test eax, eax
jg 0x4028c5
push edi
call fcn.0041563a
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x403660
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push esi
push str.EPSON_StatusMonitor3_Environment_Check
xor esi, esi
push 1
push esi
mov dword [0x429de8], eax
mov dword [0x429cbc], ecx
mov dword [0x429cc4], esi
mov dword [0x429de0], esi
mov dword [0x429de4], esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, esi
mov dword [0x429cb4], eax
je 0x4036b1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov dword [0x429cb0], esi
je 0x4036bb
mov dword [0x429cb0], 1
mov eax, 1
pop esi
ret
Function at 0x403770
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41e378
push eax
mov eax, dword [0x429cc0]
mov dword fs:[0], esp
sub esp, 8
test eax, eax
je 0x40384e
cmp byte [0x429cc8], 0x30
je 0x40384e
push esi
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
push 0x429cc8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40384d
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x403846
lea ecx, [esp + 4]
call fcn.004017b0
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
call fcn.00401e70
push 0
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
call fcn.00402ca0
push eax
lea ecx, [esp + 0x10]
call fcn.00402cb0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x403835
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00401910
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x403860
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41e398
push eax
mov eax, dword [0x429cc0]
mov dword fs:[0], esp
sub esp, 8
test eax, eax
je 0x403940
cmp byte [0x429cc8], 0x30
je 0x403940
push esi
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
push 0x429cc8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40393f
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40393f
lea ecx, [esp + 4]
call fcn.00402cf0
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
call fcn.004030b0
push 0
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
call fcn.00402ca0
shl eax, 1
push eax
lea ecx, [esp + 0x10]
call fcn.00402cb0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x403927
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00402cc0
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4039a0
Capabilities:
Get number of processors
Inspect load icon resource

Disassembly:
push 0xffffffffffffffff
push 0x41e3bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, dword [str.InstallExeClass]
mov ecx, dword [0x42035c]
mov edx, dword [0x420360]
mov dword [esp + 4], eax
mov eax, dword [0x420364]
push edi
mov dword [esp + 0x14], eax
mov eax, dword [0x429de8]
push 0x80
xor edi, edi
push eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], 0x2000
mov dword [esp + 0x24], 0x4036d0
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea edx, [esp + 0x18]
lea ecx, [esp + 8]
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x403a4c
xor eax, eax
pop edi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret
mov eax, dword [0x429de8]
push esi
push edi
push eax
push edi
push edi
push 0x64
push 0x64
push edi
push edi
push 0x20cf0000
push str.StatusMonitor3_Environment_Check
lea ecx, [esp + 0x34]
push ecx
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
cmp esi, edi
jne 0x403a8b
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret
push edi
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xf8
call fcn.0041563f
add esp, 4
mov dword [esp + 8], eax
cmp eax, edi
mov dword [esp + 0x4c], edi
je 0x403ab5
mov ecx, eax
call fcn.004054f0
jmp 0x403ab7
xor eax, eax
mov dword [0x429ddc], eax
mov dword [eax + 4], esi
mov edx, dword [0x429cbc]
mov eax, dword [0x429cb0]
mov ecx, dword [0x429ddc]
push edx
push eax
mov dword [esp + 0x54], 0xffffffff
call fcn.00410950
mov ecx, dword [0x429ddc]
call fcn.00405860
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [esp + 0x44]
mov eax, esi
pop esi
pop edi
mov dword fs:[0], ecx
add esp, 0x48
ret
Function at 0x403b10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
je 0x403b34
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x20019
push ebx
push ebx
push str.SoftwareEPSONSTM3
push 0x80000002
lea ecx, [esp + 0x20]
mov dword [0x429cc0], ebx
call fcn.00413990
cmp dword [esp + 0x14], ebx
je 0x403b74
push ebx
push str.instlog
lea ecx, [esp + 0x14]
call fcn.004138b0
neg eax
sbb eax, eax
neg eax
mov dword [0x429cc0], eax
xor eax, eax
mov ecx, 0x44
mov edi, 0x429cc8
rep stosd dword es:[edi], eax
push 0x429cc8
push 0x111
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
mov eax, 0x429cc8
je 0x403bd2
mov ecx, 0x111
cmp byte [eax], 0
je 0x403bac
inc eax
dec ecx
jne 0x403ba1
jmp 0x403bf9
cmp ecx, ebx
je 0x403bf9
mov eax, 0x111
sub eax, ecx
push str.E_SSINSx.log
mov ecx, 0x111
sub ecx, eax
push ecx
lea edx, [eax + 0x429cc8]
push edx
call fcn.00401190
jmp 0x403bf9
mov edx, str.c:E_SSINSx.log
mov esi, 0x111
sub edx, 0x429cc8
mov cl, byte [edx + eax]
test cl, cl
je 0x403bf1
mov byte [eax], cl
inc eax
dec esi
jne 0x403be2
jmp 0x403bf5
cmp esi, ebx
jne 0x403bf6
dec eax
mov byte [eax], 0
push str._LOG_START__n
call fcn.00403770
add esp, 4
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [esp + 0x3c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x38]
push ecx
push str.File_Name_:__s_n
call fcn.00403770
push str.4.02
push str.File_Version_:__s_n
call fcn.00403770
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push edx
push eax
call fcn.00403660
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.004039a0
add esp, 0x1c
test eax, eax
jne 0x403c96
mov ecx, dword [0x429ddc]
cmp ecx, ebx
je 0x403c75
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [0x429ddc], ebx
push str._LOG_END__InitInstance_error___n
call fcn.00403770
add esp, 4
lea ecx, [esp + 0xc]
call fcn.00413420
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
call esi
cmp eax, ebx
je 0x403ce9
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
cmp eax, 0xffffffff
je 0x403cdc
lea ecx, [esp + 0x1c]
push ecx
call edi
lea edx, [esp + 0x1c]
push edx
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
jne 0x403cb6
jmp 0x403ce9
push str.GetMessage_:_error_n
call fcn.00403770
add esp, 4
mov ecx, dword [0x429ddc]
test ecx, ecx
je 0x403d03
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [0x429ddc], 0
push str._LOG_END__n_n
call fcn.00403770
mov esi, dword [esp + 0x28]
add esp, 4
lea ecx, [esp + 0xc]
call fcn.00413420
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403d80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
lea eax, [esp + 8]
push eax
xor ebp, ebp
push str.SystemCurrentControlSetControlProductOptions
xor ebx, ebx
push 0x80000002
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403e56
mov eax, dword [esp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push ecx
push ebp
lea edx, [esp + 0x1c]
push edx
push ebp
push str.ProductSuite
push eax
call esi
test eax, eax
jne 0x403e55
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x403e55
push edi
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebp
je 0x403e54
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edi
lea edx, [esp + 0x20]
push edx
push ebp
push str.ProductSuite
push eax
call esi
test eax, eax
jne 0x403e47
cmp dword [esp + 0x18], 7
jne 0x403e47
cmp byte [edi], 0
mov esi, edi
je 0x403e47
mov ebp, dword [esp + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push ebp
push esi
call ebx
test eax, eax
je 0x403e3f
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x403e25
jmp 0x403e47
mov dword [esp + 0x1c], 1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [esp + 0x1c]
xor ebp, ebp
pop edi
pop esi
mov eax, dword [esp + 8]
cmp eax, ebp
je 0x403e65
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret 4
Function at 0x403e70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x140
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x28], 2
jne 0x403f6a
mov eax, dword [esp + 0x1c]
cmp eax, 4
jbe 0x403ed4
mov ecx, dword [esp + 0x20]
test ecx, ecx
jbe 0x403ed4
mov dword [esi + 8], 1
mov eax, dword [esi + 8]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 5
ja 0x403ec2
cmp eax, 4
jbe 0x403f75
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.ntdll.dll
call edi
test eax, eax
je 0x403f6a
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.VerSetConditionMask
push eax
call ebp
test eax, eax
je 0x403f6a
push 6
push 0x40
push 0
push 0
call eax
push str.KERNEL32.DLL
mov esi, eax
mov ebx, edx
call edi
test eax, eax
je 0x403f66
push str.VerifyVersionInfoA
push eax
call ebp
mov edx, eax
test edx, edx
je 0x403f66
push ebx
xor eax, eax
push esi
mov ecx, 0x27
lea edi, [esp + 0xb8]
rep stosd dword es:[edi], eax
push 0x40
lea ecx, [esp + 0xbc]
push ecx
mov dword [esp + 0xc0], 0x9c
mov word [esp + 0x158], 0x10
call edx
mov edx, dword [esp + 0x14]
mov dword [edx + 8], eax
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 8]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push str.Terminal_Server
mov ecx, esi
call fcn.00403d80
pop edi
mov dword [esi + 8], eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4040d0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x41e508
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
push esi
push edi
lea eax, [esp + 8]
xor edi, edi
push eax
lea ecx, [esp + 0x15c]
mov dword [esp + 0x154], edi
call fcn.00402ca0
push eax
lea ecx, [esp + 0x160]
call fcn.00401c00
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0xffffffffffffffff
lea ecx, [esp + 0x15c]
mov esi, eax
call fcn.00401ca0
cmp esi, 0xffffffff
jne 0x404157
cmp dword [esp + 0x15c], 1
jne 0x40416a
push edi
lea ecx, [esp + 0x15c]
call fcn.00402cb0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 1
jne 0x40416a
mov edi, eax
jmp 0x40416a
test byte [esp + 8], 0x10
je 0x404163
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x158]
mov dword [esp + 0x150], 0xffffffff
call fcn.00401910
mov ecx, dword [esp + 0x148]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14c
ret 8
Function at 0x4041a0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41e508
push eax
mov dword fs:[0], esp
push ebx
push esi
xor esi, esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], esi
call fcn.00402ca0
push eax
lea ecx, [esp + 0x1c]
call fcn.00401c00
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
mov ebx, eax
call fcn.00401ca0
cmp ebx, 0xffffffff
je 0x404227
test bl, 1
je 0x404222
and ebx, 0xfffffffe
push ebx
lea ecx, [esp + 0x1c]
call fcn.00402ca0
push eax
lea ecx, [esp + 0x20]
call fcn.00401c00
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x404215
mov esi, 1
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
call fcn.00401ca0
jmp 0x404227
mov esi, 1
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00401910
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4

Function at 0x404250
Capabilities:
Check if file exists

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41e508
push eax
mov dword fs:[0], esp
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push esi
push 0xc0000000
push esi
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], esi
call fcn.00401c00
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x40429a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4042b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4042ac
mov esi, 1
jmp 0x4042b9
xor ecx, ecx
cmp eax, 0x20
setne cl
add ecx, 2
mov esi, ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.00401910
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4

Function at 0x4042e0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x41e508
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
push ebx
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push ebx
lea ecx, [esp + 0x168]
mov dword [esp + 0x160], ebx
call fcn.00401c00
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404371
push ecx
lea edx, [esp + 0x164]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
call fcn.00402330
mov ecx, edi
call fcn.00404250
sub eax, ebx
je 0x404354
sub eax, 2
jne 0x404371
mov ebx, 1
jmp 0x404371
push ebx
lea ecx, [esp + 0x164]
call fcn.00401c00
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x404371
mov ebx, 2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x160]
mov dword [esp + 0x158], 0xffffffff
call fcn.00401910
mov ecx, dword [esp + 0x150]
pop edi
pop esi
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
add esp, 0x150
ret 4
Function at 0x4043d0
Capabilities:
Access peb ldr_data
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x41e438
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
mov esi, ecx
push 0x4202c0
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x30], 3
xor ebp, ebp
call fcn.004024e0
add esp, 8
mov edx, esp
mov dword [esp + 0x1c], esp
lea ecx, [esp + 0x3c]
push ecx
push eax
push edx
mov byte [esp + 0x34], 4
call fcn.00402410
add esp, 0xc
mov ecx, esi
call fcn.00404250
lea ecx, [esp + 0xc]
mov esi, eax
mov byte [esp + 0x24], 3
call fcn.00401910
test esi, esi
je 0x404450
cmp esi, 1
je 0x404450
cmp esi, 2
jmp 0x404507
push 0x4202c0
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.004024e0
lea ecx, [esp + 0x44]
push ecx
push eax
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x3c], 5
call fcn.00402410
mov esi, eax
push 0x4202c0
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + 0x48], 6
call fcn.004024e0
lea edx, [esp + 0x54]
push edx
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x54], 7
call fcn.00402410
add esp, 0x30
mov edi, eax
push 0
mov ecx, esi
mov byte [esp + 0x28], 8
call fcn.00402cb0
push eax
mov ecx, edi
call fcn.00402cb0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0xc]
mov esi, eax
mov byte [esp + 0x24], 7
call fcn.00401910
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 6
call fcn.00401910
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 5
call fcn.00401910
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 3
call fcn.00401910
test esi, esi
jne 0x40450e
mov ebp, 2
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 2
call fcn.00401910
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 1
call fcn.00401910
lea ecx, [esp + 0x34]
mov byte [esp + 0x24], 0
call fcn.00401910
lea ecx, [esp + 0x38]
mov dword [esp + 0x24], 0xffffffff
call fcn.00401910
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, ebp
mov dword fs:[0], ecx
pop ebp
add esp, 0x1c
ret 0x10
Function at 0x4047e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x41e4f2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebp
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x28]
push eax
mov ebp, 1
push 0x105
mov dword [esp + 0x248], ebp
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x404827
xor ebp, ebp
jmp 0x4049ad
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404830
sub eax, edx
mov byte [esp + eax + 0x27], cl
push 0x4202b4
lea ecx, [esp + 0x10]
call fcn.00402390
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x24c]
mov byte [esp + 0x244], 2
call fcn.00401540
test eax, eax
je 0x40486f
lea edx, [esp + 0x28]
push edx
jmp 0x404892
push 0x105
lea eax, [esp + 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40499a
lea ecx, [esp + 0x130]
push ecx
lea ecx, [esp + 0x10]
call fcn.004019c0
push 0x4202c0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.004024e0
push str.ebapiext
push eax
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x258], 3
call fcn.004024e0
add esp, 0x18
lea esi, [edi + 4]
push eax
mov ecx, esi
mov byte [esp + 0x244], 4
call fcn.00401940
lea ecx, [esp + 0x10]
mov byte [esp + 0x240], 3
call fcn.00401910
lea ecx, [esp + 0x14]
mov byte [esp + 0x240], 2
call fcn.00401910
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00402330
mov ecx, edi
call fcn.004040d0
cmp eax, 1
jne 0x40498e
push ecx
lea edx, [esp + 0x250]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.00402330
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
mov byte [esp + 0x24c], 5
call fcn.00402330
push ecx
lea eax, [esp + 0x258]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
mov byte [esp + 0x250], 6
call fcn.00402330
push ecx
lea edx, [esp + 0x258]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x254], 7
call fcn.00402330
mov ecx, edi
mov byte [esp + 0x250], 2
call fcn.004043d0
test eax, eax
je 0x40499c
mov ecx, esi
push 0x4202b4
call fcn.004019c0
xor ebp, ebp
lea ecx, [esp + 0xc]
mov byte [esp + 0x240], 1
call fcn.00401910
lea ecx, [esp + 0x248]
mov byte [esp + 0x240], 0
call fcn.00401910
lea ecx, [esp + 0x24c]
mov dword [esp + 0x240], 0xffffffff
call fcn.00401910
mov ecx, dword [esp + 0x238]
pop edi
pop esi
mov eax, ebp
mov dword fs:[0], ecx
pop ebp
add esp, 0x238
ret 8