joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4054c0
Capabilities:
Get file size

Disassembly:
sub esp, 0x30
mov eax, dword [0x45e480]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov ebx, dword [0x462890]
push ebp
push edi
mov edi, dword [0x462894]
mov eax, ebx
or eax, edi
jne 0x40564c
mov ecx, dword [esi + 0x84]
sub ecx, dword [esi + 0x80]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
xor ebp, ebp
add ecx, edx
je 0x40564c
xor ebx, ebx
mov edi, edi
mov ecx, dword [esi + 0x84]
sub ecx, dword [esi + 0x80]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jb 0x405536
call fcn.00431010
mov ecx, dword [esi + 0x80]
cmp byte [ebx + ecx + 0x38], 0
je 0x40555b
mov eax, esi
call fcn.00407220
add dword [0x462890], eax
adc dword [0x462894], edx
jmp 0x405617
mov ecx, dword [esi + 0x84]
sub ecx, dword [esi + 0x80]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jb 0x405581
call fcn.00431010
mov eax, dword [esi + 0x80]
push 0xffffffffffffffff
add eax, ebx
push 0
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
call fcn.00402740
cmp dword [esp + 0x30], 0x10
mov eax, dword [esp + 0x1c]
jae 0x4055bb
lea eax, [esp + 0x1c]
push 0
push 0x80
push 3
push 0
push 1
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x405603
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4055fc
mov edx, dword [esp + 0x10]
add dword [0x462890], edx
mov eax, dword [esp + 0x14]
adc dword [0x462894], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x30], 0x10
jb 0x405617
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00413f54
add esp, 4
mov ecx, dword [esi + 0x84]
sub ecx, dword [esi + 0x80]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebp
add eax, edx
add ebx, 0x54
cmp ebp, eax
jb 0x405510
mov edi, dword [0x462894]
mov ebx, dword [0x462890]
mov ecx, dword [esp + 0x34]
mov edx, edi
pop edi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00430bbd
add esp, 0x30
ret

Function at 0x405670
Capabilities:
Get disk size

Disassembly:
sub esp, 0xc
push esi
xor esi, esi
cmp dword [eax + 0x18], 0x10
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
jb 0x405689
mov eax, dword [eax + 4]
jmp 0x40568c
add eax, 4
push esi
push esi
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x4056b0
push esi
push str.Error
push str.GetDiskFreeSpaceEx_failure
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [esp + 0x14]
call fcn.004054c0
mov ecx, dword [esp + 0xc]
cmp ecx, edx
ja 0x4056d4
jb 0x4056cb
mov edx, dword [esp + 8]
cmp edx, eax
ja 0x4056d4
xor al, al
pop esi
add esp, 0xc
ret 4
mov al, 1
pop esi
add esp, 0xc
ret 4
Function at 0x4067f0
Capabilities:
Get disk size

Disassembly:
sub esp, 0xc
cmp dword [eax + 0x54], 0x10
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jb 0x40680e
mov eax, dword [eax + 0x40]
jmp 0x406811
add eax, 0x40
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x406837
push eax
push str.Error
push str.GetDiskFreeSpaceEx_failure
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esp + 8], 0
ja 0x406850
jb 0x40684a
cmp dword [esp + 4], 0x100000
jae 0x406850
mov al, 1
add esp, 0xc
ret
xor al, al
add esp, 0xc
ret
Function at 0x406860
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x448896
mov eax, dword fs:[0]
push eax
sub esp, 0x750
mov eax, dword [0x45e480]
xor eax, esp
mov dword [esp + 0x748], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45e480]
xor eax, esp
push eax
lea eax, [esp + 0x764]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x774]
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x20], ebx
cmp dword [esi + 0x18], 0x10
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
lea edi, [esi + 4]
jb 0x4068bf
mov eax, dword [edi]
jmp 0x4068c1
mov eax, edi
push ebx
push ebx
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x4068e5
push ebx
push str.Error
push str.GetDiskFreeSpaceEx_failure
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esi + 0x18], 0x10
jb 0x4068ed
mov edi, dword [edi]
lea edx, [esp + 0x25c]
push edx
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x164]
push ecx
lea edx, [esp + 0x2c]
push edx
push edi
call fcn.00431ba1
mov edi, 0xf
lea eax, [esp + 0x34]
add esp, 0x14
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406928
sub eax, edx
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
call fcn.00402db0
push 1
push 0x450260
lea ecx, [esp + 0x48]
push ecx
xor eax, eax
mov dword [esp + 0x778], ebx
call fcn.00402940
cmp eax, 0xffffffff
je 0x4069a5
push eax
xor ecx, ecx
lea esi, [esp + 0x28]
lea edx, [esp + 0x44]
call fcn.004021b0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x778], 1
call fcn.00402740
mov esi, 0x10
mov byte [esp + 0x76c], bl
cmp dword [esp + 0x3c], esi
jb 0x4069aa
mov edx, dword [esp + 0x28]
push edx
call fcn.00413f54
add esp, 4
jmp 0x4069aa
mov esi, 0x10
mov edx, dword [esp + 0x44]
cmp dword [esp + 0x58], esi
jae 0x4069b8
lea edx, [esp + 0x44]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
mov ecx, eax
and eax, 0x7fffffff
mov dword [esp + 0x18], eax
fild qword [esp + 0x14]
and ecx, 0x80000000
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ebx
fild qword [esp + 0x14]
sub esp, 8
fchs
faddp st(1)
fld qword [0x453358]
fmul st(1), st(0)
fmul st(1), st(0)
fmulp st(1)
fstp qword [esp]
push edx
push 0x450264
lea edx, [esp + 0x36c]
push 0x400
push edx
call fcn.00431345
lea eax, [esp + 0x374]
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x14], ebx
add esp, 0x18
mov byte [ebp + 4], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406a30
sub eax, edx
push eax
lea eax, [esp + 0x360]
push eax
mov ecx, ebp
call fcn.00402db0
cmp dword [esp + 0x58], esi
jb 0x406a5c
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00413f54
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x764]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x748]
xor ecx, esp
call fcn.00430bbd
add esp, 0x75c
ret 4
Function at 0x407220
Capabilities:
Read file on windows

Disassembly:
push ecx
cmp dword [eax + 0x70], 0x10
push ebx
push esi
push edi
jb 0x40722f
mov eax, dword [eax + 0x5c]
jmp 0x407232
add eax, 0x5c
push 0x4501d8
push eax
call fcn.004314b8
mov esi, eax
add esp, 8
test esi, esi
jne 0x407261
push eax
push str.error
push str.open_file_failure
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
pop ecx
ret
push 2
push 0xfffffffffffffffc
push esi
call fcn.00431559
push esi
push 1
lea eax, [esp + 0x20]
push 4
push eax
mov dword [esp + 0x28], 0
call fcn.0043187e
push 2
push 0
push esi
call fcn.00431559
push esi
call fcn.00431f39
push esi
mov edi, eax
mov ebx, edx
call fcn.00431912
mov eax, dword [esp + 0x3c]
cdq
add esp, 0x30
sub edi, eax
mov eax, edi
pop edi
sbb ebx, edx
pop esi
mov edx, ebx
pop ebx
pop ecx
ret

Function at 0x4072c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
xor esi, esi
push esi
call fcn.00407520
mov edi, eax
cmp edi, esi
je 0x407346
push edi
push 1
lea eax, [esp + 0x18]
push 8
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call fcn.0043187e
add esp, 0x10
cmp eax, 1
jb 0x40733d
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
inc eax
push eax
call fcn.00413f49
mov ecx, dword [ebx]
add esp, 4
inc ecx
push ecx
mov esi, eax
push 0
push esi
mov dword [ebp], esi
call fcn.00433a30
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edi
push 1
push edx
push esi
call fcn.0043187e
add esp, 0x10
cmp eax, 1
jae 0x407351
mov eax, dword [ebp]
push eax
call fcn.00413f54
add esp, 4
push edi
call fcn.00431912
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
add esp, 0xc
ret 4
push edi
call fcn.00431912
add esp, 4
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0xc
ret 4
Function at 0x407370
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x1c
cmp dword [eax + 0x18], 0x10
push ebx
push ebp
push esi
push edi
jb 0x407382
mov eax, dword [eax + 4]
jmp 0x407385
add eax, 4
push 0x450290
push eax
call fcn.004314b8
mov edi, eax
xor ebx, ebx
add esp, 8
mov dword [esp + 0x14], edi
cmp edi, ebx
jne 0x4073ac
lea eax, [ebx + 2]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
mov eax, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
call fcn.00407520
mov esi, eax
mov dword [esp + 0x30], esi
cmp esi, ebx
jne 0x4073dc
push edi
call fcn.00431912
mov eax, 1
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
push esi
push 1
lea ecx, [esp + 0x24]
push 8
push ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.0043187e
add esp, 0x10
cmp eax, 1
jae 0x407413
push esi
call fcn.00431912
mov eax, 1
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
push 0x200000
call fcn.00413f49
mov ebp, eax
mov eax, dword [esp + 0x20]
add esp, 4
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], ebx
mov edi, edi
sub eax, ebx
mov edi, 0x200000
cmp eax, 0x200000
ja 0x407440
mov edi, eax
push esi
push edi
push 1
push ebp
call fcn.0043187e
mov esi, eax
add esp, 0x10
cmp esi, edi
jb 0x4074d2
mov edx, dword [esp + 0x14]
push edx
push 1
push esi
add ebx, esi
adc dword [esp + 0x34], 0
push ebp
call fcn.004320e5
add esp, 0x10
cmp eax, 1
jb 0x4074d9
mov eax, dword [esp + 0x34]
add eax, esi
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
mov dword [esp + 0x34], eax
test eax, eax
jge 0x40748c
fadd qword [0x453368]
mov eax, dword [esp + 0x1c]
fild dword [esp + 0x1c]
test eax, eax
jge 0x40749e
fadd qword [0x453368]
fdivp st(1)
mov ecx, dword [0x4627e0]
fmul qword [0x453360]
fstp dword [ecx + 0xb0]
call fcn.004060f0
mov eax, dword [esp + 0x1c]
cmp ebx, eax
jne 0x4074c9
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x20]
je 0x4074e0
mov esi, dword [esp + 0x30]
jmp 0x407430
mov esi, 1
jmp 0x4074e2
mov esi, 3
jmp 0x4074e2
xor esi, esi
push ebp
call fcn.00413f54
mov edx, dword [esp + 0x18]
add esp, 4
push edx
call fcn.00431912
mov eax, dword [esp + 0x34]
add esp, 4
push eax
call fcn.00431912
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x407520
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp dword [eax + 0x70], 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
jb 0x407536
mov eax, dword [eax + 0x5c]
jmp 0x407539
add eax, 0x5c
push 0x4501d8
push eax
call fcn.004314b8
mov esi, eax
xor ebx, ebx
add esp, 8
cmp esi, ebx
je 0x40757d
push 2
push 0xfffffffffffffffc
push esi
call fcn.00431559
push esi
push 1
lea eax, [esp + 0x30]
push 4
push eax
mov dword [esp + 0x38], ebx
call fcn.0043187e
add esp, 0x1c
cmp eax, 1
jge 0x407589
push esi
call fcn.00431912
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov ecx, dword [esp + 0x1c]
push ebx
push ecx
push esi
call fcn.00431559
add esp, 0xc
xor edi, edi
cmp ebp, ebx
jle 0x4075d9
mov edi, edi
push esi
push 1
lea edx, [esp + 0x18]
push 8
push edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.0043187e
add esp, 0x10
cmp eax, 1
jl 0x407574
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 1
push eax
push ecx
push esi
call fcn.00432203
inc edi
add esp, 0x10
cmp edi, ebp
jl 0x4075a0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x407740
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov ebp, 0x10
push edi
mov esi, ecx
cmp dword [eax + 0x18], ebp
jb 0x407758
mov eax, dword [eax + 4]
jmp 0x40775b
add eax, 4
push 0x450290
push eax
call fcn.004314b8
mov edi, eax
xor ebx, ebx
add esp, 8
mov dword [esp + 0x18], edi
cmp edi, ebx
jne 0x407780
lea eax, [ebx + 2]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
cmp dword [esi + 0x18], ebp
jb 0x40778a
mov eax, dword [esi + 4]
jmp 0x40778d
lea eax, [esi + 4]
push 0x4501d8
push eax
call fcn.004314b8
mov esi, eax
add esp, 8
mov dword [esp + 0x1c], esi
cmp esi, ebx
jne 0x4077bb
push edi
call fcn.00431912
mov eax, 1
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
push 2
push ebx
push esi
call fcn.00431559
add esp, 0xc
push esi
call fcn.00431f39
add esp, 4
mov edi, eax
push ebx
sub edi, 0x20
sbb edx, ebx
push ebx
push esi
mov dword [esp + 0x3c], edx
call fcn.00431559
add esp, 0xc
push 0x200000
call fcn.00413f49
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], ebx
nop
mov eax, edi
sub eax, ebx
mov ebp, 0x200000
cmp eax, 0x200000
ja 0x407812
mov ebp, eax
mov eax, dword [esp + 0x10]
push esi
push ebp
push 1
push eax
call fcn.0043187e
mov esi, eax
add esp, 0x10
cmp esi, ebp
jb 0x4078ae
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push ecx
push 1
push esi
add ebx, esi
adc dword [esp + 0x34], 0
push edx
call fcn.004320e5
add esp, 0x10
cmp eax, 1
jb 0x4078b5
mov eax, dword [esp + 0x14]
add eax, esi
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
mov dword [esp + 0x14], eax
test eax, eax
jge 0x40786a
fadd qword [0x453368]
mov eax, edi
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
test eax, eax
jge 0x40787e
fadd qword [0x453368]
fdivp st(1)
mov ecx, dword [0x4627e0]
fmul qword [0x453360]
fstp dword [ecx + 0xb0]
call fcn.004060f0
cmp ebx, edi
jne 0x4078a5
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x30]
je 0x4078bc
mov esi, dword [esp + 0x1c]
jmp 0x407800
mov esi, 1
jmp 0x4078be
mov esi, 3
jmp 0x4078be
xor esi, esi
mov edx, dword [esp + 0x10]
push edx
call fcn.00413f54
mov eax, dword [esp + 0x1c]
add esp, 4
push eax
call fcn.00431912
mov ecx, dword [esp + 0x20]
add esp, 4
push ecx
call fcn.00431912
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x409520
Capabilities:
Check for time delay via gettickcount

Disassembly:
test byte [0x4628a4], 1
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x40953e
or dword [0x4628a4], 1
call ebp
mov dword [0x4628a0], eax
call ebp
mov ecx, eax
sub ecx, dword [0x4628a0]
cmp ecx, 0x32
jb 0x409662
mov ecx, dword [edi]
mov dword [0x4628a0], eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov dword [esi + 0x240], 0
mov dword [esi + 0x244], ecx
mov dword [esi + 0x248], eax
jne 0x409581
mov dword [esi + 0x248], 1
mov eax, dword [esi + 0x20c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
movzx edx, cx
shl edx, 0x10
push edx
push 0
push 0x401
push eax
call ebp
mov eax, dword [edi + 4]
mov ecx, dword [esi + 0x240]
cmp eax, ecx
jge 0x4095ad
mov eax, ecx
mov ecx, dword [esi + 0x244]
cmp eax, ecx
jle 0x4095b9
mov eax, ecx
mov ecx, dword [esi + 0x20c]
push 0
push eax
push 0x402
push ecx
mov dword [esi + 0x250], eax
call ebp
cmp dword [edi + 0x20], 0x10
jb 0x4095db
mov eax, dword [edi + 0xc]
jmp 0x4095de
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0x464]
call fcn.0041a472
mov eax, 0x64
mov dword [esi + 0x2ec], eax
cdq
xor eax, edx
sub eax, edx
mov dword [esi + 0x2e8], 0
mov dword [esi + 0x2f0], eax
jne 0x409616
mov dword [esi + 0x2f0], 1
mov edx, dword [esi + 0x2b4]
push 0x640000
push 0
push 0x401
push edx
call ebp
fld dword [edi + 0x24]
call fcn.00436620
mov ecx, dword [esi + 0x2e8]
cmp eax, ecx
jge 0x40963f
mov eax, ecx
mov ecx, dword [esi + 0x2ec]
cmp eax, ecx
jle 0x40964b
mov eax, ecx
push 0
push eax
mov dword [esi + 0x2f8], eax
mov eax, dword [esi + 0x2b4]
push 0x402
push eax
call ebp
pop ebp
ret
Function at 0x409710
Capabilities:
Create directory

Disassembly:
sub esp, 0x510
mov eax, dword [0x45e480]
xor eax, esp
mov dword [esp + 0x50c], eax
mov eax, dword [0x45f91c]
push ebx
push esi
mov ebx, 0x10
test eax, eax
je 0x40976e
lea esi, [eax - 1]
cmp eax, esi
ja 0x409740
call fcn.00446d2a
mov eax, dword [0x45f90c]
cmp dword [0x45f920], ebx
jae 0x409752
mov eax, 0x45f90c
mov al, byte [eax + esi]
cmp al, 0x2f
je 0x40976e
cmp al, 0x5c
je 0x40976e
push 1
push 0x44fd10
mov eax, 0x45f908
call fcn.004025a0
push 0x103
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.00433a30
push 0
call fcn.0043267b
mov esi, dword [0x45f90c]
add esp, 0x10
mov dword [esp + 0xc], edx
cmp dword [0x45f920], ebx
jae 0x4097a5
mov esi, 0x45f90c
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push esi
lea ecx, [esp + 0x1c]
push str._s_d__d
push ecx
call fcn.00431289
add esp, 0x14
push 0
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne al
test al, al
jne 0x409843
push 0
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
sete cl
cmp eax, 0xb7
je 0x409843
cmp eax, 3
je 0x409801
test cl, cl
jne 0x409843
push 0x3ff
lea ecx, [esp + 0x119]
push 0
push ecx
call fcn.00433a30
add esp, 0xc
push edi
mov ecx, 2
lea ebx, [esp + 0x118]
call fcn.00409d70
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x50c]
xor ecx, esp
call fcn.00430bbd
add esp, 0x510
ret
lea eax, [esp + 0x10]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409850
sub eax, edx
push eax
lea edx, [esp + 0x14]
lea esi, [edi + 0x1d0]
push edx
mov ecx, esi
call fcn.00402db0
call fcn.00401d20
mov ecx, dword [esp + 0x514]
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.00430bbd
add esp, 0x510
ret
Function at 0x409890
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x448846
mov eax, dword fs:[0]
push eax
sub esp, 0x490
mov eax, dword [0x45e480]
xor eax, esp
mov dword [esp + 0x48c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45e480]
xor eax, esp
push eax
lea eax, [esp + 0x4a4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x4b4]
push 0x44
xor ebx, ebx
lea eax, [esp + 0x44]
push ebx
push eax
call fcn.00433a30
xor eax, eax
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0xa8], 0xf
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
lea ecx, [ebp + 0x1d0]
push ecx
mov edi, str.Setup.exe
lea esi, [esp + 0x34]
mov dword [esp + 0x4bc], ebx
call fcn.00408240
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x90]
mov byte [esp + 0x4b8], 1
call fcn.00402740
mov edi, 0x10
mov byte [esp + 0x4ac], bl
cmp dword [esp + 0x3c], edi
jb 0x40996a
mov edx, dword [esp + 0x28]
push edx
call fcn.00413f54
add esp, 4
mov eax, dword [esp + 0x88]
cmp dword [esp + 0x9c], edi
jae 0x409981
lea eax, [esp + 0x88]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x44]
push edx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4099d9
push 0x3ff
lea eax, [esp + 0xa5]
push ebx
push eax
call fcn.00433a30
add esp, 0xc
push ebp
mov ecx, 6
lea ebx, [esp + 0xa4]
call fcn.00409d70
cmp dword [esp + 0x9c], edi
jb 0x409a13
mov ecx, dword [esp + 0x88]
push ecx
jmp 0x409a0b
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
cmp dword [esp + 0x9c], edi
jb 0x409a13
mov edx, dword [esp + 0x88]
push edx
call fcn.00413f54
add esp, 4
mov ecx, dword [esp + 0x4a4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48c]
xor ecx, esp
call fcn.00430bbd
add esp, 0x49c
ret 4
Function at 0x409a40
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x448f68
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x45e480]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x1e4], 0
je 0x409b91
lea eax, [esp + 0x14]
push eax
call fcn.004021e0
lea ebx, [esi + 0x1d0]
mov dword [esp + 0x38], 0
cmp dword [ebx + 0x18], 0x10
jb 0x409a9e
mov edx, dword [ebx + 4]
jmp 0x409aa1
lea edx, [ebx + 4]
lea ecx, [esp + 0x14]
call fcn.004035f0
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x20]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
xor esi, esi
test ecx, ecx
jle 0x409b24
push esi
lea eax, [esp + 0x18]
call fcn.00402460
cmp dword [eax + 0x18], 0x10
jb 0x409ae0
mov edi, dword [eax + 4]
jmp 0x409ae3
lea edi, [eax + 4]
push 0
push edi
call fcn.004310a9
add esp, 8
cmp eax, 0xffffffff
je 0x409b04
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x409b04
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x20]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
cmp esi, eax
jl 0x409acb
cmp dword [ebx + 0x18], 0x10
jb 0x409b2f
mov esi, dword [ebx + 4]
jmp 0x409b32
lea esi, [ebx + 4]
push 0
push esi
call fcn.004310a9
add esp, 8
cmp eax, 0xffffffff
je 0x409b49
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edi, ebx
call fcn.00402110
mov eax, dword [esp + 0x20]
xor esi, esi
cmp eax, esi
je 0x409b78
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x24]
push ecx
call fcn.00403d10
mov edx, dword [esp + 0x24]
add esp, 4
push edx
call fcn.00413f54
add esp, 4
mov eax, dword [esp + 0x14]
push eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call fcn.00413f54
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409ec0
Capabilities:
Create thread
Resume thread

Disassembly:
cmp byte [esi + 0x1c], 0
je 0x409eef
lea eax, [esi + 0x18]
push eax
push 0
push esi
push 0x409f60
push 0
push 0
call fcn.004328f5
add esp, 0x18
test eax, eax
mov dword [esi + 0xc], eax
mov byte [esi + 0x1c], 0
mov byte [esi + 0x1d], 0
setne al
ret
cmp byte [esi + 0x1d], 0
je 0x409f0b
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x409f07
xor al, al
ret
mov byte [esi + 0x1d], 0
mov al, 1
ret

Function at 0x409f10
Capabilities:
Terminate thread

Disassembly:
push ecx
mov ecx, dword [esi + 0xc]
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp], 0x103
jne 0x409f4f
mov edx, dword [esi + 0xc]
push 0x103
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [esi + 0xc], eax
mov byte [esi + 0x1e], al
mov byte [esi + 0x1c], 1
pop ecx
ret
mov byte [esi + 0x1e], 0
mov byte [esi + 0x1c], 1
pop ecx
ret