joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4067bb
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebx], fcn.00406969
mov dword [ebx + 4], 0x989680
mov word [ebx + 8], 0
mov byte [ebx + 0xa], al
mov byte [ebx + 0xb], 1
call fcn.00401371
push eax
lea ecx, [ebx + 0xc]
call fcn.00401791
push dword [ebp + 8]
xor edi, edi
lea ecx, [ebx + 0x14]
mov dword [ebx + 0x10], edi
call fcn.00403f54
mov dword [ebx + 0x18], edi
call fcn.00401371
push eax
lea ecx, [ebx + 0x1c]
call fcn.00401791
movzx eax, byte [0x440d19]
neg eax
sbb eax, eax
and eax, 0x440d20
mov dword [ebp + 8], eax
je 0x40688e
lea ecx, [ebp + 0xc]
push ecx
mov ecx, eax
call fcn.004066ce
mov esi, dword [ebp + 0xc]
cmp dword [esi - 0xc], edi
je 0x40686a
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push 0x989680
push str.MaxLogFileSize
push str.LoggingSettings
call edi
mov dword [ebx + 4], eax
xor eax, eax
push esi
inc eax
push eax
push str.LogFileWide
push str.LoggingSettings
call edi
test eax, eax
setne al
jmp 0x406874
xor eax, eax
mov dword [ebx + 4], 0x989680
inc eax
mov byte [ebx + 0xb], al
lea ecx, [ebx + 0x1c]
mov eax, dword [ebp + 8]
add eax, 0x54
push eax
call fcn.004015e6
lea ecx, [esi - 0x10]
call fcn.004015ce
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x406a5a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x43f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
lea edx, [ebp - 0x6c]
push edi
xor edi, edi
mov dword [ebp - 0x6c], edi
mov ecx, dword [esi + 0x14]
call fcn.00404ce3
mov eax, dword [ebp - 0x6c]
cmp eax, dword [esi + 4]
jbe 0x406a91
mov ecx, esi
call fcn.00406bc4
xor eax, eax
cmp byte [esi + 0xa], al
push edi
setne al
push 0x80
lea eax, [eax*2 + 2]
push eax
push edi
push 3
push 0x40000000
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x18], eax
cmp eax, 0xffffffff
jne 0x406aca
mov dword [esi + 0x18], edi
xor al, al
jmp 0x406b5c
lea ecx, [ebp - 0x8c]
call fcn.004021a0
push 0x221
push 0x20
push 2
lea eax, [ebp - 0x68]
push 0x439750
push eax
call fcn.00401cff
add esp, 0x14
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x8c]
push edi
push 0xc0010000
push eax
call fcn.0040221d
lea ecx, [ebp - 0x68]
mov bl, al
call fcn.00401de8
test bl, bl
je 0x406b24
push ecx
mov ecx, dword [esi + 0x14]
lea eax, [ebp - 0x8c]
push eax
call fcn.00403029
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x406b4f
cmp byte [esi + 0xb], 0
je 0x406b4f
push edi
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], edi
push eax
push 2
push 0x438658
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x8c]
call fcn.004021e6
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415e90
leave
ret
Function at 0x40838b
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4083f1
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
test eax, eax
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
pop ebx
call fcn.00415e90
leave
ret

Function at 0x40913a
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4091a9
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x409185
push ebx
push edi
push eax
call fcn.00417e60
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x4091a0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret

Function at 0x40bbd7
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 9
mov esi, ecx
lea edi, [ebp - 0x44]
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0x40]
lea ebx, [edi - 1]
not ebx
and ebx, dword [ebp + 8]
je 0x40bc28
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
lea ecx, [esi + 0xc]
call fcn.0040c619
cmp eax, dword [esi + 0xc]
je 0x40bc1c
cmp ebx, dword [eax + 0x10]
jae 0x40bc1f
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0xc]
jne 0x40bc31
sub ebx, edi
jne 0x40bc03
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push 7
lea esi, [eax + 0x14]
pop ecx
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x14]
add ecx, ebx
cmp ecx, dword [ebp + 8]
jbe 0x40bc28
mov eax, ebx
jmp 0x40bc2a
Function at 0x40bf30
Capabilities:
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x78
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x74]
push 9
pop ecx
xor eax, eax
mov dword [ebp - 0xc], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
and dword [esi + 8], eax
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [ebp - 0x30]
push eax
push 0
jmp 0x40c036
cmp dword [ebp - 0x20], 0x1000
jne 0x40c027
mov eax, dword [ebp - 0xc]
lea esi, [ebp - 0x30]
push 7
pop ecx
lea edi, [ebp - 0x50]
add eax, 0xc
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 4]
push ecx
mov ecx, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], edi
call fcn.0040c619
mov esi, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp esi, eax
je 0x40bfc2
cmp edi, dword [esi + 0x10]
jae 0x40c004
push 0x30
call fcn.00404701
mov edx, eax
xor eax, eax
pop ecx
mov ecx, dword [ebp - 4]
push 7
lea edi, [edx + 0x10]
mov dword [edi], ecx
add edi, 4
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0x10]
push edx
push eax
push esi
lea eax, [ebp - 0x14]
mov word [edx + 0xc], 0
push eax
call fcn.0040ca9d
mov esi, dword [ebp - 0x14]
lea edi, [esi + 0x14]
push 7
pop ecx
lea esi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
test byte [ebp - 0x1c], 0x70
je 0x40c027
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, ecx
div dword [ebp - 0x70]
mov edx, dword [ebp - 0xc]
add dword [edx + 8], eax
jmp 0x40c02a
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
add eax, ecx
lea ecx, [ebp - 0x30]
push 0x1c
push ecx
push eax
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp eax, 0x1c
je 0x40bf7d
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x412a3c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x200
xor ebx, ebx
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.00416a10
add esp, 0xc
mov dword [ebp - 0x20c], pe_nt_image_headers32
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push 3
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x412aa0
push ecx
lea ecx, [ebp - 0x204]
call fcn.00404e00
pop ecx
test al, al
je 0x412aa0
mov al, 1
jmp 0x412ae5
push esi
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], ebx
push eax
push 0x64
push ebx
call dword [sym.imp.NETAPI32.dll_NetWkstaGetInfo]
mov esi, dword [ebp - 0x208]
test eax, eax
jne 0x412adb
cmp dword [esi + 8], ebx
je 0x412adb
push str.google
push dword [esi + 8]
call fcn.004237cc
pop ecx
pop ecx
test eax, eax
jne 0x412adb
mov bl, 1
push esi
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov al, bl
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00415e90
leave
ret

Function at 0x4136b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
mov byte [ebp - 1], cl
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.0041329c
test eax, eax
js 0x4137da
mov ebx, dword [ebp - 0x18]
cmp dword [ebp - 0x1c], ebx
je 0x4137da
call fcn.0041267f
cmp byte [ebp - 1], 0
mov eax, str.HKLMSoftwareGoogleUpdate_
jne 0x413700
mov eax, str.HKCUSoftwareGoogleUpdate_
push eax
lea ecx, [ebp - 8]
call fcn.00403f54
push 0x43c2f0
lea ecx, [ebp - 0xc]
call fcn.00403f54
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 8]
lea ecx, [ebp - 0x10]
call fcn.00403854
pop ecx
push eax
lea ecx, [ebp - 8]
call fcn.004015e6
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.004015ce
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.004015ce
mov esi, dword [ebp - 8]
mov ecx, esi
call fcn.00407b6d
test al, al
jne 0x413761
mov cl, byte [ebp - 1]
mov dl, 1
call fcn.004137ec
mov edi, eax
jmp 0x4137cc
push 1
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0x439948
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], 0x200
call fcn.004076bd
mov edi, eax
test edi, edi
js 0x4137bd
mov eax, dword [ebp - 0x1c]
xor edi, edi
sub ebx, eax
sar ebx, 2
test ebx, ebx
je 0x4137b1
push 0
push 0
push 0
push 0
push dword [eax + edi*4]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4137d6
mov eax, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x413791
mov cl, byte [ebp - 1]
xor dl, dl
call fcn.004137ec
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0x439948
call fcn.00407560
lea ecx, [esi - 0x10]
call fcn.004015ce
jmp 0x4137dd
xor edi, edi
jmp 0x4137bd
xor edi, edi
inc edi
lea ecx, [ebp - 0x1c]
call fcn.00404ba2
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41497e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x43fa1c
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
push 0x43fa1c
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
and dword [esi + 0x18], 0
and dword [esi + 0x1c], 0
mov dword [ebp + 8], eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp + 8], 0
jne 0x4149c0
test ebx, ebx
je 0x414a1e
lea ebx, [edi + 0x1c]
mov ecx, edi
push ebx
push str.Counts
call fcn.00414955
test al, al
je 0x414a1e
push dword [esi + 4]
lea ecx, [ebp - 4]
call fcn.00405383
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
xor edi, edi
mov edx, esi
push eax
mov ecx, ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call fcn.00414c47
mov eax, dword [ebp + 8]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
adc dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
pop ecx
push 8
push eax
push 3
push edi
push esi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [esi - 0x10]
call fcn.004015ce
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4019b0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], 0x419161
lea eax, [ebx + 0x68]
mov dword [esp], eax
call fcn.004047f0
mov dword [esp + 0x18], eax
test eax, eax
je 0x401b30
mov eax, dword [esp + 0x44]
mov dword [esp + 8], 0
mov eax, dword [eax + 4]
add eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040fc80
test eax, eax
mov eax, dword [esp + 0x44]
js 0x401b08
mov ebx, dword [eax + 0xc]
mov dword [esp], ebx
call sub.msvcrt.dll_malloc
mov dword [esp + 0x1c], eax
test eax, eax
je 0x401b51
mov eax, dword [esp + 0x44]
cmp byte [eax + 0x10], 1
je 0x401ae8
mov edx, ebx
xor ecx, ecx
test ebx, ebx
je 0x401aca
mov ebp, dword [esp + 0x1c]
jmp 0x401a4c
sub edx, esi
sbb ecx, edi
add ebp, esi
mov ebx, ecx
or ebx, edx
je 0x401aca
mov eax, 0x2000
mov esi, edx
mov edi, ecx
cmp eax, edx
mov eax, 0
sbb eax, ecx
jae 0x401a67
mov esi, 0x2000
xor edi, edi
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
mov dword [esp], ebp
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
call sub.msvcrt.dll_fread
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test eax, eax
jne 0x401a40
mov eax, dword [esp + 0x44]
mov dword [esp + 4], str.Failed_to_extract__s:_failed_to_read_data_chunk__n
mov dword [esp], str.fread
add eax, 0x12
mov dword [esp + 8], eax
call fcn.00403190
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [esp + 0x1c]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x44]
xor ecx, ecx
mov dword [esp], eax
mov eax, dword [esp + 0x18]
call fcn.00401640
test eax, eax
je 0x401aca
jmp 0x401ab6
add eax, 0x12
mov dword [esp + 4], str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
mov dword [esp + 8], eax
mov dword [esp], str.fseek
call fcn.00403190
mov dword [esp + 0x1c], 0
jmp 0x401aca
mov eax, dword [esp + 0x44]
mov dword [esp], str.Failed_to_extract__s:_failed_to_open_archive_file__n
add eax, 0x12
mov dword [esp + 4], eax
call fcn.00403030
mov dword [esp + 0x1c], 0
jmp 0x401ad6
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
add eax, 0x12
mov dword [esp], str.malloc
mov dword [esp + 8], eax
call fcn.00403190
jmp 0x401aca
Function at 0x408260
Capabilities:
Query environment variable

Disassembly:
push ebx
mov eax, 0x4018
call fcn.0040f380
sub esp, eax
mov eax, dword [esp + 0x4020]
mov dword [esp + 8], 0
lea ebx, [esp + 0x10]
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.004097f0
mov dword [esp + 8], 0x2000
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub esp, 0xc
test eax, eax
jne 0x4082c0
add esp, 0x4018
xor eax, eax
pop ebx
ret
lea eax, [esp + 0x2010]
mov dword [esp + 8], 0x2000
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub esp, 0xc
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.00409610
test eax, eax
je 0x4082ac
cmp byte [eax], 0
je 0x4082ac
mov dword [esp], eax
call sub.msvcrt.dll__strdup
add esp, 0x4018
pop ebx
ret

Function at 0x408380
Capabilities:
Set environment variable

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.004097f0
mov dword [esp + 4], 0
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
sub esp, 8
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
Function at 0x408710
Capabilities:
Delete directory

Disassembly:
push ebp
mov eax, 0x445c
push edi
push esi
push ebx
call fcn.0040f380
sub esp, eax
mov eax, dword [esp + 0x4470]
mov dword [esp + 8], 0x1000
lea ebx, [esp + 0x44c]
mov dword [esp + 4], eax
lea eax, [esp + 0x244e]
mov dword [esp], eax
call fcn.004097f0
lea eax, [esp + 0x244e]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscpy
mov dword [esp], ebx
call sub.msvcrt.dll_wcslen
mov ebp, eax
movzx eax, word [esp + eax*2 + 0x44a]
cmp ax, 0x2f
je 0x40877e
cmp ax, 0x5c
jne 0x408820
mov dword [esp + 4], 0x41b4e2
mov dword [esp], ebx
call sub.msvcrt.dll_wcscat
lea eax, [esp + 0x230]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll__wfindfirst]
mov dword [esp + 0x22c], eax
cmp eax, 0xffffffff
jne 0x4087d0
lea eax, [esp + 0x244e]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wrmdir]
add esp, 0x445c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, 0x87
mov edi, esp
lea esi, [esp + 0x230]
mov eax, ebx
rep movsd dword es:[edi], dword [esi]
mov edx, ebp
call fcn.00408840
lea eax, [esp + 0x230]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x22c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wfindnext]
test eax, eax
je 0x4087d0
mov eax, dword [esp + 0x22c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__findclose]
jmp 0x4087ae
mov dword [esp + 4], 0x41b4de
add ebp, 1
mov dword [esp], ebx
call sub.msvcrt.dll_wcscat
jmp 0x40877e

Function at 0x408840
Capabilities:
Delete directory
Delete file

Disassembly:
push edi
push esi
push ebx
push eax
mov eax, 0x101c
call fcn.0040f380
sub esp, eax
mov edi, edx
mov eax, dword [esp + eax]
lea esi, [esp + 0x1044]
mov dword [esp + 4], 0x41b4e6
mov dword [esp], esi
mov ebx, eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x408880
add esp, 0x1020
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], 0x41b4ea
mov dword [esp], esi
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x408872
xor eax, eax
mov word [ebx + edi*2], ax
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_wcscat
test byte [esp + 0x1030], 0x10
mov dword [esp], ebx
je 0x4088e0
call fcn.00409b30
test eax, eax
jne 0x408910
mov dword [esp + 4], ebx
lea ebx, [esp + 0x1f]
mov dword [esp + 8], 0x1000
mov dword [esp], ebx
call fcn.00409610
mov dword [esp], ebx
call fcn.00408710
jmp 0x408872
mov esi, dword [sym.imp.msvcrt.dll__wremove]
call esi
test eax, eax
je 0x408872
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
mov dword [esp], ebx
call esi
jmp 0x408872
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__wrmdir]
jmp 0x408872
Function at 0x408b80
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push edi
mov eax, 0x1010
push esi
push ebx
call fcn.0040f380
sub esp, eax
mov eax, dword [esp + 0x1020]
mov dword [esp + 4], 0x41b580
mov dword [esp], eax
call fcn.004047f0
mov ebx, eax
mov eax, dword [esp + 0x1028]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1024]
mov dword [esp], eax
call fcn.00408a50
mov edi, eax
test ebx, ebx
je 0x408c98
test eax, eax
je 0x408c8c
lea esi, [esp + 0x10]
lea esi, [esi]
nop
mov dword [esp], ebx
call sub.msvcrt.dll_feof
test eax, eax
jne 0x408c88
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.msvcrt.dll_fread
test eax, eax
jne 0x408c30
mov dword [esp], ebx
call sub.msvcrt.dll_ferror
test eax, eax
je 0x408be0
mov dword [esp], ebx
mov esi, 0xffffffff
call sub.msvcrt.dll_clearerr
jmp 0x408c65
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.msvcrt.dll_fwrite
test eax, eax
je 0x408c58
mov dword [esp], edi
call sub.msvcrt.dll_ferror
test eax, eax
je 0x408be0
mov dword [esp], edi
mov esi, 0xffffffff
call sub.msvcrt.dll_clearerr
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov dword [esp], edi
call sub.msvcrt.dll_fclose
add esp, 0x1010
mov eax, esi
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x408c65
test ebx, ebx
je 0x408c98
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov esi, 0xffffffff
test edi, edi
jne 0x408c6d
jmp 0x408c75
Function at 0x408d30
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push ebp
mov eax, 0x20ac
push edi
push esi
push ebx
call fcn.0040f380
xor ebx, ebx
sub esp, eax
mov eax, dword [esp + 0x20c0]
lea ecx, [esp + 0xa0]
mov dword [esp + 8], 0x1000
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 0x3c], 0
call fcn.004097f0
mov dword [esp + 4], 1
mov dword [esp], 0x4080f0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
sub esp, 8
lea edi, [esp + 0x5c]
mov dword [esp + 0x40], 0xc
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 1
mov esi, dword [fcn.00417950]
sub esp, 4
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x88], 0x101
mov word [esp + 0x8c], ax
mov dword [esp], 0
call esi
mov dword [esp], eax
call sub.msvcrt.dll__fileno_1
mov ebp, dword [sym.imp.msvcrt.dll__get_osfhandle]
mov dword [esp], eax
call ebp
mov dword [esp], 1
cmp eax, 0xffffffff
cmove eax, ebx
mov dword [esp + 0x94], eax
call esi
mov dword [esp], eax
call sub.msvcrt.dll__fileno_1
mov dword [esp], eax
call ebp
mov dword [esp], 2
cmp eax, 0xffffffff
cmove eax, ebx
mov dword [esp + 0x98], eax
call esi
mov dword [esp], eax
call sub.msvcrt.dll__fileno_1
mov dword [esp], eax
call ebp
cmp eax, 0xffffffff
cmove eax, ebx
mov dword [esp + 0x9c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x4c]
lea ecx, [esp + 0xa0]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edx
lea edx, [esp + 0x40]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x408ef0
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
mov eax, dword [esp + 0x3c]
add esp, 0x20ac
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], str.Error_creating_child_process__n
mov dword [esp], str.CreateProcessW
call fcn.004030f0
add esp, 0x20ac
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret