joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a8bbca0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.2a8ca120
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x18]
inc ebp
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [esi + 4]
mov ecx, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x30], 1
je 0x2a8bbd2a
mov edx, dword [esp + 0x24]
lea eax, [edx + ebp]
cmp eax, ecx
ja 0x2a8bbd2e
add dword [edi + 0x14], edx
sub ecx, edx
add dword [edi + 0x18], edx
sub dword [edi + 0xc], edx
mov dword [edi + 8], ecx
mov eax, dword [edi + 0x14]
push ebx
push dword [esi + 0x3c8]
mov al, byte [eax + ecx - 1]
movzx ebx, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebx
call fcn.2a893790
push eax
call fcn.2a8cccb0
mov esi, dword [edi + 8]
add esp, 8
mov dword [esp + 0x18], esi
and eax, 0x200000
je 0x2a8bbd37
sub esi, ebx
mov eax, 1
dec esi
pop ebx
mov dword [edi + 8], esi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
cmp ebp, ecx
jbe 0x2a8bbce2
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
lea ecx, [ebx + ebp]
mov eax, esi
mov ebx, esi
xor eax, ecx
sub ebx, ecx
xor ebx, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
cmovb eax, esi
xor ebp, ebp
mov dword [esp + 0x14], eax
test eax, eax
je 0x2a8bbdb4
mov eax, dword [esp + 0x20]
dec esi
mov edi, dword [edi + 0x14]
shr eax, 0x1f
add edi, esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x10]
lea edi, [edi - 1]
mov edx, esi
mov ecx, ebp
sub edx, ebp
shr ecx, 0x1f
shr edx, 0x1f
xor al, cl
xor dl, cl
inc ebp
movzx ecx, byte [esp + 0x2c]
or dl, al
movzx eax, byte [edi + 1]
dec dl
movzx edx, dl
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
cmp ebp, dword [esp + 0x14]
jb 0x2a8bbd75
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
not ebx
movzx ecx, bl
inc eax
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov eax, ecx
pop ebx
mov dword [edi + 8], esi
and eax, 1
pop edi
not ecx
pop esi
or eax, ecx
pop ebp
add esp, 0xc
ret

Function at 0x2a8c94f1
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x2a9867e9
call fcn.2a84a756
mov edi, ecx
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x10
mov dword [ebp - 0x54], esi
call fcn.2a886a0b
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x2a8c9536
push 0x10
push ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x2a8c9538
mov esi, ebx
or dword [ebp - 4], 0xffffffff
mov ecx, edi
mov dword [edi + 0x24], esi
call fcn.2a8c88a9
push dword [edi + 0x24]
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
call fcn.2a84a9ee
ret
Function at 0x2a8e8ad0
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.2a886a0b
push 0x62
push esi
mov edi, eax
mov ebx, 1
call sub.VCRUNTIME140.dll_strchr
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x2a8e8b75
push 0x48
push str.crypto_bio_bss_file.c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 1
push 2
call fcn.2a8cf650
push 0x2a9905c4
push esi
push 0x2a9b2914
push dword [esp + 0x30]
push str.fopen_
push 5
call fcn.2a8ced60
add esp, 0x2c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
cmp dword [eax], 2
je 0x2a8e8b52
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
cmp dword [eax], 6
je 0x2a8e8b52
lea eax, [edi + 2]
lea ecx, [edi + 0x51]
jmp 0x2a8e8b5c
mov eax, 0x80
mov ecx, 0x4f
push ecx
push str.crypto_bio_bss_file.c
push eax
push 0x6d
push 0x20
call fcn.2a8cf650
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x2a9b28bc
call fcn.2a8cd060
mov esi, eax
add esp, 4
test esi, esi
jne 0x2a8e8b97
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.2a8cca00
push edi
push ebx
push 0x6a
push esi
call fcn.2a8cca30
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x401e9f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x4012d4
xor ebx, ebx
push 1
push ebx
call esi
push 0x40116c
push ebx
push ebx
mov dword [ebp - 4], eax
call esi
cmp dword [ebp + 0x14], ebx
mov dword [ebp - 8], eax
je 0x401ef7
push dword [ebp + 0x14]
push ebx
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x401ef7
push 0x1388
push esi
call fcn.00403d19
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x18]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x10c]
push eax
call fcn.00403560
lea eax, [ebp - 0x10c]
push eax
call fcn.00403560
lea eax, [ebp - 0x10c]
push eax
call fcn.00402440
push dword [ebp + 0x1c]
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call fcn.00402608
cmp eax, ebx
mov dword [ebp + 0x14], eax
jl 0x401f5d
call fcn.00402ccb
lea eax, [ebp - 0x10c]
push eax
call fcn.00402e7a
call fcn.00402f66
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
jne 0x401f6f
push dword [ebp + 0xc]
call fcn.00402f8a
mov edi, eax
cmp dword [ebp + 0x14], ebx
jl 0x401fcc
push 6
lea eax, [ebp - 0x210]
pop esi
push eax
call fcn.00403f65
cmp byte [ebp - 0x210], bl
je 0x401fb1
lea eax, [ebp - 0x210]
push 0x4013f8
push eax
jmp 0x40d318
test byte [0x405114], 1
jne 0x401fcc
push 0x10040
push dword [ebp + 0xc]
push esi
push dword [ebp + 0x10]
push edi
call fcn.004038cc
mov esi, dword [ebp + 0x1c]
cmp dword [esi], 1
jne 0x401ff7
test byte [0x405114], 1
jne 0x401ff7
push 0x10044
push dword [ebp + 0xc]
push 7
push dword [ebp + 0x10]
push edi
call fcn.004038cc
cmp eax, 7
jne 0x401ff7
mov dword [esi], ebx
cmp edi, ebx
je 0x402013
push ebx
push ebx
call fcn.0040396e
test eax, eax
jne 0x402013
push ebx
push 0x40307a
push edi
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp dword [ebp - 8], ebx
pop edi
je 0x402022
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], ebx
pop esi
pop ebx
je 0x402032
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
leave
ret 0x18

Function at 0x402154
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
push 0x40116c
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, dword [ebp + 8]
cmp eax, edi
mov dword [esi], eax
je 0x4021ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4021ca
cmp dword [ebp + 0x10], edi
je 0x40219c
push edi
push edi
push dword [ebp + 0x14]
push 0x66
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov ebx, eax
jmp 0x40219e
xor ebx, ebx
push 0x57e40
push dword [esi]
call fcn.00403d19
test eax, eax
je 0x4021b8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x4021bf
mov dword [ebp - 4], 1
cmp ebx, edi
je 0x4021ca
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x403e57
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp byte [edi], 0x25
jne 0x403ed4
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push eax
call fcn.00403093
lea eax, [ebp + eax - 0x105]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x25
jne 0x403ebc
and byte [eax], 0
push dword [ebp + 0x1c]
lea eax, [ebp - 0x104]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push eax
push 0x4016ec
call esi
pop edi
pop esi
leave
ret 0x18

Function at 0x4041d7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0xc]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40422c
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
lea eax, [ebp + 8]
push esi
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x404223
cmp dword [ebp + 8], esi
jne 0x404223
cmp dword [ebp - 4], esi
jne 0x404223
push 1
pop esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 8

Function at 0x1001408
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x100144b
push esi
lea ecx, [eax + 8]
call dword [sym.imp.ulib.dll_public:_class_WSTRING____thiscall_PATH::QueryFullPathString_void_const]
mov esi, eax
cmp esi, ebx
je 0x100144a
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x1001442
cmp word [eax], bx
je 0x1001442
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001442
test ah, 0x10
je 0x1001442
mov bl, 1
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
pop esi
mov al, bl
pop ebx
ret 4
Function at 0x401047
Capabilities:
Set current directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.00403fe0
pop ecx
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea edi, [eax - 1]
neg edi
sbb edi, edi
neg edi
test esi, esi
je 0x401076
push dword [esp + 0xc]
call fcn.00401e62
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x40130c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov word [ebp - 0xb], 0x5c3a
mov byte [ebp - 9], 0
mov al, byte [eax]
mov byte [ebp - 0xc], al
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor ecx, ecx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0040876a
mov esp, ebp
pop ebp
ret 4

Function at 0x401974
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [0x426d54]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4019a1
push edi
mov edi, dword [esp + 0xc]
movzx ecx, byte [edi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x426360]
inc edi
sub esi, 1
jne 0x401988
pop edi
mov dword [0x426d54], edx
pop esi
ret
Function at 0x402e5f
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push 0x105
push esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x402e82
cmp byte [esi], 0
je 0x402e82
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x402ed0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xc]
push eax
call fcn.0040be40
pop ecx
cmp eax, 8
jae 0x402f93
push esi
xor esi, esi
lea eax, [ebp - 0x2c]
push esi
push esi
push esi
push esi
push esi
push 0x20
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x402f33
mov eax, 0xffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040876a
mov esp, ebp
pop ebp
ret 4
push 7
lea eax, [ebp - 0x2c]
push str.PKBACK
push eax
call fcn.0040357c
add esp, 0xc
test eax, eax
jne 0x402f1d
mov cl, byte [ebp - 0x2c]
lea eax, [ebp - 0x2c]
jmp 0x402f5f
cmp cl, 0x2e
je 0x402f63
cmp cl, 0x20
je 0x402f63
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x402f52
cmp byte [eax], 0
je 0x402f1d
mov cl, byte [eax]
cmp cl, 0x30
jb 0x402f74
cmp cl, 0x39
jbe 0x402f88
inc eax
jmp 0x402f68
movzx ecx, cl
sub ecx, 0x30
imul esi, esi, 0xa
cmp ecx, 9
ja 0x402f8e
add esi, ecx
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x402f77
mov ax, si
jmp 0x402f22
push 0x41d
push str.sfxhead.c
call fcn.00404280
int3

Function at 0x40377d
Capabilities:
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
push esi
push 8
add edx, edx
pop esi
sar edx, 1
mov eax, ecx
xor eax, edx
shr ecx, 1
test al, 1
je 0x40379b
xor ecx, 0xedb88320
dec esi
test esi, esi
jg 0x403789
mov eax, ecx
pop esi
ret 4
Function at 0x40403e
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp + 0x398], eax
push edi
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x404142
lea eax, [ebp - 0x80]
mov edi, 0x209
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], edi
push eax
push str.winzip_shellopencommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x404142
push ebx
push esi
lea esi, [ebp - 0x7c]
cmp word [ebp - 0x7c], ax
je 0x4040bc
xor ebx, ebx
push 4
push str.___1
push esi
call fcn.0040bbc3
add esp, 0xc
test eax, eax
je 0x4040bc
add esi, 2
cmp word [esi], bx
jne 0x4040a0
push 0x105
mov ebx, 0x4268c0
push ebx
call fcn.00405dcf
lea ecx, [ebp - 0x7c]
mov eax, esi
sub eax, ecx
add eax, 2
push ebx
sar eax, 1
sub edi, eax
lea eax, [esi + 2]
push str.__s_
push edi
push eax
call fcn.004043b3
mov eax, dword [0x423040]
add esp, 0x18
pop esi
pop ebx
test eax, 0x1000
je 0x404127
test eax, 0x8000
jne 0x404127
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x7a
pop ecx
push 0x69
lea eax, [ebp + eax*2 - 0x84]
mov word [eax], cx
pop ecx
mov word [eax + 2], cx
push 0x70
pop ecx
mov word [eax + 4], cx
push 0xffffffffffffffff
lea eax, [ebp - 0x7c]
push 0x41b358
push eax
call fcn.004043cf
add esp, 0xc
neg eax
sbb eax, eax
neg eax
jmp 0x404168
push 0
push 0x7d0
call fcn.004035f7
push eax
push 0x40e
call fcn.004035f7
push eax
push dword [0x426338]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov ecx, dword [ebp + 0x398]
xor ecx, ebp
pop edi
call fcn.0040876a
lea esp, [ebp + 0x39c]
pop ebp
ret
Function at 0x404280
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x11c]
sub esp, 0x19c
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp + 0x118], eax
mov eax, dword [0x423b48]
mov ecx, eax
mov edx, dword [ebp + 0x124]
inc eax
mov dword [0x423b48], eax
push esi
test ecx, ecx
je 0x4042bb
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x128]
push edx
push 0x7d4
call fcn.004035f7
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x30
push 0x7d0
call fcn.004035f7
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x426338]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push str.WZSFX32.RPT
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4042b3
push 0x41b3c0
lea eax, [ebp - 0x7c]
push 0x191
push eax
call fcn.0040bdd6
add esp, 0xc
lea eax, [ebp - 0x80]
push 0
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0040be40
pop ecx
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.004039fa
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WZSFX32.RPT
push 0x7d1
call fcn.004035f7
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x30
push 0x7d0
call fcn.004035f7
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x426338]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4042b3
Function at 0x4043cf
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xfe8
mov eax, dword [0x4231a4]
xor eax, esp
mov dword [esp + 0xfe4], eax
push ebx
mov ebx, dword [esp + 0xff0]
lea eax, [esp + 0xa20]
push ebp
mov ebp, dword [esp + 0xffc]
push esi
mov esi, dword [esp + 0xffc]
push edi
push ebx
push 0x2e3
push eax
call fcn.0040badc
xor edi, edi
add esp, 0xc
cmp word [esi], di
je 0x404446
push 0x41b2f8
lea eax, [esp + 0xa30]
push 0x2e3
push eax
call fcn.0040badc
push esi
lea eax, [esp + 0xa3c]
push 0x2e3
push eax
call fcn.0040ba67
add esp, 0x18
cmp ebp, 0xffffffff
jne 0x40449e
push 0x10
lea eax, [esp + 0x14]
push edi
push eax
call fcn.004035c9
push 0x44
pop edi
push edi
xor ecx, ecx
lea eax, [esp + 0x30]
push ecx
push eax
call fcn.004035c9
add esp, 0x18
mov dword [esp + 0x20], edi
lea eax, [esp + 0x10]
xor edi, edi
push eax
lea eax, [esp + 0x24]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0xa4c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40449e
mov eax, dword [esp + 0x10]
jmp 0x4045d6
lea eax, [esp + 0x464]
push eax
push edi
push ebx
call dword [sym.imp.SHELL32.dll_FindExecutableW]
mov edi, eax
cmp edi, 0x1f
jne 0x404515
mov ebp, 0x100
lea eax, [esp + 0x64]
push ebp
push eax
push 0xffffffffffffffff
push 0x427
call fcn.004035f7
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edi, edi
push eax
push edi
push edi
call esi
push ebx
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x46c]
push 0x2e3
push eax
call fcn.004043b3
add esp, 0x10
lea eax, [esp + 0x264]
push ebp
push eax
push 0xffffffffffffffff
push 0x7d0
call fcn.004035f7
push eax
push edi
push edi
call esi
push 0x10
jmp 0x4045b8
cmp edi, 0x20
jbe 0x40455b
xor eax, eax
xor ecx, ecx
cmp word [esi], cx
push 1
cmovne eax, esi
push ecx
push eax
mov eax, dword [0x423040]
and eax, 0x20000
neg eax
push ebx
sbb eax, eax
and eax, 0x41b2fc
push eax
push dword [0x426338]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
test ebp, ebp
je 0x404552
mov dword [ebp], edi
cmp edi, 0x20
jbe 0x40455b
mov eax, edi
jmp 0x4045d6
mov ebp, 0x100
lea eax, [esp + 0x64]
push ebp
push eax
push 0xffffffffffffffff
push 0x400
call fcn.004035f7
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
xor eax, eax
push eax
push eax
call esi
push ebx
push edi
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x470]
push 0x2e3
push eax
call fcn.004043b3
add esp, 0x14
lea eax, [esp + 0x264]
push ebp
push eax
push 0xffffffffffffffff
push 0x7d0
call fcn.004035f7
push eax
xor ebx, ebx
push ebx
push ebx
call esi
push ebx
lea eax, [esp + 0x268]
push eax
lea eax, [esp + 0x46c]
push eax
push dword [0x426338]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0xff4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040876a
add esp, 0xfe8
ret
Function at 0x4047b0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
sub esp, 0x220
lea ebp, [esp - 4]
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp + 0x220], eax
push 0x140
mov eax, 0x41a7d3
call fcn.00408827
mov esi, dword [ebp + 0x22c]
lea eax, [ebp + 0x18]
push 0x104
push 0
push eax
call fcn.004035c9
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x4047fa
mov eax, dword [esi]
jmp 0x4047fc
mov eax, esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push 0x41b3c4
push eax
lea eax, [ebp + 0x18]
push eax
call ebx
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40490e
push 0x104
lea eax, [ebp + 0x11c]
push 0
push eax
call fcn.004035c9
add esp, 0xc
test byte [ebp - 0x14c], 0x10
je 0x4048c7
lea eax, [ebp - 0x120]
push 0x41b388
push eax
call fcn.0040e790
pop ecx
pop ecx
test eax, eax
je 0x4048f1
lea eax, [ebp - 0x120]
push 0x41b3c8
push eax
call fcn.0040e790
pop ecx
pop ecx
test eax, eax
je 0x4048f1
cmp dword [esi + 0x14], 0x10
jb 0x404885
mov eax, dword [esi]
jmp 0x404887
mov eax, esi
lea ecx, [ebp - 0x120]
push ecx
push eax
lea eax, [ebp + 0x11c]
push eax
call ebx
lea eax, [ebp + 0x11c]
push eax
lea ecx, [ebp]
call fcn.00404701
and dword [ebp - 4], 0
lea eax, [ebp]
push eax
call fcn.004047b0
or dword [ebp - 4], 0xffffffff
pop ecx
push 0
push 1
lea ecx, [ebp]
call fcn.00405313
jmp 0x4048f1
cmp dword [esi + 0x14], 0x10
jb 0x4048d1
mov eax, dword [esi]
jmp 0x4048d3
mov eax, esi
lea ecx, [ebp - 0x120]
push ecx
push eax
lea eax, [ebp + 0x11c]
push eax
call ebx
lea eax, [ebp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x14c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40482a
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esi + 0x14], 0x10
jb 0x404916
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x220]
xor ecx, ebp
call fcn.0040876a
lea esp, [ebp + 0x224]
pop ebp
ret
Function at 0x404946
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0xa8]
sub esp, 0x128
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp + 0xa4], eax
push esi
mov esi, dword [ebp + 0xb0]
cmp dword [esi + 0x14], 0x10
jb 0x404972
mov eax, dword [esi]
jmp 0x404974
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x404a09
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
push edi
lea eax, [ebp + 0x84]
push 0x41b3cc
push eax
call fcn.004046c7
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x4049ab
mov eax, dword [esi]
jmp 0x4049ad
mov eax, esi
lea ecx, [ebp + 0x84]
push ecx
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4049da
inc edi
jmp 0x40498c
xor edi, edi
lea eax, [ebp - 0x80]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp byte [ebp - 0x80], 0
je 0x4049f9
lea eax, [ebp - 0x80]
push eax
call fcn.0040be40
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x80]
mov ecx, esi
push eax
call fcn.004055ef
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp + 0xa4]
xor ecx, ebp
pop esi
call fcn.0040876a
lea esp, [ebp + 0xa8]
pop ebp
ret

Function at 0x404a1f
Capabilities:
Accept command line arguments

Disassembly:
push 0x20
mov eax, 0x41a806
call fcn.0040885b
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp - 0x2c]
mov ebx, 0x41b3d0
push ecx
push ebx
push eax
jmp 0x404a72
push eax
lea ecx, [ebp - 0x28]
call fcn.00404701
lea eax, [ebp - 0x28]
mov dword [ebp - 4], edi
push eax
mov ecx, esi
call fcn.0040599e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push edi
push 1
call fcn.00405313
lea eax, [ebp - 0x2c]
push eax
push ebx
push edi
call fcn.0040e743
add esp, 0xc
test eax, eax
jne 0x404a46
call fcn.00408816
ret

Function at 0x404ba3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 0x103
jb 0x404bd7
xor eax, eax
jmp 0x404c50
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x208
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
test eax, eax
je 0x404c24
cmp byte [ebp - 0x310], 0
jne 0x404c0e
xor eax, eax
jmp 0x404c1b
lea eax, [ebp - 0x310]
push eax
call fcn.0040be40
pop ecx
push eax
lea eax, [ebp - 0x310]
jmp 0x404c45
cmp byte [ebp - 0x108], 0
jne 0x404c31
xor eax, eax
jmp 0x404c3e
lea eax, [ebp - 0x108]
push eax
call fcn.0040be40
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.004055ef
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040876a
mov esp, ebp
pop ebp
ret