joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b750
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x42a6f0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x437368]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437368]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov ebp, 7
mov esi, ecx
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x60], ebx
call fcn.0040b910
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x40]
mov byte [esp + 0x68], 1
call fcn.00401600
mov edi, 8
mov byte [esp + 0x60], bl
cmp dword [esp + 0x34], edi
jb 0x40b7d6
mov eax, dword [esp + 0x20]
push eax
call fcn.00414041
add esp, 4
cmp dword [esp + 0x4c], 0x24
je 0x40b809
push 0xffffffffffffffff
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
push ebx
lea eax, [esp + 0x40]
mov ecx, esi
mov word [esi + 4], bx
call fcn.00401600
cmp dword [esp + 0x50], edi
jb 0x40b8e2
mov ecx, dword [esp + 0x3c]
push ecx
jmp 0x40b8da
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x42f96c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40b859
push ebx
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
push 0x42f3d4
mov word [esi + 4], bx
call fcn.00401560
cmp dword [esp + 0x50], edi
jb 0x40b8e2
mov ecx, dword [esp + 0x3c]
push ecx
jmp 0x40b8da
cmp dword [esp + 0x50], edi
mov eax, dword [esp + 0x3c]
jae 0x40b867
lea eax, [esp + 0x3c]
mov edx, dword [esp + 0x4c]
lea ecx, [edx + edx + 2]
mov edx, dword [esp + 0x14]
push ecx
push eax
push 1
push ebx
push 0x42f9a0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40b8ac
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x42f3d4
mov eax, esi
call fcn.00401520
cmp dword [esp + 0x50], edi
jb 0x40b8e2
mov ecx, dword [esp + 0x3c]
push ecx
jmp 0x40b8da
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
push ebx
lea eax, [esp + 0x40]
mov ecx, esi
mov word [esi + 4], bx
call fcn.00401600
cmp dword [esp + 0x50], edi
jb 0x40b8e2
mov eax, dword [esp + 0x3c]
push eax
call fcn.00414041
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00414002
add esp, 0x50
ret
Function at 0x40bd90
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x42b43e
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x437368]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push ebp
push edi
mov eax, dword [0x437368]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov edx, 0x42f668
mov ecx, esi
mov dword [esp + 0x14], esi
call fcn.0040ab50
lea ebp, [esi + 0x10]
mov edx, 0x42f668
mov ecx, ebp
call fcn.0040ab50
lea edi, [esi + 0x20]
xor ebx, ebx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
mov word [edi + 4], bx
lea ecx, [esp + 0x18]
mov dword [esp + 0x70], ebx
call fcn.0040a4e0
push 0xffffffffffffffff
push ebx
mov ecx, edi
mov byte [esp + 0x78], 1
call fcn.00401600
mov edi, 8
mov byte [esp + 0x70], bl
cmp dword [esp + 0x30], edi
jb 0x40be2b
mov eax, dword [esp + 0x1c]
push eax
call fcn.00414041
add esp, 4
lea ecx, [esp + 0x18]
mov eax, esi
call fcn.0040c7b0
cmp dword [eax + 0x18], edi
jb 0x40be40
mov eax, dword [eax + 4]
jmp 0x40be43
add eax, 4
push eax
push 0x18
lea ecx, [esp + 0x3c]
push ecx
push 0x42fa14
push 0x42fa3c
push 0x42fa4c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [esp + 0x30], edi
jb 0x40be73
mov edx, dword [esp + 0x1c]
push edx
call fcn.00414041
add esp, 4
lea edx, [esp + 0x34]
mov ecx, esi
call fcn.0040ab50
lea edx, [esp + 0x34]
mov ecx, ebp
call fcn.0040ab50
mov edi, dword [esp + 0x80]
push 0x6c
mov dword [esi + 0x40], edi
call fcn.00414361
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x70], 2
je 0x40bec0
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x78]
push edi
push ecx
push edx
push eax
call fcn.0040ddb0
mov dword [esi + 0x3c], eax
jmp 0x40bec3
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.00414002
add esp, 0x64
ret 0xc
Function at 0x40c110
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x98
mov eax, dword [0x437368]
xor eax, esp
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0xa0]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov dword [esp + 0xc], eax
xor ebx, ebx
push edi
lea esi, [esp + 0x20]
xor eax, eax
mov dword [esp + 0x14], ebx
call fcn.0040a590
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004134ab
push edi
mov dword [esp + 0x20], eax
call fcn.0040a590
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x14]
ja 0x40c18a
push eax
call fcn.00414062
add esp, 4
xor eax, eax
jmp 0x40c213
lea edx, [esp + 0x18]
push edx
push 0x42fa64
push eax
mov dword [esp + 0x24], ebx
call fcn.004145b5
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40c202
push edi
push 0x40
lea ecx, [esp + 0x28]
push ecx
push 0
push esi
push 0x42fa68
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x40c1e8
test ebp, ebp
je 0x40c1e5
mov eax, dword [esp + 0xc]
cmp ebx, dword [eax]
ja 0x40c1e5
lea ecx, [esp + 0x20]
push ecx
push esi
mov esi, ebp
call fcn.0040c670
add ebp, 0xb8
add dword [esp + 0x10], 1
add ebx, 1
lea edx, [esp + 0x18]
push edx
push 0x42fa64
push 0
call fcn.004145b5
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40c1a7
mov eax, dword [esp + 0x14]
push eax
call fcn.00414062
mov eax, dword [esp + 0x14]
add esp, 4
mov ecx, dword [esp + 0xc]
pop esi
mov dword [ecx], ebx
mov ecx, dword [esp + 0x9c]
pop ebp
pop ebx
xor ecx, esp
call fcn.00414002
add esp, 0x98
ret 8

Function at 0x40c240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42a3e8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x437368]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0xc]
call fcn.0040c7b0
mov dword [esp + 0x30], 0
cmp dword [eax + 0x18], 8
jb 0x40c285
mov eax, dword [eax + 4]
jmp 0x40c288
add eax, 4
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push ecx
push edx
mov edi, eax
call fcn.0040c110
cmp dword [esp + 0x24], 8
mov esi, eax
jb 0x40c2af
mov eax, dword [esp + 0x10]
push eax
call fcn.00414041
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 0xc
Function at 0x40cc40
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x42a680
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x437368]
xor eax, esp
mov dword [esp + 0x7c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437368]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push 0x42faa8
push 0x80000002
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ce59
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x18]
push ecx
push eax
push eax
push eax
push 0x42fb0c
push edx
call edi
test eax, eax
je 0x40cccc
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ce59
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004134ab
mov ecx, dword [esp + 0x18]
add esp, 4
lea edx, [esp + 0x18]
push edx
mov ebp, eax
push ebp
lea eax, [esp + 0x24]
push eax
push 0
push 0x42fb0c
push ecx
call edi
test eax, eax
jne 0x40ce45
cmp dword [esp + 0x1c], 7
jne 0x40ce45
cmp dword [esp + 0x18], eax
je 0x40ce45
mov edx, 0x42fb44
lea eax, [esp + 0x74]
call fcn.00401520
push esi
lea ecx, [esp + 0x40]
mov dword [esp + 0xa0], 0
call fcn.0040ace0
mov edi, eax
add esi, 0x20
push esi
mov ebx, 0x42fb50
lea esi, [esp + 0x5c]
mov byte [esp + 0xa0], 1
call fcn.004098b0
push edi
push eax
lea edi, [esp + 0x2c]
mov byte [esp + 0xa8], 2
call fcn.0040d3f0
add esp, 0xc
push 0
push eax
or eax, 0xffffffff
lea esi, [esp + 0x7c]
mov byte [esp + 0xa4], 3
call fcn.00409010
mov esi, edi
call fcn.004012e0
lea esi, [esp + 0x58]
call fcn.004012e0
lea esi, [esp + 0x3c]
mov byte [esp + 0x9c], 0
call fcn.004012e0
mov edx, dword [esp + 0x18]
add edx, 0xfffffffe
mov esi, ebp
je 0x40ce02
lea esp, [esp]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cdb5
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, dword [esp + 0x88]
push esi
lea ecx, [esp + 0x78]
call fcn.00409fc0
test eax, eax
je 0x40ce21
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cde0
mov ecx, dword [esp + 0x18]
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
mov eax, esi
sub eax, ebp
add ecx, 0xfffffffe
cmp eax, ecx
jb 0x40cdb0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.00414062
add esp, 4
lea esi, [esp + 0x74]
call fcn.004012e0
jmp 0x40ce59
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.00414062
add esp, 4
lea esi, [esp + 0x74]
call fcn.004012e0
mov eax, 1
jmp 0x40ce5b
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.00414062
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.00414002
add esp, 0x8c
ret
Function at 0x40d5f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov eax, ebp
push edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d600
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004134ab
push ebp
mov edi, eax
push esi
push edi
call fcn.00414067
push 0x5c
push edi
call fcn.004150cf
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x40d654
push edi
call fcn.00414062
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
ret
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x5c
add esi, 2
push esi
call fcn.004150cf
mov esi, eax
add esp, 8
test esi, esi
je 0x40d67a
mov word [esi], 0
push 0
push edi
call ebx
test eax, eax
jne 0x40d68c
call ebp
cmp eax, 0xb7
jne 0x40d697
test esi, esi
je 0x40d6a7
mov word [esi], 0x5c
jmp 0x40d661
push edi
call fcn.00414062
add esp, 4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret
push edi
call fcn.00414062
add esp, 4
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret

Function at 0x40d6c0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
lea eax, [esp + 8]
push eax
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x40d6e0
pop ebp
pop ebx
add esp, 0xc
ret
push edi
push ebx
call fcn.004134ab
mov ecx, dword [esp + 0x10]
add esp, 4
mov edi, eax
push edi
push ebx
push ecx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x40d70f
push edi
call fcn.00414062
add esp, 4
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x42f384
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
push edi
je 0x40d6fe
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
movzx edx, ax
movzx ebx, cx
shr eax, 0x10
shr ecx, 0x10
mov dword [esi], ecx
mov dword [esi + 4], ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
call fcn.00414062
add esp, 4
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x40d840
Capabilities:
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows

Disassembly:
sub esp, 0x94
mov eax, dword [0x437368]
xor eax, esp
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x98]
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push 1
push eax
mov edi, ecx
mov dword [esp + 0x30], 0x10
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40d89d
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00414002
add esp, 0x94
ret
push ebp
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x40d8cf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00414002
add esp, 0x94
ret
push ebx
push ebp
call fcn.004134ab
add esp, 4
push 0
mov ebx, eax
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40da08
cmp ebp, dword [esp + 0x18]
jne 0x40da08
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x40d929
push ebx
call fcn.00414062
add esp, 4
jmp 0x40da18
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x40d961
push ebx
call fcn.00414062
mov ecx, dword [esp + 0x18]
add esp, 4
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x40da18
mov edx, dword [esp + 0x10]
push 0
push ebp
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
push ebx
jne 0x40d99a
call fcn.00414062
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 0x14]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x40da18
call fcn.00414062
mov ecx, dword [esp + 0x14]
add esp, 4
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x14]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test esi, esi
je 0x40da18
xor esi, esi
jmp 0x40d9e0
movzx ecx, byte [esp + esi + 0x20]
push ecx
push 0x42fb68
push 3
push edi
call fcn.00414046
add esi, 1
add esp, 0x10
add edi, 4
cmp esi, 0x10
jl 0x40d9e0
mov eax, 1
jmp 0x40da1a
push ebx
call fcn.00414062
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0xa0]
pop ebx
pop ebp
pop edi
pop esi
xor ecx, esp
call fcn.00414002
add esp, 0x94
ret
Function at 0x40dd30
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebp
push esi
call ebx
cmp eax, 0xffffffff
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
je 0x40dd4d
and eax, 0xfffffffc
push eax
push esi
call ebp
test edi, edi
jne 0x40dd7e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40dd79
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40dd79
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop ebp
mov eax, 1
pop ebx
ret
pop ebp
xor eax, eax
pop ebx
ret
push edi
call ebx
cmp eax, 0xffffffff
je 0x40dd8d
and eax, 0xfffffffc
push eax
push edi
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 9
push edi
push esi
call ebx
test eax, eax
jne 0x40dd79
push 5
push edi
push esi
call ebx
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x40e360
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x42b1e1
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x437368]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push ebp
push esi
mov eax, dword [0x437368]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x9c]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
mov dword [esp + 0x38], edi
mov dword [esp + 0x14], ecx
mov word [edi + 4], bx
mov dword [esp + 0x94], ebx
mov eax, dword [ebp + 0x38]
cmp eax, ebx
mov esi, 1
mov dword [esp + 0x18], esi
jne 0x40e405
push ecx
lea edx, [esp + 0x20]
call fcn.0040df50
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x24]
mov dword [esp + 0x9c], esi
call fcn.00401600
mov byte [esp + 0x94], bl
cmp dword [esp + 0x34], 8
jb 0x40e405
mov eax, dword [esp + 0x20]
push eax
call fcn.00414041
add esp, 4
lea ecx, [ebp + 0x24]
push ecx
mov ebx, 0x42fa74
lea esi, [esp + 0x20]
call fcn.004098b0
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, edi
mov dword [esp + 0x9c], 2
call fcn.00401600
mov ebx, 8
mov byte [esp + 0x94], 0
cmp dword [esp + 0x34], ebx
jb 0x40e450
mov edx, dword [esp + 0x20]
push edx
call fcn.00414041
add esp, 4
cmp dword [edi + 0x18], ebx
jb 0x40e45a
mov eax, dword [edi + 4]
jmp 0x40e45d
lea eax, [edi + 4]
mov edx, dword [esp + 0x14]
push eax
push 0x42fe0c
mov ecx, ebp
call fcn.0040e9f0
cmp dword [edi + 0x18], ebx
lea esi, [edi + 4]
jb 0x40e47a
mov eax, dword [esi]
jmp 0x40e47c
mov eax, esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
push 0x10
lea eax, [esp + 0x6c]
push eax
push 0
push 0x42fa3c
push 0x42fa4c
call ebp
test eax, eax
je 0x40e4e2
cmp dword [edi + 0x18], ebx
jb 0x40e4a3
mov esi, dword [esi]
push esi
push 0x10
lea ecx, [esp + 0x6c]
push ecx
push 0
push 0
push 0x42fa68
call ebp
test eax, eax
je 0x40e4e2
mov eax, edi
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.00414002
add esp, 0x88
ret 4
xor eax, eax
push 0x17
push 0x42fe24
lea esi, [esp + 0x24]
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], eax
mov word [esp + 0x28], ax
call fcn.00401560
mov edx, esi
push edx
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x9c], 3
call fcn.0040a6e0
push 0x4340d8
lea ecx, [esp + 0x40]
push ecx
call fcn.004166ab
int3
Function at 0x40f120
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
sub esp, 0x20
mov eax, dword [0x437368]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
push edi
lea edi, [eax + 0x24]
push edi
mov ebx, 0x42fa74
lea esi, [esp + 0x14]
call fcn.004098b0
mov esi, dword [esp + 0x18]
add esp, 4
cmp dword [esp + 0x28], 8
jae 0x40f15a
lea esi, [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f171
and eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x40f196
call ebp
cmp eax, 2
je 0x40f196
push 4
push 0
push esi
call ebx
cmp dword [edi + 0x18], 8
jb 0x40f1a1
mov esi, dword [edi + 4]
jmp 0x40f1a4
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x40f1bd
call ebp
cmp eax, 3
je 0x40f1bd
push 4
push 0
push esi
call ebx
cmp dword [esp + 0x28], 8
pop edi
pop esi
pop ebp
pop ebx
jb 0x40f1d5
mov eax, dword [esp + 4]
push eax
call fcn.00414041
add esp, 4
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00414002
add esp, 0x20
ret 4

Function at 0x40f1f0
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x2c
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x20]
push ecx
mov edi, eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea ecx, [esp + 0x10]
push ecx
push esi
shr esi, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
mov eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x40f480
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x250
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x10f
lea eax, [esp + 0x4d]
xor ebx, ebx
push esi
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], esi
xor edi, edi
mov byte [esp + 0x54], bl
call fcn.0041a130
add esp, 0xc
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
xor ebp, ebp
mov dword [esp + 0x24], esi
lea edx, [esi + 1]
jmp 0x40f4c4
xor esi, esi
mov ecx, dword [esp + 0x264]
mov eax, dword [ecx + edx*4]
cmp byte [eax], 0x2d
jne 0x40f537
lea esi, [eax + 1]
mov al, byte [esi]
test al, al
je 0x40f551
lea ecx, [ecx + edx*4 + 4]
add esi, 1
cmp al, 0x65
je 0x40f4eb
cmp al, 0x45
jne 0x40f4f3
mov dword [esp + 0x18], 1
cmp al, 0x6f
je 0x40f4fb
cmp al, 0x4f
jne 0x40f503
mov dword [esp + 0x14], 1
cmp al, 0x64
je 0x40f50b
cmp al, 0x44
jne 0x40f516
mov ebx, dword [ecx]
mov ebp, 1
mov dword [esp + 0x24], ebx
cmp al, 0x70
je 0x40f51e
cmp al, 0x50
jne 0x40f52b
cmp edx, 4
jge 0x40f52b
mov edi, dword [ecx]
add edx, 1
add ecx, 4
mov al, byte [esi]
test al, al
jne 0x40f4e0
mov ebx, dword [esp + 0x20]
jmp 0x40f551
cmp ebx, esi
jne 0x40f543
mov ebx, eax
mov dword [esp + 0x20], ebx
jmp 0x40f551
cmp dword [esp + 0x1c], esi
jne 0x40f551
cmp ebp, esi
jne 0x40f551
mov dword [esp + 0x1c], eax
add edx, 1
cmp edx, 5
jl 0x40f4c2
test ebx, ebx
je 0x40f5c7
push 0xff
lea ecx, [esp + 0x4c]
push ebx
push ecx
call fcn.00415d00
add esp, 0xc
lea eax, [esp + 0x28]
mov byte [esp + 0x148], 0
call fcn.00410840
push ebx
call fcn.0040f960
mov esi, eax
test esi, esi
jne 0x40f5d7
lea eax, [esp + 0x48]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x40f598
mov edx, dword [0x4300e8]
mov cl, byte [0x4300ec]
mov dword [eax], edx
lea edx, [esp + 0x48]
mov byte [eax + 4], cl
push edx
lea eax, [esp + 0x2c]
call fcn.0040f960
mov esi, eax
test esi, esi
jne 0x40f5d7
mov eax, 0xfffe
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x250
ret
lea eax, [esp + 0x158]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test ebp, ebp
je 0x40f616
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00415efb
add esp, 4
test eax, eax
je 0x40f616
mov eax, esi
call fcn.0040fb50
mov eax, 0xfffd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x250
ret
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push edi
push edx
push eax
mov eax, esi
call fcn.0040f420
add esp, 0xc
lea ecx, [esp + 0x158]
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, esi
call fcn.0040fb50
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x250
ret