joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4047ce
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
mov esi, eax
mov eax, dword [esi]
push edi
sub eax, 0x10
call fcn.00402f91
mov ebx, eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
add ebx, 0x10
sub eax, 0x10
mov dword [ebp - 4], ebx
call fcn.00402f91
mov edi, eax
mov eax, dword [esi]
add edi, 0x10
xor esi, esi
cmp dword [eax - 0xc], esi
mov dword [ebp + 0x10], edi
jne 0x404930
push 0x3c
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.0041eb30
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x48]
push ecx
push esi
push esi
push eax
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 0x48], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x404858
mov esi, dword [ebp + 8]
call fcn.004035ec
lea eax, [edi - 0x10]
call fcn.00402f79
lea eax, [ebx - 0x10]
jmp 0x40495c
push dword [ebp - 0x1c]
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00402a47
cmp dword [ebp - 0x3c], 5
mov byte [ebp - 0xc], 0x2f
jne 0x404875
mov byte [ebp - 0xc], 0x5c
push dword [ebp - 0xc]
lea esi, [ebp - 8]
call fcn.00402a87
mov ebx, eax
test ebx, ebx
jl 0x4048ae
mov eax, dword [ebp - 8]
mov eax, dword [eax - 0xc]
sub eax, ebx
lea ecx, [ebp - 0xc]
dec eax
push ecx
call fcn.00402aa1
lea edi, [ebp - 4]
call fcn.00402d6c
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00402f79
mov edi, dword [ebp + 0x10]
cmp dword [ebp - 0x3c], 3
jne 0x4048b8
push 0x3f
jmp 0x4048c0
cmp dword [ebp - 0x3c], 1
jne 0x4048cc
push 0x3b
lea esi, [ebp - 4]
xor ecx, ecx
call fcn.00402a62
mov ebx, eax
test ebx, ebx
jl 0x4048f3
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
lea esi, [ebp - 4]
call fcn.00402af0
mov edi, esi
call fcn.00402d6c
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00402f79
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
call fcn.004049b8
lea esi, [ebp - 0xc]
mov dword [esp], str..aiu
call fcn.004067cc
mov eax, esi
push eax
lea eax, [ebp - 4]
call fcn.00405d74
mov eax, dword [ebp - 0xc]
pop ecx
add eax, 0xfffffff0
call fcn.00402f79
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00402f79
mov ebx, dword [ebp - 4]
push 0x3a
xor ecx, ecx
lea esi, [ebp - 4]
call fcn.00402a62
test eax, eax
jle 0x404965
add ebx, 0xfffffff0
mov eax, ebx
call fcn.00402f91
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
lea eax, [edi - 0x10]
call fcn.00402f79
mov eax, ebx
call fcn.00402f79
mov eax, esi
jmp 0x4049b3
cmp dword [edi - 0xc], 0
je 0x404982
lea eax, [ebp + 0x10]
call fcn.00405e30
push dword [ebx - 0xc]
lea eax, [ebp + 0x10]
push ebx
push eax
call fcn.00402f2b
jmp 0x40498d
lea eax, [ebp - 4]
lea edi, [ebp + 0x10]
call fcn.00402d6c
mov esi, dword [ebp + 0x10]
add esi, 0xfffffff0
mov eax, esi
call fcn.00402f91
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
mov eax, esi
call fcn.00402f79
lea eax, [ebx - 0x10]
call fcn.00402f79
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404fea
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x424050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x70]
call fcn.00414516
mov edx, dword [edx]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x88], eax
jne 0x405036
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4050f5
push esi
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
sub edi, dword [ebp + 8]
mov esi, 0xc000
push esi
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
call fcn.00402bb9
push ebx
lea eax, [ebp - 0x80]
push eax
push esi
push dword [ebp - 0x78]
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4050c3
mov ebx, dword [ebp - 0x80]
test ebx, ebx
je 0x4050c1
mov eax, dword [ebp - 0x7c]
lea ecx, [ebx + eax]
cmp ecx, edi
mov byte [ebp - 0x71], 0
jbe 0x405093
mov ebx, edi
sub ebx, eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x71], 1
push dword [ebp - 0x78]
lea eax, [ebp - 0x70]
call fcn.004143a3
cmp byte [ebp - 0x71], 0
jne 0x4050c1
add dword [ebp - 0x7c], ebx
push 0
lea eax, [ebp - 0x80]
push eax
push esi
push dword [ebp - 0x78]
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405073
xor ebx, ebx
lea esi, [ebp - 0x70]
call fcn.0041443d
mov eax, esi
call fcn.004144bf
push dword [ebp - 0x78]
mov esi, eax
call fcn.0041e6cf
cmp dword [ebp - 0x88], ebx
pop ecx
je 0x4050f1
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0041e95f
leave
ret
Function at 0x4053f2
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x424050]
push ebx
push esi
push edi
xor eax, ebp
mov edi, ecx
push str.SystemFolder
lea esi, [ebp - 0x78]
mov dword [ebp + 0x94], eax
mov dword [ebp - 0x7c], edi
mov byte [ebp - 0x71], 1
call fcn.004032f7
mov eax, dword [eax]
mov ecx, dword [edi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push eax
push ecx
call edi
mov ebx, eax
mov eax, dword [ebp - 0x78]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.00402f79
test bl, bl
je 0x405475
push 0x104
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp + eax - 0x70], 0x5c
mov byte [ebp + eax - 0x6f], 0
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x7c]
call fcn.004035d2
jmp 0x4055ce
push str.WindowsFolder
lea esi, [ebp - 0x78]
call fcn.004032f7
mov eax, dword [eax]
mov esi, dword [ebp - 0x7c]
mov ecx, dword [esi]
push eax
push ecx
call edi
mov ebx, eax
mov eax, dword [ebp - 0x78]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.00402f79
test bl, bl
je 0x4054c4
push 0x104
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [ebp + eax - 0x70], 0x5c
mov byte [ebp + eax - 0x6f], 0
lea eax, [ebp - 0x70]
push eax
push esi
jmp 0x40546b
push str.WindowsVolume
lea esi, [ebp - 0x78]
call fcn.004032f7
mov eax, dword [eax]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx]
push eax
push ecx
call edi
mov ebx, eax
mov eax, dword [ebp - 0x78]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.00402f79
test bl, bl
je 0x40550b
push 0x104
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [ebp - 0x6d], 0
jmp 0x405464
mov ebx, dword [ebp - 0x7c]
mov eax, dword [ebx]
push str.TempFolder
push eax
call edi
test eax, eax
jne 0x40553a
lea eax, [ebp - 0x70]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov byte [ebp + eax - 0x70], 0
lea eax, [ebp - 0x70]
push eax
push ebx
jmp 0x40546b
xor esi, esi
mov eax, dword [esi*4 + 0x424200]
mov ecx, dword [ebx]
push eax
push ecx
call edi
test eax, eax
je 0x405553
inc esi
cmp esi, 0xb
jb 0x40553c
cmp esi, 0xb
jae 0x4055ca
lea eax, [ebp - 0x78]
push eax
lea esi, [esi*4 + 0x4208ec]
push dword [esi]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x40558a
push dword [esi]
call fcn.004055e9
test al, al
pop ecx
jne 0x4055ce
mov edi, dword [ebp - 0x7c]
call fcn.004056ac
mov byte [ebp - 0x71], al
jmp 0x4055ce
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
and dword [ebp - 0x80], 0
mov esi, eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 0x80]
push dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test esi, esi
je 0x4055ca
lea eax, [ebp - 0x70]
push eax
push ebx
call fcn.004035d2
mov eax, ebx
call fcn.00405e30
jmp 0x4055ce
mov byte [ebp - 0x71], 0
mov ecx, dword [ebp + 0x94]
mov al, byte [ebp - 0x71]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e95f
add ebp, 0x98
leave
ret
Function at 0x4056ac
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x424050]
xor eax, ebp
push ebx
push esi
mov dword [ebp + 0x88], eax
call fcn.00403e7f
test al, al
jne 0x405760
mov eax, dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push str.ProgramFilesFolder
push eax
call esi
test eax, eax
mov ebx, str.AppDataFolder
je 0x405707
mov eax, dword [edi]
push str.ProgramFiles
push eax
call esi
test eax, eax
je 0x405707
mov eax, dword [edi]
push ebx
push eax
call esi
test eax, eax
jne 0x405760
mov eax, dword [edi]
push ebx
push eax
call esi
neg eax
sbb al, al
inc al
push 0
pop ebx
mov byte [ebp - 0x7d], al
mov byte [ebp - 0x7c], bl
mov eax, str.APPDATA
jne 0x405728
mov eax, str.PROGRAMFILES
push 0x104
lea ecx, [ebp - 0x7c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
jbe 0x405744
mov byte [ebp + esi - 0x7c], 0x5c
inc esi
mov byte [ebp + esi - 0x7c], bl
cmp byte [ebp - 0x7c], bl
je 0x405757
lea eax, [ebp - 0x7c]
push eax
push edi
call fcn.004035d2
xor eax, eax
cmp esi, ebx
setne al
jmp 0x405762
xor al, al
mov ecx, dword [ebp + 0x88]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e95f
add ebp, 0x8c
leave
ret

Function at 0x405779
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x424050]
and dword [ebp - 0x80], 0
and dword [ebp - 0x7c], 0
and dword [ebp - 0x78], 0
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x68]
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [ebp - 0x6c], eax
xor edi, edi
lea esi, [ebp + edi - 0x68]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x4057ea
push esi
lea esi, [ebp - 0x74]
call fcn.004032f7
mov eax, esi
push eax
lea esi, [ebp - 0x80]
call fcn.004069f1
mov eax, dword [ebp - 0x74]
add eax, 0xfffffff0
call fcn.00402f79
jmp 0x4057ea
cmp byte [ebp + edi - 0x68], 0
je 0x4057ef
inc edi
cmp edi, dword [ebp - 0x6c]
jb 0x4057e2
inc edi
cmp edi, dword [ebp - 0x6c]
jb 0x4057b1
mov eax, dword [ebp - 0x70]
lea edi, [ebp - 0x80]
call fcn.004069ab
lea edi, [ebp - 0x80]
call fcn.00402dac
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x70]
pop edi
xor ecx, ebp
pop esi
call fcn.0041e95f
leave
ret
Function at 0x405819
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push 0x3c
xor ebx, ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.0041eb30
add esp, 0xc
push 0x64
pop eax
lea ecx, [ebp - 0x3c]
push ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push ebx
push eax
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x40586b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40593a
push edi
push dword [ebp - 0x2c]
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 0x28]
call fcn.00402a47
mov edi, dword [ebp + 0x14]
call fcn.00402d6c
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00402f79
push dword [ebp - 0x10]
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00402a47
mov edi, dword [ebp + 0x18]
call fcn.00402d6c
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00402f79
cmp dword [ebp - 0x20], ebx
je 0x4058d7
push dword [ebp - 0x20]
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00402a47
mov edi, dword [ebp + 0x1c]
call fcn.00402d6c
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00402f79
cmp dword [ebp - 0x18], ebx
je 0x4058fe
push dword [ebp - 0x18]
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00402a47
mov edi, dword [ebp + 0x20]
call fcn.00402d6c
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00402f79
cmp dword [ebp - 8], ebx
je 0x405925
push dword [ebp - 8]
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00402a47
mov edi, dword [ebp + 0x24]
call fcn.00402d6c
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00402f79
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov ax, word [ebp - 0x24]
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
xor eax, eax
pop edi
pop ebx
leave
ret

Function at 0x40593d
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x4243c4]
push esi
push edi
mov ecx, 0x4243c4
call dword [eax + 0xc]
mov edi, dword [ebp + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
lea esi, [eax - 1]
call fcn.00403d96
cmp al, 0x5c
jne 0x405991
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
lea ecx, [ebp + 0xc]
dec eax
push ecx
mov esi, edi
call fcn.00402af0
lea edi, [ebp - 4]
call fcn.00402d6c
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.00402f79
jmp 0x40599b
mov eax, edi
lea edi, [ebp - 4]
call fcn.00402d6c
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [esi]
mov edx, dword [eax - 0xc]
cmp edx, dword [ecx - 0xc]
jge 0x4059e9
push 0x5c
call fcn.00402a87
lea ecx, [ebp - 8]
push ecx
call fcn.00402af0
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], 0
je 0x4059db
push dword [esi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040593d
pop ecx
pop ecx
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00402f79
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00402f79
pop edi
pop esi
leave
ret
Function at 0x405a6b
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x154
mov eax, dword [0x424050]
and dword [ebp - 0xd0], 0
push esi
mov esi, dword [ebp + 0x7c]
xor eax, ebp
push edi
mov dword [ebp + 0x70], eax
xor eax, eax
push 0x4f
pop ecx
lea edi, [ebp - 0xcc]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
sub eax, 0x10
mov dword [ebp - 0xe0], esi
call fcn.00402f91
add eax, 0x10
mov dword [ebp - 0xd4], eax
lea eax, [ebp - 0xd4]
call fcn.00405e30
mov edi, 0x420870
mov ecx, edi
call fcn.00402f1b
push eax
push edi
lea eax, [ebp - 0xd4]
push eax
call fcn.00402f2b
lea eax, [ebp - 0xd0]
push eax
push dword [ebp - 0xd4]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0xdc], eax
je 0x405c21
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp byte [ebp - 0xa4], 0x2e
jne 0x405b3a
cmp byte [ebp - 0xa3], 0
je 0x405b24
cmp byte [ebp - 0xa3], 0x2e
jne 0x405b3a
cmp byte [ebp - 0xa2], 0
jne 0x405b3a
lea eax, [ebp - 0xd0]
push eax
push dword [ebp - 0xdc]
call ebx
mov edi, eax
jmp 0x405c18
test byte [ebp - 0xd0], 0x10
je 0x405bc0
mov eax, dword [esi]
sub eax, 0x10
call fcn.00402f91
add eax, 0x10
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0xd8]
call fcn.00405e30
lea ecx, [ebp - 0xa4]
call fcn.00402f1b
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.00402f2b
lea eax, [ebp - 0xd0]
push eax
push dword [ebp - 0xdc]
call ebx
mov edi, eax
lea eax, [ebp - 0xd8]
push eax
call fcn.00405a6b
pop ecx
lea esi, [ebp - 0xd8]
call fcn.00402b4b
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, dword [ebp - 0xd8]
add eax, 0xfffffff0
call fcn.00402f79
jmp 0x405c12
mov eax, esi
lea edi, [ebp - 0xd4]
call fcn.00402d6c
mov eax, edi
call fcn.00405e30
lea ecx, [ebp - 0xa4]
call fcn.00402f1b
push eax
lea eax, [ebp - 0xa4]
push eax
mov eax, edi
push eax
call fcn.00402f2b
lea eax, [ebp - 0xd0]
push eax
push dword [ebp - 0xdc]
call ebx
lea esi, [ebp - 0xd4]
mov edi, eax
call fcn.00402b4b
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [ebp - 0xe0]
test edi, edi
jne 0x405b00
pop ebx
push dword [ebp - 0xdc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0xd4]
add eax, 0xfffffff0
call fcn.00402f79
mov ecx, dword [ebp + 0x70]
pop edi
xor ecx, ebp
pop esi
call fcn.0041e95f
add ebp, 0x74
leave
ret
Function at 0x405c4c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
xor eax, eax
push 0x10
xor ebx, ebx
cmp byte [ebp + 0x18], bl
pop ecx
lea edi, [ebp - 0x58]
mov dword [ebp - 0x5c], 0x44
rep stosd dword es:[edi], eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
mov byte [ebp - 4], bl
je 0x405c84
lea esi, [ebp - 8]
call fcn.0041deb0
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push dword [ebp + 0x14]
push ebx
push ebx
push ebx
call fcn.00402b4b
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp byte [ebp + 0x18], bl
mov edi, eax
je 0x405cb8
lea esi, [ebp - 8]
call fcn.0041dec6
cmp edi, ebx
je 0x405ce3
cmp dword [ebp + 0x10], ebx
je 0x405cd8
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea esi, [ebp - 8]
call fcn.0041dec6
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x405cf2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0xe
pop ecx
xor eax, eax
cmp dword [ebp + 0x10], eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x3c], 0x3c
pop edi
je 0x405d17
mov dword [ebp - 0x38], 0x40
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x30], str.open
cmp dword [eax - 0xc], 0
je 0x405d3b
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x405d4d
xor al, al
leave
ret
cmp dword [ebp + 0x10], 0
je 0x405d70
cmp dword [ebp - 4], 0
je 0x405d70
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov al, 1
leave
ret

Function at 0x405dc2
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x424050]
xor eax, ebp
push esi
mov dword [ebp + 0x84], eax
lea eax, [ebp - 0x80]
push eax
push 0x104
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x405dfa
call fcn.004035ec
jmp 0x405e18
cmp byte [ebp + eax - 0x81], 0x5c
je 0x405e0a
mov byte [ebp + eax - 0x80], 0x5c
inc eax
mov byte [ebp + eax - 0x80], 0
lea eax, [ebp - 0x80]
push eax
call fcn.004032f7
mov ecx, dword [ebp + 0x84]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041e95f
add ebp, 0x88
leave
ret
Function at 0x406486
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x424050]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
xor eax, ebp
push ebx
mov dword [ebp + 0x390], eax
mov eax, dword [ebp + 0x39c]
mov eax, dword [eax]
push 3
push 0x80000000
push eax
mov dword [ebp - 0x78], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea ecx, [ebp - 0x74]
push ecx
mov edi, 0x3ff
push edi
lea ecx, [ebp - 0x70]
push ecx
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x74], ebx
push eax
jmp 0x406506
mov eax, dword [ebp - 0x74]
mov byte [ebp + eax - 0x70], bl
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x78]
call fcn.00402de1
push ebx
lea eax, [ebp - 0x74]
push eax
push edi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x80]
call esi
cmp dword [ebp - 0x74], ebx
jne 0x4064e6
mov esi, dword [ebp - 0x78]
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
cmp eax, 2
jl 0x406538
lea ecx, [ebp - 0x78]
add eax, 0xfffffffe
push ecx
call fcn.00402af0
mov edi, esi
call fcn.00402d6c
mov eax, dword [ebp - 0x78]
add eax, 0xfffffff0
call fcn.00402f79
cmp dword [ebp - 0x80], ebx
pop edi
pop esi
pop ebx
je 0x406549
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x390]
xor ecx, ebp
call fcn.0041e95f
add ebp, 0x394
leave
ret
Function at 0x40657b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa0
mov eax, dword [0x424050]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
xor eax, ebp
push 0x26
mov dword [ebp + 0x74], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x9c
call esi
mov edi, eax
test edi, edi
jne 0x4065ca
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call esi
test eax, eax
je 0x4067b4
mov eax, dword [ebp - 0x18]
sub eax, 0
je 0x4067b8
dec eax
mov ecx, dword [ebp - 0x24]
je 0x406769
dec eax
jne 0x4067b4
cmp ecx, 6
jne 0x40663f
cmp dword [ebp - 0x20], 0
jne 0x4067b4
cmp byte [ebp + 0x72], 1
jne 0x40662b
call fcn.0041dedd
test al, al
movzx eax, word [ebp + 0x6c]
je 0x40661a
dec eax
je 0x406613
push 0x26
jmp 0x4067ba
push 0x27
jmp 0x4067ba
dec eax
je 0x406624
push 0x1d
jmp 0x4067ba
push 0x1e
jmp 0x4067ba
call fcn.0041dedd
neg al
sbb eax, eax
and eax, 9
add eax, 0x1f
jmp 0x4067bb
cmp ecx, 5
jne 0x40672a
cmp dword [ebp - 0x20], 2
jne 0x4066b6
cmp byte [ebp + 0x72], 1
jne 0x406673
movzx eax, word [ebp + 0x6c]
dec eax
je 0x40666c
dec eax
je 0x406665
push 0x20
jmp 0x4067ba
push 0x22
jmp 0x4067ba
push 0x21
jmp 0x4067ba
call fcn.0041dedd
test al, al
movzx eax, word [ebp + 0x6c]
je 0x40669b
dec eax
je 0x406694
dec eax
je 0x40668d
push 0x23
jmp 0x4067ba
push 0x25
jmp 0x4067ba
push 0x24
jmp 0x4067ba
dec eax
je 0x4066af
dec eax
je 0x4066a8
push 0x1a
jmp 0x4067ba
push 0x1c
jmp 0x4067ba
push 0x1b
jmp 0x4067ba
cmp dword [ebp - 0x20], 1
jne 0x4066e9
test edi, edi
je 0x4066cd
movzx eax, word [ebp + 0x6c]
dec eax
je 0x4066e2
dec eax
je 0x4066db
dec eax
je 0x4066d4
push 0x16
jmp 0x4067ba
push 0x19
jmp 0x4067ba
push 0x18
jmp 0x4067ba
push 0x17
jmp 0x4067ba
cmp dword [ebp - 0x20], 0
jne 0x4067b4
test edi, edi
je 0x406707
movzx eax, word [ebp + 0x6c]
dec eax
je 0x406723
dec eax
je 0x40671c
dec eax
je 0x406715
dec eax
je 0x40670e
push 0x11
jmp 0x4067ba
push 0x15
jmp 0x4067ba
push 0x14
jmp 0x4067ba
push 0x13
jmp 0x4067ba
push 0x12
jmp 0x4067ba
cmp ecx, 4
ja 0x4067b4
test edi, edi
je 0x40674d
movzx eax, word [ebp + 0x6c]
dec eax
je 0x406765
dec eax
je 0x406761
dec eax
je 0x40675d
dec eax
je 0x406759
dec eax
je 0x406755
dec eax
je 0x406751
push 0xa
jmp 0x4067ba
push 0x10
jmp 0x4067ba
push 0xf
jmp 0x4067ba
push 0xe
jmp 0x4067ba
push 0xd
jmp 0x4067ba
push 0xc
jmp 0x4067ba
push 0xb
jmp 0x4067ba
cmp ecx, 4
jne 0x4067b4
cmp dword [ebp - 0x20], 0
jne 0x406790
cmp dword [ebp - 0x1c], 0x3b6
jbe 0x406781
push 5
jmp 0x4067ba
xor eax, eax
cmp byte [ebp - 0x13], 0x43
sete al
lea eax, [eax + eax + 4]
jmp 0x4067bb
cmp dword [ebp - 0x20], 0xa
jne 0x4067aa
cmp byte [ebp - 0x13], 0x41
je 0x4067a6
cmp byte [ebp - 0x13], 0x42
je 0x4067a6
push 7
jmp 0x4067ba
push 8
jmp 0x4067ba
cmp dword [ebp - 0x20], 0x5a
jne 0x4067b4
push 9
jmp 0x4067ba
push 0x29
jmp 0x4067ba
push 4
pop eax
mov ecx, dword [ebp + 0x74]
pop edi
xor ecx, ebp
pop esi
call fcn.0041e95f
add ebp, 0x78
leave
ret
Function at 0x407418
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ebx, [edi + 0x34]
push eax
mov esi, ebx
call fcn.00407528
lea eax, [esp + 8]
push eax
xor eax, eax
push eax
push edi
push 0x407460
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea esi, [edi + 0x2c]
call fcn.00407528
push 0xffffffffffffffff
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
pop ebx
pop ecx
ret