joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011607
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10011625
push 0x1637
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
jmp 0x10011643
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10011643
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret

Function at 0x10018341
Capabilities:
Get file system object information

Disassembly:
push 0xb9e
push 0x16d0
push 0
push 0x20d2
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
ret
Function at 0x1001ce6b
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001ce99
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001ce97
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1001cee4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001cec7
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1001cee4
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x18]
call fcn.100164aa
mov dword [eax], 0x272b
jmp 0x1001cebc
mov esp, ebp
pop ebp
ret
Function at 0x1001dd9e
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001ded1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc]
imul ecx, dword [edx]
cmp dword [eax], ecx
je 0x1001ddf7
mov dword [ebp - 0x1c], 1
jmp 0x1001ddfb
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0xc]
xor ecx, ecx
inc ecx
sub ecx, dword [eax]
mov eax, dword [ebp - 8]
cmp ecx, dword [eax]
jl 0x1001de13
mov dword [ebp - 0x10], 1
jmp 0x1001de17
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0xe9ab5c29
jb 0x1001de29
mov dword [ebp - 0x14], 1
jmp 0x1001de2d
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jl 0x1001de40
mov dword [ebp - 0x18], 1
jmp 0x1001de44
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jle 0x1001de57
mov dword [ebp - 0x20], 1
jmp 0x1001de5b
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
je 0x1001de6c
mov dword [ebp - 0x24], 1
jmp 0x1001de70
and dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 1
jge 0x1001de7f
mov dword [ebp - 0x28], 1
jmp 0x1001de83
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
sub eax, 0x512d
cmp eax, 1
ja 0x1001debc
mov eax, 0x1415
test eax, eax
je 0x1001debc
mov dword [ebp - 0x3c], 1
jmp 0x1001dec0
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2c]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
jmp 0x1001def6
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001def6
push 0xb9e
push 0x16d0
push 0
push 0x20d2
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x100285de
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100285f5
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1002860c
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1002eb7a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 0x5461
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1002e927
add esp, 0x10
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002ebaf
xor eax, eax
jmp 0x1002ed0e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002ebcd
xor eax, eax
jmp 0x1002ed0e
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x6f0d
push 0x5be2
push 0x5252
call fcn.1002ed12
add esp, 0x18
cmp dword [ebp - 0xc], 0
jne 0x1002ebfb
xor eax, eax
jmp 0x1002ed0e
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 4]
push eax
push 0x2b9e
push 0x78a5
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push dword [ebp - 8]
push 1
call fcn.1002e78f
add esp, 0x20
push dword [ebp + 8]
push dword [ebp - 8]
push 0
push 0x3ea1
push 0x3191
push dword [ebp - 4]
call fcn.10025303
add esp, 0x18
push 0xbd3
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x70fd
lea eax, [ebp - 0x1c]
push eax
call fcn.1002e981
add esp, 0x18
push 1
push 0x46b1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x644
call fcn.1002ea13
add esp, 0x14
push dword [ebp - 4]
call fcn.1002dfa4
pop ecx
test eax, eax
jne 0x1002ec8e
xor eax, eax
jmp 0x1002ed0e
push 1
push 0x6b9e
push 0x7879
lea eax, [ebp - 4]
push eax
call fcn.1002eab0
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002ecf6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x1002ecc5
xor eax, eax
jmp 0x1002ed0e
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002ecde
xor eax, eax
jmp 0x1002ed0e
push 1
push 0x3e34
lea eax, [ebp - 4]
push eax
push 0x483b
call fcn.1002eb26
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002ed07
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x1002ed0b
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x10042ed7
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10042f2f
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10042f13
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10042f2d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100164aa
and dword [eax], 0
jmp 0x10042f08
jmp 0x10042f3b
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov esp, ebp
pop ebp
ret
Function at 0x10045f64
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10046058
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x10045ff6
mov eax, 0xf3f0
test eax, eax
jne 0x10045ff6
and dword [ebp - 0xc], 0
jmp 0x10045ffd
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
jl 0x10046010
mov dword [ebp - 0x10], 1
jmp 0x10046014
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 1
jbe 0x10046028
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x10046028
and dword [ebp - 0x14], 0
jmp 0x1004602f
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jl 0x1004604a
mov eax, dword [ebp - 0x40]
cmp dword [eax], 0
je 0x1004604a
mov dword [ebp - 0x1c], 1
jmp 0x1004604e
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
jmp 0x10046060
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret

Function at 0x10046d85
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10046da6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
jmp 0x10046dbf
push 0xb9e
push 0x16d0
push 0
push 0x20d2
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
pop ebp
ret
Function at 0x10085df2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008f330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10075694
mov dword [ebp - 0x14], eax
cmp dword [0x1067c514], esi
jne 0x10085ee5
push 0x800
push esi
push 0x10008064
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10085e72
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10085fc5
push esi
push esi
push 0x10008064
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10085fc5
push 0x1000807c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10085fc5
push eax
call ebx
push 0x10008088
push edi
mov dword [0x1067c514], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10008098
push edi
mov dword [0x1067c518], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100080ac
push edi
mov dword [0x1067c51c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067c524], eax
test eax, eax
je 0x10085ee2
push 0x100080c8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067c520], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10085f0a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10085efd
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10085f1f
push 4
pop eax
jmp 0x10085fc7
cmp dword [ebp - 0x14], esi
je 0x10085f1f
push dword [0x1067c514]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10085f04
mov eax, dword [0x1067c520]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10085f7d
cmp dword [0x1067c524], edi
je 0x10085f7d
push eax
call ebx
push dword [0x1067c524]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10085f7d
test eax, eax
je 0x10085f7d
call ecx
test eax, eax
je 0x10085f72
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10085f72
test byte [ebp - 8], 1
jne 0x10085f7d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10085fad
mov eax, dword [0x1067c518]
cmp eax, edi
je 0x10085faa
push eax
call ebx
test eax, eax
je 0x10085faa
call eax
mov esi, eax
test esi, esi
je 0x10085faa
mov eax, dword [0x1067c51c]
cmp eax, edi
je 0x10085faa
push eax
call ebx
test eax, eax
je 0x10085faa
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1067c514]
call ebx
test eax, eax
je 0x10085fc5
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10085fc7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80c004]
jne 0x401010
repz ret
jmp fcn.0040160c

Function at 0x4076e5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404bff
and dword [ebp - 4], 0
cmp dword [0x80ec9c], 0
mov ebx, eax
jne 0x407796
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407847
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407847
push eax
call fcn.00404b8d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x80ec9c], eax
call esi
push eax
call fcn.00404b8d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x80eca0], eax
call esi
push eax
call fcn.00404b8d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x80eca4], eax
call esi
push eax
call fcn.00404b8d
pop ecx
mov dword [0x80ecac], eax
test eax, eax
je 0x407796
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404b8d
pop ecx
mov dword [0x80eca8], eax
mov eax, dword [0x80eca8]
cmp eax, ebx
je 0x4077ee
cmp dword [0x80ecac], ebx
je 0x4077ee
push eax
call fcn.00404c08
push dword [0x80ecac]
mov esi, eax
call fcn.00404c08
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4077ee
test edi, edi
je 0x4077ee
call esi
test eax, eax
je 0x4077e5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4077e5
test byte [ebp - 0xc], 1
jne 0x4077ee
or dword [ebp + 0x10], 0x200000
jmp 0x407827
mov eax, dword [0x80eca0]
cmp eax, ebx
je 0x407827
push eax
call fcn.00404c08
pop ecx
test eax, eax
je 0x407827
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407827
mov eax, dword [0x80eca4]
cmp eax, ebx
je 0x407827
push eax
call fcn.00404c08
pop ecx
test eax, eax
je 0x407827
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x80ec9c]
call fcn.00404c08
pop ecx
test eax, eax
je 0x407847
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407849
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409a80
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x80c004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x27263b4], 0x930
jne 0x409aaa
push 0x80a498
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
cmp dword [0x27263b4], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x27261f8], eax
jne 0x409add
push 0
lea ecx, [ebp - 0x804]
push ecx
push 0
call sub.KERNEL32.dll_VerLanguageNameW
lea edx, [ebp - 0x820]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401006
mov esp, ebp
pop ebp
ret
Function at 0x4129f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x47ca30]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [0x482a00], 0
push esi
je 0x412a20
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
push 0x18
call fcn.0045acd7
add esp, 4
test eax, eax
je 0x412a3e
push 0
mov ecx, eax
call fcn.00412840
mov dword [0x482a00], eax
jmp 0x412a48
mov dword [0x482a00], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [esp + 0x18], 7
xor eax, eax
mov dword [esp + 0x14], 0
mov word [esp + 4], ax
cmp word [edx], ax
jne 0x412a70
xor ecx, ecx
jmp 0x412a84
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412a75
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0xc]
call fcn.00415a10
mov ecx, dword [0x482a00]
lea eax, [esp + 4]
push eax
call fcn.00413e10
cmp dword [esp + 0x18], 8
jb 0x412ab2
push dword [esp + 4]
call fcn.0045ad4d
add esp, 4
mov ecx, dword [esp + 0x1c]
mov al, 1
pop esi
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret

Function at 0x413e10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x47ca30]
xor eax, esp
mov dword [esp + 0x1c], eax
mov dword [esp], 0
xor eax, eax
push esi
push edi
mov word [esp + 0xc], ax
mov edi, ecx
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push 3
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
call fcn.00422e20
add esp, 8
cmp dword [esp + 0x1c], 0
je 0x413e96
cmp dword [esp + 0x20], 8
lea ecx, [esp + 8]
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
cmovae eax, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, edi
push esi
push dword [esp + 0xc]
call fcn.00412bd0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x20], 8
jb 0x413ea9
push dword [esp + 0xc]
call fcn.0045ad4d
add esp, 4
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret 4
Function at 0x419ba0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
mov eax, dword [0x47ca30]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
push edi
lea edi, [esi + 0x10]
je 0x419d1f
cmp byte [0x482a08], 0
je 0x419d1f
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push 0x5c
push eax
call fcn.0045f65e
add esp, 8
test eax, eax
je 0x419c00
xor ecx, ecx
mov word [eax + 2], cx
push 0x40dc04
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0045faf3
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x419c21
mov esi, dword [esi]
mov edx, dword [edi]
xor eax, eax
mov word [ebp - 0x228], ax
mov ecx, esi
lea eax, [ebp - 0x228]
mov dword [ebp - 0x214], 7
push eax
mov dword [ebp - 0x218], 0
call fcn.00421070
add esp, 4
cmp dword [ebp - 0x218], 0
je 0x419d08
push 0x44
lea eax, [ebp - 0x280]
push 0
push eax
call fcn.00438c15
add esp, 0xc
mov dword [ebp - 0x280], 0x44
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x238]
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x280]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x419ce1
push 0xffffffffffffffff
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x234]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x238]
call esi
jmp 0x419d08
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
push 0x40010
cmovae eax, dword [ebp - 0x228]
push 0x40dc28
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp - 0x214], 8
jb 0x419d1f
push dword [ebp - 0x228]
call fcn.0045ad4d
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
Function at 0x41db90
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x260
mov eax, dword [0x47ca30]
xor eax, esp
mov dword [esp + 0x25c], eax
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0x104
jb 0x41dbce
xor al, al
pop esi
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
mov bl, byte [ebp + 0xc]
test bl, bl
jne 0x41dc65
xorps xmm0, xmm0
mov word [esp + 0x30], 0
lea edx, [esp + 0x28]
movlpd qword [esp + 0x28], xmm0
mov ecx, esi
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
call fcn.0041e380
test al, al
je 0x41dc38
cmp byte [esp + 0x30], bl
je 0x41dc38
cmp dword [esi + 0x14], 8
jb 0x41dc18
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
pop esi
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x41dc42
mov eax, dword [esi]
jmp 0x41dc44
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x41dc65
mov al, 1
pop esi
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x208
push eax
mov word [esp + 0x58], ax
lea eax, [esp + 0x5a]
push eax
call fcn.00438c15
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x41dc87
mov esi, dword [esi]
lea ecx, [esp + 0x50]
jmp 0x41dc90
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x41dc90
mov word [esp + 0x24], ax
xorps xmm0, xmm0
mov dword [esp + 8], 0
lea eax, [esp + 0x50]
movq qword [esp + 0x1c], xmm0
movdqu xmmword [esp + 0xc], xmm0
mov dword [esp + 0x10], eax
mov eax, 0x414
mov dword [esp + 0xc], 3
mov word [esp + 0x18], ax
test bl, bl
jne 0x41dce5
mov eax, 0x1494
mov word [esp + 0x18], ax
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [esp + 0x1a], 0
jne 0x41dbb8
test eax, eax
je 0x41dd21
cmp eax, 2
je 0x41dd21
cmp eax, 0x402
je 0x41dd21
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x264]
mov eax, 1
pop esi
pop ebx
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret

Function at 0x41dd40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x41dd4e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x41dd60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x41dd68
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dd7b
shr eax, 4
and eax, 1
ret
xor al, al
ret