joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434d32
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor eax, eax
xor esi, esi
xor edi, edi
cmp dword [ebp + 0x10], esi
sete al
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x434e0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x10], esi
jne 0x434d7b
cmp eax, 0x50
je 0x434d73
cmp eax, 0xb7
jne 0x434d7b
xor edi, edi
inc edi
jmp 0x434e0d
cmp eax, 3
jne 0x434dfd
movzx eax, word [ebx]
mov ecx, ebx
test ax, ax
je 0x434df6
cmp ax, 0x5c
jne 0x434d92
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x434d8a
test esi, esi
je 0x434df6
xor eax, eax
push eax
push ebx
mov word [esi], ax
call fcn.0043575a
mov edi, eax
push 0x5c
pop eax
mov word [esi], ax
test edi, edi
js 0x434e0d
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x434e0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x434dde
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jns 0x434e0d
push edi
push 0x3b1
push 0x44ca86
call fcn.004314ce
jmp 0x434e0d
mov edi, 0x80070003
jmp 0x434e0d
cmp eax, esi
jle 0x434e0b
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x434e6a
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 4], esi
cmp dword [ebp + 0x10], esi
je 0x434e86
mov dword [ebp - 4], 1
cmp dword [ebp + 0x14], esi
je 0x434e8f
or dword [ebp - 4], 2
push dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x434f58
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x10], esi
jne 0x434ec6
cmp eax, 0x50
je 0x434ebe
cmp eax, 0xb7
jne 0x434ec6
xor edi, edi
inc edi
jmp 0x434f58
cmp eax, 3
jne 0x434f48
movzx eax, word [ebx]
mov ecx, ebx
test ax, ax
je 0x434f41
cmp ax, 0x5c
jne 0x434edd
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x434ed5
test esi, esi
je 0x434f41
xor eax, eax
push eax
push ebx
mov word [esi], ax
call fcn.0043575a
mov edi, eax
push 0x5c
pop eax
mov word [esi], ax
test edi, edi
js 0x434f58
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x434f58
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x434f29
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jns 0x434f58
push edi
push 0x424
push 0x44ca86
call fcn.004314ce
jmp 0x434f58
mov edi, 0x80070003
jmp 0x434f58
cmp eax, esi
jle 0x434f56
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x434fbe
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
xor ebx, ebx
call fcn.00434b16
test eax, eax
je 0x43504e
test byte [ebp - 4], 7
push esi
push edi
mov edi, 0xffff
mov esi, 0x80070000
je 0x43501b
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x43501b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x43500d
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jns 0x43501b
push ebx
push 0x519
jmp 0x435042
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43504c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x435036
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jns 0x43504c
push ebx
push 0x51f
push 0x44ca86
call fcn.004314ce
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x43507e
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
mov ebx, 0xffff
mov edi, 0x80070000
test eax, eax
jne 0x4350da
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4350bf
and eax, ebx
or eax, edi
mov esi, eax
test esi, esi
jns 0x4350da
push esi
push 0x118
push 0x44ca86
call fcn.004314ce
jmp 0x435183
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4350f9
mov esi, 0x8007000e
push esi
push 0x11c
jmp 0x4350cb
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x435128
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x43511a
and eax, ebx
or eax, edi
mov esi, eax
test esi, esi
jns 0x435128
push esi
push 0x120
jmp 0x43515b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x44c59c
push dword [ebp - 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x435167
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x43514f
and eax, ebx
or eax, edi
mov esi, eax
test esi, esi
jns 0x435167
push esi
push 0x125
push 0x44ca86
call fcn.004314ce
jmp 0x43517a
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x43572e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push dword [esp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x435753
test al, 0x10
je 0x435753
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x435750
mov dword [ecx], eax
xor esi, esi
inc esi
mov eax, esi
pop esi
ret 8

Function at 0x43575a
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push ebp
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x435821
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x435821
cmp eax, 3
je 0x43579e
push esi
push ebx
call fcn.0043572e
test eax, eax
jne 0x435821
movzx eax, word [ebx]
push edi
xor edi, edi
mov ecx, ebx
test ax, ax
je 0x4357c2
cmp ax, 0x5c
jne 0x4357b3
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x4357ab
test edi, edi
jne 0x4357d6
mov esi, 0x80070003
push esi
push 0x7a
push 0x44caba
call fcn.004314ce
jmp 0x435820
push ebp
xor eax, eax
push ebx
mov word [edi], ax
call fcn.0043575a
mov esi, eax
push 0x5c
pop eax
mov word [edi], ax
test esi, esi
js 0x435820
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43581e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43580c
xor esi, esi
inc esi
jmp 0x435820
test eax, eax
jle 0x43581a
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x435820
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x4368a6
Capabilities:
Get http content length

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0x20000005
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x4368fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4368e5
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jns 0x4368fa
push esi
push 0x20
push 0x44cc5e
call fcn.004314ce
jmp 0x436906
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
and dword [eax + 4], 0
mov dword [eax], ecx
mov eax, esi
pop esi
leave
ret 8
Function at 0x436b5c
Capabilities:
Parse url

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x23f0]
mov eax, 0x2470
call fcn.0040b8c0
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp + 0x23ec], eax
mov eax, dword [ebp + 0x23f8]
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x2404]
push ebx
mov ebx, dword [ebp + 0x23fc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x2408]
push esi
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x240c]
push edi
mov edi, dword [ebp + 0x2400]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x2410]
push 0x3c
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x2414]
pop esi
push esi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00408720
mov dword [ebp - 0x80], esi
xor esi, esi
add esp, 0xc
cmp edi, esi
je 0x436bf1
lea eax, [ebp + 0x1fe0]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], 0x101
mov eax, 0x81
cmp dword [ebp - 0x38], esi
je 0x436c07
lea ecx, [ebp + 0x22e8]
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x34], esi
je 0x436c18
lea ecx, [ebp + 0x21e4]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], eax
mov eax, 0x801
cmp dword [ebp - 0x3c], esi
je 0x436c2e
lea ecx, [ebp + 0xfdc]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x30], esi
je 0x436c3c
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x80]
push eax
push 0x90000000
push esi
push dword [ebp - 0x44]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x436c89
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x436c67
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x2c], eax
cmp eax, esi
jl 0x436c75
mov dword [ebp - 0x2c], 0x80004005
push dword [ebp - 0x2c]
push 0x5e
push 0x44cc92
call fcn.004314ce
jmp 0x436d1b
cmp ebx, esi
je 0x436c92
mov eax, dword [ebp - 0x74]
mov dword [ebx], eax
cmp edi, esi
je 0x436ca9
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push edi
call fcn.0042fa38
mov dword [ebp - 0x2c], eax
cmp eax, esi
jl 0x436d1b
mov eax, dword [ebp - 0x40]
cmp eax, esi
je 0x436cb7
mov cx, word [ebp - 0x68]
mov word [eax], cx
cmp dword [ebp - 0x38], esi
je 0x436cd1
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push dword [ebp - 0x38]
call fcn.0042fa38
mov dword [ebp - 0x2c], eax
cmp eax, esi
jl 0x436d1b
cmp dword [ebp - 0x34], esi
je 0x436ceb
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x34]
call fcn.0042fa38
mov dword [ebp - 0x2c], eax
cmp eax, esi
jl 0x436d1b
cmp dword [ebp - 0x3c], esi
je 0x436d05
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push dword [ebp - 0x3c]
call fcn.0042fa38
mov dword [ebp - 0x2c], eax
cmp eax, esi
jl 0x436d1b
cmp dword [ebp - 0x30], esi
je 0x436d1b
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x30]
call fcn.0042fa38
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 0x23ec]
mov eax, dword [ebp - 0x2c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408498
add ebp, 0x23f0
leave
ret 0x20
Function at 0x401000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x41b038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], 0
xor eax, eax
mov word [ebp - 0x414], ax
push 0x206
push 0
lea ecx, [ebp - 0x412]
push ecx
call fcn.0040a840
add esp, 0xc
xor edx, edx
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.0040a840
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov edx, 2
shl edx, 1
mov dword [ebp - 0x41c], edx
cmp dword [ebp - 0x41c], 0x208
jae 0x401088
jmp 0x40108d
call fcn.00406cb9
xor eax, eax
mov ecx, dword [ebp - 0x41c]
mov word [ebp + ecx - 0x414], ax
push 0x419628
lea edx, [ebp - 0x414]
push edx
push 0x41966c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4010df
mov edx, dword [ebp - 0x418]
or edx, 1
mov dword [ebp - 0x418], edx
push 0x419678
lea eax, [ebp - 0x414]
push eax
push 0x4196c0
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401121
mov eax, dword [ebp - 0x418]
or eax, 2
mov dword [ebp - 0x418], eax
push 0x4196d8
lea ecx, [ebp - 0x414]
push ecx
push 0x4196cc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401163
mov ecx, dword [ebp - 0x418]
or ecx, 4
mov dword [ebp - 0x418], ecx
push 0x419730
lea edx, [ebp - 0x414]
push edx
push 0x419724
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4011a8
mov edx, dword [ebp - 0x418]
or edx, 0x100
mov dword [ebp - 0x418], edx
push 0x419790
lea eax, [ebp - 0x414]
push eax
push 0x419784
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4011ec
mov eax, dword [ebp - 0x418]
or eax, 0x200
mov dword [ebp - 0x418], eax
push 0x4197f0
lea ecx, [ebp - 0x414]
push ecx
push 0x4197e4
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401231
mov ecx, dword [ebp - 0x418]
or ecx, 0x400
mov dword [ebp - 0x418], ecx
mov edx, dword [ebp - 0x418]
or edx, 0x2000000
mov dword [ebp - 0x418], edx
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406b74
mov esp, ebp
pop ebp
ret
Function at 0x401720
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x41b038]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x44], ax
push 0x3e
push 0
lea ecx, [ebp - 0x42]
push ecx
call fcn.0040a840
add esp, 0xc
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1dc], 0
lea edx, [ebp - 0x44]
push edx
call fcn.00404bd0
add esp, 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0x1e4], 0x41cf88
mov ecx, dword [ebp - 0x1e4]
mov dword [ebp - 0x204], ecx
mov edx, dword [ebp - 0x1f0]
mov ax, word [edx]
mov word [ebp - 0x1de], ax
mov ecx, dword [ebp - 0x1e4]
mov dx, word [ebp - 0x1de]
mov word [ecx], dx
mov eax, dword [ebp - 0x1f0]
add eax, 2
mov dword [ebp - 0x1f0], eax
mov ecx, dword [ebp - 0x1e4]
add ecx, 2
mov dword [ebp - 0x1e4], ecx
cmp word [ebp - 0x1de], 0
jne 0x401788
push 0x41cf88
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
je 0x401805
mov edx, dword [ebp - 0x1dc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4019c3
push 0x41cf88
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
jne 0x40182c
xor eax, eax
jmp 0x4019c3
lea eax, [ebp - 0x1d4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x41db20
call fcn.00402550
add esp, 4
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jne 0x401985
mov dword [ebp - 0x1f4], 0x4198a4
mov dword [ebp - 0x1e8], 0x41dcc8
mov ecx, dword [ebp - 0x1e8]
mov dword [ebp - 0x200], ecx
mov edx, dword [ebp - 0x1f4]
mov ax, word [edx]
mov word [ebp - 0x1d8], ax
mov ecx, dword [ebp - 0x1e8]
mov dx, word [ebp - 0x1d8]
mov word [ecx], dx
mov eax, dword [ebp - 0x1f4]
add eax, 2
mov dword [ebp - 0x1f4], eax
mov ecx, dword [ebp - 0x1e8]
add ecx, 2
mov dword [ebp - 0x1e8], ecx
cmp word [ebp - 0x1d8], 0
jne 0x40187e
push 0x4198b0
push 0x41db24
call fcn.004024e0
add esp, 8
push 0x4198cc
push 0x41dba6
call fcn.00402500
add esp, 8
push 0x4198d8
push 0x41dbc6
call fcn.004024e0
add esp, 8
mov edx, 0x51
mov word [0x41dba4], dx
mov eax, 0x2b8e
mov word [0x41dc46], ax
mov dword [ebp - 0x1f8], 0x4198f4
mov dword [ebp - 0x1ec], 0x41dca8
mov ecx, dword [ebp - 0x1ec]
mov dword [ebp - 0x208], ecx
mov edx, dword [ebp - 0x1f8]
mov ax, word [edx]
mov word [ebp - 0x1d6], ax
mov ecx, dword [ebp - 0x1ec]
mov dx, word [ebp - 0x1d6]
mov word [ecx], dx
mov eax, dword [ebp - 0x1f8]
add eax, 2
mov dword [ebp - 0x1f8], eax
mov ecx, dword [ebp - 0x1ec]
add ecx, 2
mov dword [ebp - 0x1ec], ecx
cmp word [ebp - 0x1d6], 0
jne 0x401933
mov dword [0x41dce8], 5
call fcn.00404d10
push 0x419904
call fcn.00404e30
add esp, 4
mov dword [0x41de20], eax
push 0x41d920
call fcn.004013a0
add esp, 4
push 0
push 0
push 0
push 0x4015d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406b74
mov esp, ebp
pop ebp
ret
Function at 0x4019e0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x41b038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], 0
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00405630
add esp, 8
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x401a28
mov eax, dword [ebp - 0x418]
jmp 0x401baa
xor edx, edx
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.0040a840
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x414], cx
push 0x206
push 0
lea edx, [ebp - 0x412]
push edx
call fcn.0040a840
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x420], 0
jmp 0x401a93
mov ecx, dword [ebp - 0x420]
add ecx, 1
mov dword [ebp - 0x420], ecx
cmp dword [ebp - 0x420], 5
jge 0x401b02
mov edx, dword [ebp - 0x420]
imul edx, edx, 0x118
mov eax, 2
imul eax, eax, 0
movzx ecx, word [edx + eax + 0x41d3a8]
test ecx, ecx
jne 0x401abe
jmp 0x401a84
lea edx, [ebp - 0x20c]
push edx
push 0x104
lea eax, [ebp - 0x414]
push eax
call fcn.00406d93
add esp, 0xc
mov ecx, dword [ebp - 0x420]
imul ecx, ecx, 0x118
add ecx, 0x41d3a8
push ecx
push 0x104
lea edx, [ebp - 0x414]
push edx
call fcn.00406def
add esp, 0xc
jmp 0x401a84
mov dword [ebp - 0x41c], 0
jmp 0x401b1d
mov eax, dword [ebp - 0x41c]
add eax, 1
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 5
jge 0x401b6f
mov ecx, dword [ebp - 0x41c]
imul ecx, ecx, 0x118
mov edx, 2
imul edx, edx, 0
movzx eax, word [ecx + edx + 0x41d3a8]
test eax, eax
jne 0x401b48
jmp 0x401b0e
push 1
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x41c]
imul eax, eax, 0x118
add eax, 0x41d3a8
push eax
call fcn.004065e0
add esp, 0x10
jmp 0x401b0e
push 0x41d1a0
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00406def
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401ba4
mov dword [ebp - 0x418], 2
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406b74
mov esp, ebp
pop ebp
ret
Function at 0x402020
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x41b038]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x64
push 0x41ceb8
push 0x67
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x41cdf0
push 0x6d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edx, dword [ebp + 8]
push edx
call fcn.00402260
add esp, 4
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00402300
add esp, 8
test eax, eax
jne 0x402080
xor eax, eax
jmp 0x402247
push 0x6d
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [ebp - 0x238], eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x41bf08
call fcn.00403b00
add esp, 4
call fcn.00402b10
test eax, eax
je 0x4020c0
call fcn.00404730
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401720
test eax, eax
jne 0x4020d0
xor eax, eax
jmp 0x402247
call fcn.00401c10
cmp dword [0x41de20], 0
jbe 0x40210b
movzx eax, word [0x41de24]
test eax, eax
jle 0x40210b
push 0x41bef8
mov ecx, dword [0x41de20]
push ecx
call fcn.00405480
add esp, 8
mov dx, word [0x41de24]
mov word [0x41bef4], dx
mov dword [ebp - 0x234], 0x419a74
mov dword [ebp - 0x230], 0x41d1a0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x234]
mov dx, word [ecx]
mov word [ebp - 0x22a], dx
mov eax, dword [ebp - 0x230]
mov cx, word [ebp - 0x22a]
mov word [eax], cx
mov edx, dword [ebp - 0x234]
add edx, 2
mov dword [ebp - 0x234], edx
mov eax, dword [ebp - 0x230]
add eax, 2
mov dword [ebp - 0x230], eax
cmp word [ebp - 0x22a], 0
jne 0x40212b
call fcn.00405530
xor ecx, ecx
mov word [ebp - 0x20c], cx
push 0x206
push 0
lea edx, [ebp - 0x20a]
push edx
call fcn.0040a840
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41d1a0
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00406def
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0x419a8c
lea edx, [ebp - 0x20c]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406b74
mov esp, ebp
pop ebp
ret 0x10