joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b6f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
test edi, edi
jbe 0x40b74e
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov eax, edi
push 0
sub eax, esi
lea ecx, [esi + ebx]
push eax
push ecx
push ebp
call sub.WS2_32.dll_send
test eax, eax
jle 0x40b738
add esi, eax
cmp esi, edi
jb 0x40b706
test esi, esi
jge 0x40b74e
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x3eb
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
or esi, 0xffffffff
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x3eb
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40bbe0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
push 0
push eax
push ecx
push edx
call sub.WS2_32.dll_recv
mov esi, eax
test esi, esi
jge 0x40bc0d
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x3eb
mov eax, esi
pop esi
ret
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0
mov eax, esi
pop esi
ret
Function at 0x40c090
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Query environment variable
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x1a4
lea eax, [esp + 0x14]
push ebx
push esi
push edi
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x40c0c5
call dword [sym.imp.MSVCRT.dll__errno]
pop edi
mov dword [eax], 0x3e9
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x1a4
ret
mov ax, word [esp + 0x20]
cmp al, 1
jne 0x40c284
xor ecx, ecx
mov cl, ah
cmp cl, al
jne 0x40c284
push 0
call sub.WS2_32.dll_WSASetLastError
mov esi, dword [esp + 0x1b4]
test esi, esi
jne 0x40c0f5
mov esi, 0x4181fc
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov al, byte [ecx + esi]
cmp al, 0x30
jb 0x40c106
cmp al, 0x39
jbe 0x40c10a
cmp al, 0x2e
jne 0x40c10d
inc ecx
jmp 0x40c0f7
cmp byte [ecx + esi], 0
jne 0x40c13b
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x40c1bf
call dword [sym.imp.MSVCRT.dll__errno]
pop edi
mov dword [eax], 0x3ea
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x1a4
ret
mov edi, dword [sym.imp.MSVCRT.dll_getenv]
push 0x418208
call edi
add esp, 4
test eax, eax
jne 0x40c15d
push 0x418214
call edi
add esp, 4
test eax, eax
je 0x40c195
mov edi, esi
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x40c187
test cl, cl
je 0x40c183
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x40c187
add eax, 2
add edi, 2
test cl, cl
jne 0x40c15f
xor eax, eax
jmp 0x40c18c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c195
mov esi, 0x418224
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x40c1b8
call dword [sym.imp.MSVCRT.dll__errno]
pop edi
mov dword [eax], 0x3ea
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x1a4
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
xor edx, edx
mov dword [esp + 0x10], edx
mov word [esp + 0x10], 2
mov dword [esp + 0x14], edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1b8]
mov dword [esp + 0x18], edx
push eax
mov dword [esp + 0x20], edx
call sub.WS2_32.dll_htons
push 0
push 1
push 2
mov word [esp + 0x1e], ax
call sub.WS2_32.dll_socket
mov ebx, eax
test ebx, ebx
jge 0x40c218
call dword [sym.imp.MSVCRT.dll__errno]
pop edi
mov dword [eax], 0x3eb
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x1a4
ret
lea ecx, [esp + 0x10]
push 0x10
push ecx
push ebx
call sub.WS2_32.dll_connect
test eax, eax
jge 0x40c242
call dword [sym.imp.MSVCRT.dll__errno]
pop edi
mov dword [eax], 0x3eb
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x1a4
ret
mov edi, 0x418230
mov ecx, 0xa
xor edx, edx
push 4
repe cmpsb byte [esi], byte es:[edi]
mov eax, edx
mov dword [esp + 0x10], 1
sete al
mov dword [0x4180bc], eax
mov dword [0x4180c0], eax
lea eax, [esp + 0x10]
push eax
push 1
push 6
push ebx
call sub.WS2_32.dll_setsockopt
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x1a4
ret
call dword [sym.imp.MSVCRT.dll__errno]
pop edi
mov dword [eax], 0x3e8
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x1a4
ret
Function at 0x40c340
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x100
push esi
mov esi, dword [esp + 0x108]
push 2
push esi
call sub.WS2_32.dll_shutdown
push 0
lea eax, [esp + 8]
push 0x100
push eax
push esi
call sub.WS2_32.dll_recv
test eax, eax
jle 0x40c382
push 0
lea ecx, [esp + 8]
push 0x100
push ecx
push esi
call sub.WS2_32.dll_recv
test eax, eax
jg 0x40c36c
push esi
call sub.WS2_32.dll_closesocket
mov esi, dword [sym.imp.MSVCRT.dll__errno]
test eax, eax
je 0x40c3ab
call esi
mov dword [eax], 0x3eb
call sub.WS2_32.dll_WSACleanup
call esi
mov eax, dword [eax]
pop esi
add esp, 0x100
ret
call esi
mov dword [eax], 0
call sub.WS2_32.dll_WSACleanup
call esi
mov eax, dword [eax]
pop esi
add esp, 0x100
ret

Function at 0x40d7d0
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x40d7dd
xor eax, eax
pop esi
ret
mov al, byte [esi + 8]
test al, al
jne 0x40d809
mov eax, dword [esi]
push eax
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov byte [esi + 8], 1
test eax, eax
je 0x40d809
push 0
push 0
push eax
call dword [sym.imp.MSVCRT.dll_strtoul]
add esp, 0xc
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
pop esi
ret
Function at 0x402f7c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x402f96
push dword [ebp + 0x14]
call fcn.0040269a
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
test dword [ecx + edi*8 - 0x7a380001], ecx
jl 0x402f9b
mov dword [ebp - 0x384], 4

Function at 0x403526
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
stc
invalid
add esp, 0x14
call fcn.004026d5
je 0x40357b
loopne 0x403513
push dword [ebp - 0x698]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
mov eax, dword [ebp - 0x33c]
mov esp, dword [ebp + 0x1c]
mov dword [esp - 4], eax
popal
add esp, 0x14
jmp dword [esp - 0x38]
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.004026d5
sbb ebx, dword [ecx + 0x4a]
or dword [eax - 0x22f5b], eax
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
inc eax
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x4037a1
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x4037be
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x104
jge 0x403825
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
and eax, 0x80
test eax, eax
je 0x4037f0
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
jmp 0x403823
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
cmp eax, 0x5c
jne 0x40380f
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x338], eax
invalid
test dword [eax], esi
cld

Function at 0x4035e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004026b3
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
invalid
invalid
Function at 0x4044e1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + edi*8 - 1], eax
call dword [eax - 0x18]
stc
loope 0x4044ea
invalid
call [ecx + 0x50]
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00402646
add esp, 0xc
jmp 0x40464d
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.004026d5
invalid

Function at 0x404ce5
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ebp
push esi
push edi
push 1
lea eax, [esp + 0x18]
push eax
push edx
mov dword [esp + 0x1c], edx
mov esi, ecx
call ebx
mov ecx, esi
mov edi, eax
call fcn.004147df
lea ebp, [edi + 2]
push ebp
mov ecx, esi
call fcn.0040420b
inc edi
push edi
push ebp
mov ecx, esi
call fcn.0040420b
push eax
push dword [esp + 0x18]
call ebx
mov ecx, esi
call fcn.004041f0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x40541a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
push edi
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x42275c], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.0041bd00
call fcn.00403c85
push 3
pop ecx
call fcn.00403ce0
push 0x28
pop ecx
mov dword [0x422760], eax
call fcn.00403ce0
push 2
pop ecx
mov dword [0x42274c], eax
call fcn.00403ce0
push 5
pop ecx
mov dword [0x422738], eax
call fcn.00403ce0
push 0x15
pop ecx
mov dword [0x42273c], eax
call fcn.00403ce0
push 0x16
pop ecx
mov dword [0x422754], eax
call fcn.00403ce0
push 0x17
pop ecx
mov dword [0x422748], eax
call fcn.00403ce0
xor ebx, ebx
mov dword [0x422744], eax
mov dword [0x422758], ebx
mov dword [0x422750], ebx
xor edi, edi
push ebx
push edi
lea eax, [ebp - 0x268]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40550c
push edi
lea eax, [ebp - 0x5c]
push 0x41ead4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 1
lea edx, [ebp - 0x268]
lea ecx, [ebp - 0x5c]
call fcn.00404f69
xor esi, esi
cmp dword [esi + 0x42246c], edi
jne 0x405504
mov ecx, dword [esi + 0x422470]
push ebx
lea edx, [ebp - 0x268]
call fcn.00404f69
add esi, 8
cmp esi, 0x28
jb 0x4054ea
inc edi
cmp edi, 0x40
jl 0x4054b1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x3ae06de0
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x5a737ff3
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x402a36
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x451c10]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402aca
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402a87
cmp dword [ebp + 0x10], ebx
jne 0x402abe
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a36
test eax, eax
jne 0x402a99
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a6e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405d2e
cmp eax, ebx
je 0x402ad1
push ebx
push dword [0x451c10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402aca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
jmp 0x754678
cmp dword [0x451c10], ebx
jne 0x402ac7
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ac7
jmp 0x402aca
Function at 0x402e5b
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x402e78
mov dword [ebp - 8], reloc.GDI32.dll_SetTextColor
and dword [ebp - 4], 0
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x402e8a
mov dword [ebp - 0xc], 0x421788
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402e9f
mov ecx, dword [0x451bb8]
add ecx, eax
push ecx
call fcn.004030af
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.0040307d
test eax, eax
je 0x403028
test byte [ebp + 0x17], 0x80
je 0x403011
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
and dword [0x4140ec], 0
and dword [0x4140e8], 0
and dword [ebp + 0x14], 0x7fffffff
mov dword [ebp - 0x10], eax
mov eax, 0x415770
mov dword [0x413bd0], 8
mov dword [0x41d778], eax
mov dword [0x41d774], eax
mov eax, dword [ebp + 0x14]
mov dword [0x41d770], 0x41d770
mov dword [ebp + 8], eax
jle 0x403073
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402f18
mov esi, dword [ebp + 0x14]
mov edi, 0x41d788
push esi
push edi
call fcn.0040307d
test eax, eax
je 0x403028
sub dword [ebp + 0x14], esi
mov dword [0x413bc0], edi
mov dword [0x413bc4], esi
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
push 0x413bc0
mov dword [0x413bc8], edi
mov dword [0x413bcc], eax
call fcn.00405e08
test eax, eax
mov dword [ebp - 0x18], eax
jl 0x403009
mov esi, dword [0x413bc8]
sub esi, edi
call ebx
test byte [0x451c14], 1
mov edi, eax
je 0x402fb9
sub eax, dword [ebp - 0x10]
cmp eax, 0xc8
ja 0x402f86
cmp dword [ebp + 0x14], 0
jne 0x402fb9
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x58]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
push 0
call fcn.00404daa
mov dword [ebp - 0x10], edi
xor eax, eax
cmp esi, eax
je 0x402ffe
cmp dword [ebp + 0x10], eax
jne 0x402fe4
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40300d
cmp dword [ebp - 0x14], esi
jne 0x40300d
add dword [ebp - 4], esi
jmp 0x402ff2
mov eax, dword [0x413bc8]
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x18], 1
jne 0x402f3b
jmp 0x403073
cmp dword [ebp + 0x14], eax
jg 0x402f0b
jmp 0x403073
push 0xfffffffffffffffc
jmp 0x40302a
push 0xfffffffffffffffe
jmp 0x40302a
test edi, edi
je 0x403068
cmp dword [ebp + 0x14], esi
jge 0x40301d
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.0040307d
test eax, eax
jne 0x403070
push 0xfffffffffffffffd
pop eax
jmp 0x403076
jmp 0x756394
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4030c6
Capabilities:
Create directory

Disassembly:
push esi
mov esi, 0x484000
push esi
call fcn.00405c6e
push esi
call fcn.0040556c
test eax, eax
jne 0x4030de
pop esi
ret
push esi
jmp loc.00755437
Function at 0x403555
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [0x451b70]
push edi
push 6
call fcn.00405d2e
xor ebx, ebx
cmp eax, ebx
je 0x403581
call eax
movzx eax, ax
push eax
push 0x482000
call fcn.0040596a
jmp 0x4035cb
mov edi, 0x43b7e0
push ebx
push edi
push ebx
push str.Control_PanelDesktopResourceLocale
push 0x80000001
mov dword [0x482000], 0x7830
call fcn.004058f3
cmp byte [0x43b7e0], bl
jne 0x4035c0
push ebx
push edi
push 0x407302
push str..DEFAULTControl_PanelInternational
push 0x80000003
call fcn.004058f3
push edi
push 0x482000
call sub.KERNEL32.dll_lstrcatA
call fcn.0040381e
mov eax, dword [0x451b78]
mov ebp, 0x47c000
and eax, 0x20
push ebp
mov dword [0x451be0], eax
mov dword [0x451bfc], 0x10000
call fcn.004055e0
test eax, eax
jne 0x40367b
mov ecx, dword [esi + 0x48]
cmp ecx, ebx
je 0x40367b
mov edx, dword [esi + 0x4c]
mov eax, dword [0x451b98]
mov edi, 0x449b00
push ebx
add edx, eax
push edi
add ecx, eax
push edx
push ecx
push dword [esi + 0x44]
call fcn.004058f3
mov al, byte [0x449b00]
cmp al, bl
je 0x40367b
cmp al, 0x22
jne 0x40363a
mov edi, 0x449b01
push 0x22
push edi
call fcn.0040552a
mov byte [eax], bl
push edi
call sub.KERNEL32.dll_lstrlenA
lea eax, [eax + edi - 4]
cmp eax, edi
jbe 0x40366e
push str..exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40366e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403668
test al, 0x10
jne 0x40366e
push edi
call fcn.00405546
push edi
call fcn.004054ff
push eax
push ebp
call fcn.00405a0c
jmp 0x754f5d

Function at 0x40526c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x447fe8], 0x44
push eax
xor eax, eax
push 0x447fe8
push eax
jmp loc.00757fe1
Function at 0x405331
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004055e0
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x405365
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x451be8], eax
jmp 0x4054f9
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405383
test eax, eax
je 0x4054a4
test byte [ebp + 0xc], 2
je 0x4054a4
mov esi, 0x4437e8
push edi
push esi
call fcn.00405a0c
test ebx, ebx
je 0x4053a0
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x4053a6
push edi
call fcn.00405546
cmp byte [edi], 0
jne 0x4053b4
cmp byte [0x4437e8], 0x5c
jne 0x4053bf
push 0x409010
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40549a
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.0040552a
cmp byte [eax], 0
je 0x405405
cmp byte [ebp - 0x18], 0
je 0x405405
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x40541b
mov al, byte [esi + 1]
test al, al
je 0x405479
cmp al, 0x2e
jne 0x40541b
cmp byte [esi + 2], 0
je 0x405479
push esi
push ebx
jmp 0x755773
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4053e3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x4054a4
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4054f9
cmp dword [ebp - 8], esi
jne 0x4054b9
inc dword [0x451be8]
jmp 0x4054f9
push edi
call fcn.00405d07
test eax, eax
je 0x4054f9
push edi
call fcn.004054ff
push edi
call fcn.004056c4
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4054f1
test byte [ebp + 0xc], 4
je 0x4054b1
push edi
push 0xfffffffffffffff1
call fcn.00404daa
push esi
push edi
call fcn.0040575a
jmp 0x4054f9
push edi
push 0xffffffffffffffe5
call fcn.00404daa
pop edi
pop esi
leave
ret 8

Function at 0x4055e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x4457e8
push esi
call fcn.00405a0c
push esi
call fcn.00405593
mov edi, eax
test edi, edi
jne 0x405601
xor eax, eax
jmp 0x405653
push edi
call fcn.00405c6e
test byte [0x451b78], 0x80
je 0x40561a
jmp 0x757084
sub edi, esi
jmp 0x405632
call fcn.00405d07
test eax, eax
je 0x40562c
test byte [eax], 0x10
je 0x4055fd
push esi
call fcn.00405546
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x40561e
call fcn.004054ff
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4056c4
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4056e0
jmp loc.00757bd6
ret 4
Function at 0x4056e3
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp loc.0075419e

Function at 0x405712
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
jmp loc.007561f6

Function at 0x40575a
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405d2e
test eax, eax
mov esi, dword [esp + 0x18]
je 0x40577e
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x4058b7
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x448170], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x448170
je 0x4057c2
push 1
push 0
push esi
call fcn.004056e3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x4058bd
cmp eax, edi
jg 0x4058bd
mov esi, 0x447be8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x4058bd
cmp eax, edi
jg 0x4058bd
push esi
push ebp
push str._s_s_r_n
push 0x4477e8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x451b70]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405a2e
push 4
push 0xc0000000
push esi
call fcn.004056e3
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x4058b7
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4058b0
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4058b0
cmp edi, dword [esp + 0x18]
jne 0x4058b0
push str._Rename__r_n
push esi
call fcn.00405658
test eax, eax
jne 0x4058c4
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405a0c
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x4477e8
push eax
call fcn.004056a4
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x451bf0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409330
push eax
call fcn.00405658
test eax, eax
je 0x40587b
jmp 0x754b52