joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40930c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40935e
test eax, edx
je 0x409361
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x409321
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x409347
add ecx, 4
js 0x409337
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x409344
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x40936d
test edx, edx
jne 0x409314
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x409d5c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00405804
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409d7a
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x409d9b
cmp ebx, 3
je 0x409d9b
cmp ebx, 0x7b
je 0x409d9b
mov eax, esi
call fcn.00409d1c
test al, al
jne 0x409d9f
xor eax, eax
jmp 0x409da1
mov al, 1
pop esi
pop ebx
ret

Function at 0x409da4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405804
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409dbd
test al, 0x10
jne 0x409dc1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x409ec0
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405804
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x409ed4
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00405804
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x409ef6
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40ce1c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ce55
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00405464
jmp 0x40ce5e
mov eax, ebx
mov edx, esi
call fcn.004053c8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ce68
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ce8a
movzx eax, byte [esp]
jmp 0x40ce8c
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40d51c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40d394
mov eax, dword [0x4a80c0]
cmp byte [eax], 0
je 0x40d598
mov eax, dword [0x4a7e8c]
call fcn.004037b0
call fcn.00403038
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040a474
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40d5e0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40d5ce
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4a7e3c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4ab7f8]
call fcn.00406b14
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x41df80
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041dcbc
dec esi
jne 0x41dfa2
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x420238
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x4202d0
push 0
mov eax, ebx
call fcn.00405804
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x4202ab
mov ebx, esi
test ebx, ebx
je 0x420281
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, esi
call fcn.00405804
push eax
push 1
push 0
mov eax, edi
call fcn.00405804
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x4202c6
mov ecx, dword [0x4a7ea8]
mov dl, 1
mov eax, dword [0x41ee2c]
call fcn.0040d6a0
call fcn.00404c64
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4202ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00405374
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405804
push eax
push edi
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x420393
xor eax, eax
push ebp
push 0x42038c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00405a94
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.00405804
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405804
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x42036e
mov edx, dword [ebp - 8]
dec edx
mov eax, ebx
call fcn.00405a94
jmp 0x420375
mov eax, ebx
call fcn.00405374
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420393
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42463c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x424704
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00405374
xor eax, eax
push ebp
push 0x4246de
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.00405804
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov ebx, eax
test ebx, ebx
jle 0x4246d4
inc ebx
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x424614]
call fcn.00406a28
add esp, 4
push ebx
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.00405804
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
test eax, eax
je 0x4246bc
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.0040556c
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x424614]
call fcn.00406a28
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4246e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42470b
lea eax, [ebp - 4]
mov edx, dword [0x424614]
call fcn.00406a34
ret

Function at 0x4251c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00405374
xor edx, edx
push ebp
push 0x42524c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x201]
push eax
push 0
push 0
push esi
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, 0x80000000
sete al
test al, al
je 0x425242
mov edx, ebx
lea eax, [ebp - 0x201]
call fcn.0040a614
cmp dword [ebx], 0
je 0x425242
mov eax, dword [ebx]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x42522d
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x425242
mov eax, ebx
mov edx, 0x425268
call fcn.00405640
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x425256
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4258cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x425a49
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x425a21
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.00429b84
cmp al, 9
jb 0x4259af
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00405a94
xor edx, edx
push ebp
push 0x4259a8
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00405804
push eax
push 0
push 0
push 0x23
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, eax
jne 0x425990
mov eax, dword [ebp - 4]
call fcn.00405804
mov edx, dword [ebp - 8]
call fcn.0040a614
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x425962
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x42597e
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040e310
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004053c8
call fcn.00404d10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x425a2b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4259af
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405a94
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4a7e98]
mov eax, dword [eax]
mov ecx, 0x425a60
mov edx, 0x425a78
call fcn.0042cdec
test al, al
je 0x425a17
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4259e3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x425a17
mov eax, dword [ebp - 8]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4259fb
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x5c
je 0x425a17
mov eax, dword [ebp - 8]
mov edx, 0x425ac4
call fcn.00405640
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x425a2b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425a50
lea eax, [ebp - 0x10]
call fcn.00405374
lea eax, [ebp - 4]
call fcn.00405374
ret
Function at 0x425ac8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x425c5e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x425c31
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.00429b84
cmp al, 9
jb 0x425ba7
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00405a94
xor edx, edx
push ebp
push 0x425ba0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00405804
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, eax
jne 0x425b88
mov eax, dword [ebp - 4]
call fcn.00405804
mov edx, dword [ebp - 8]
call fcn.0040a614
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x425b5a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x425b76
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040e310
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004053c8
call fcn.00404d10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x425c3b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425ba7
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405a94
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4a7f54]
mov eax, dword [eax]
mov ecx, 0x425c74
mov edx, 0x425c84
call fcn.0042cdec
test al, al
je 0x425c27
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00424c84
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004053c8
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x425bf3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x425c27
mov eax, dword [ebp - 8]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x425c0b
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x5c
je 0x425c27
mov eax, dword [ebp - 8]
mov edx, 0x425cd0
call fcn.00405640
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x425c3b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425c65
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405398
lea eax, [ebp - 4]
call fcn.00405374
ret
Function at 0x428154
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004057f4
xor eax, eax
push ebp
push 0x428220
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x428200
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x4adb81], 2
jne 0x4281e8
cmp dword [ebp - 4], 0
je 0x4281e8
lea eax, [ebp - 4]
mov edx, 0x428238
call fcn.00405640
cmp dword [0x4a0c84], 0
je 0x4281f6
lea eax, [ebp - 4]
call fcn.00405864
mov edx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4281bf
sub eax, 4
mov eax, dword [eax]
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push edx
mov eax, dword [0x4a0c84]
push eax
call sub.kernel32.dll_WriteFile_1
cmp dword [ebp - 8], 0
jne 0x4281f6
mov eax, dword [ebp - 4]
call fcn.00405804
push eax
call sub.kernel32.dll_OutputDebugStringA
jmp 0x4281f6
mov eax, dword [ebp - 4]
call fcn.00405804
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42820a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428227
lea eax, [ebp - 4]
call fcn.00405374
ret
Function at 0x42c9a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00405804
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x42c9f8
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4a81ec]
mov dl, 1
mov eax, dword [0x42c56c]
call fcn.0040d770
call fcn.00404c64
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042c674
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42d628
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.004057f4
xor eax, eax
push ebp
push 0x42d6f3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x42d6cb
push dword fs:[edx]
mov dword fs:[edx], esp
test bl, bl
je 0x42d67e
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0040946c
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.0040540c
mov ecx, 1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x42d68f
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x42d6be
mov esi, 1
imul eax, ecx, 0x5517e877
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + esi - 1]
xor ecx, dword [eax*4 + 0x4a0cb4]
inc esi
dec ebx
jne 0x42d69a
mov dword [ebp - 0x10], ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42d6d5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d6fa
lea eax, [ebp - 0x14]
call fcn.00405374
lea eax, [ebp - 0xc]
call fcn.00405374
ret
Function at 0x42d704
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004057f4
xor eax, eax
push ebp
push 0x42d804
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor edx, edx
push ebp
push 0x42d7dc
push dword fs:[edx]
mov dword fs:[edx], esp
test bl, bl
je 0x42d763
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0040946c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.0040540c
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x42d77d
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x42d7c6
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.0040659c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x4a10b8]
mov eax, dword [eax*8 + 0x4a10b4]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x42d788
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42d7e6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d80b
lea eax, [ebp - 0x1c]
call fcn.00405374
lea eax, [ebp - 4]
call fcn.00405374
ret

Function at 0x430280
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x43035a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.0040556c
mov edx, dword [ebp - 0x18]
mov eax, dword [0x4adbf8]
call fcn.0042f740
test al, al
je 0x4302c6
mov ebx, 1
jmp 0x430344
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4302f3
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor ebx, ebx
jmp 0x430344
lea eax, [ebp - 0xc]
push eax
movzx eax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x430327
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x430327
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle_1
movzx eax, word [ebp + 0xc]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430361
lea eax, [ebp - 0x18]
call fcn.00405374
ret
Function at 0x43036c
Capabilities:
Delete file
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x4303b4
lea eax, [esp + 0x105]
push eax
push 0
push 0x4303ec
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x4303b4
lea eax, [esp + 0x105]
call fcn.0040a474
cmp ebx, eax
jg 0x4303b8
xor eax, eax
jmp 0x4303ba
mov al, 1
mov ebx, eax
test bl, bl
je 0x4303d4
lea edx, [esp + 0x105]
mov eax, esi
call fcn.0040a4b4
push esi
call sub.kernel32.dll_DeleteFileA
movzx eax, bl
mov edx, dword [0x4a7e04]
mov eax, dword [edx + eax*4]
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x430d6c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x430d75
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x430eb2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
inc dword [ebx + 0x18]
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x18]
mov eax, esi
call fcn.00430bf8
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x22]
call fcn.0040a520
lea ecx, [ebp - 0xc]
mov edx, dword [ebx + 0x14]
mov eax, esi
call fcn.00430a64
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x122]
call fcn.0040a520
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x18]
mov eax, esi
call fcn.00430b40
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x222]
call fcn.0040a520
cmp word [esi + 0x42], 0
je 0x430e02
push edi
lea eax, [ebp - 1]
push eax
mov ecx, ebx
mov edx, esi
mov eax, dword [esi + 0x44]
call dword [esi + 0x40]
cmp byte [ebp - 1], 0
jne 0x430e73
lea eax, [ebp - 0x14]
lea edx, [ebx + 0x222]
mov ecx, pe_nt_image_headers32
call fcn.004055e4
mov eax, dword [ebp - 0x14]
call fcn.00409dc8
lea eax, [ebp - 0x24]
lea edx, [ebx + 0x222]
mov ecx, pe_nt_image_headers32
call fcn.004055e4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
lea edx, [ebx + 0x122]
mov ecx, pe_nt_image_headers32
call fcn.004055e4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x18]
mov edx, 1
call fcn.0042fc94
mov eax, dword [ebp - 0x18]
call fcn.00405804
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
mov dword [esi + 0x3a2], eax
xor eax, eax
mov dword [esi + 0x3a6], eax
movzx ebx, byte [ebp - 1]
xor bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430eb9
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405398
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00405398
ret