joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae9a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4e0930
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x51f4f4]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov edi, dword [esp + 0x74]
mov esi, dword [esp + 0x70]
push 0xe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4aead3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4aeacf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
xor eax, eax
test ebp, ebp
je 0x4aeb52
xor ebx, ebx
cmp ax, word [ebp + 4]
jae 0x4aeab4
lea ecx, [esp + 0x18]
call fcn.004a9330
mov edx, dword [esp + 0x80]
movzx eax, bx
lea ecx, [eax*8]
sub ecx, eax
movzx esi, byte [ebp + ecx*2 + 6]
movzx edi, byte [ebp + ecx*2 + 7]
lea eax, [ebp + ecx*2]
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x68], 0
cmp ecx, esi
jne 0x4aea54
cmp edx, edi
je 0x4aea5c
test ecx, ecx
jne 0x4aea98
test edx, edx
jne 0x4aea98
movzx edx, word [eax + 0x12]
mov eax, dword [esp + 0x70]
push 0
push edi
push esi
push edx
push eax
lea ecx, [esp + 0x2c]
call fcn.004ac1b0
test eax, eax
je 0x4aeabe
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x78]
push ecx
mov ecx, dword [esp + 0x18]
push edi
push esi
push edx
lea eax, [esp + 0x28]
push eax
call fcn.004ae810
test eax, eax
je 0x4aeabe
lea ecx, [esp + 0x18]
mov dword [esp + 0x68], 0xffffffff
call fcn.004ac1a0
inc ebx
cmp bx, word [ebp + 4]
jb 0x4aea16
mov eax, 1
jmp 0x4aeb52
lea ecx, [esp + 0x18]
mov dword [esp + 0x68], 0xffffffff
call fcn.004ac1a0
xor eax, eax
jmp 0x4aeb52
lea ecx, [esp + 0x3c]
call fcn.004a9330
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x7c]
push 0
push ecx
push edx
push edi
push esi
lea ecx, [esp + 0x50]
mov dword [esp + 0x7c], 1
call fcn.004ac1b0
test eax, eax
jne 0x4aeb17
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.004ac1a0
xor eax, eax
jmp 0x4aeb52
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x7c]
push eax
mov eax, dword [esp + 0x7c]
push ecx
push edx
push eax
lea ecx, [esp + 0x4c]
push ecx
mov ecx, ebx
call fcn.004ae810
lea ecx, [esp + 0x3c]
mov esi, eax
mov dword [esp + 0x68], 0xffffffff
call fcn.004ac1a0
mov eax, esi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0x18

Function at 0x4b69d0
Capabilities:
Enumerate gui resources

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x4b5fd0
push ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov ax, word [esp]
pop ecx
ret
Function at 0x4b7510
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
push ebp
push edi
call fcn.00409c00
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
mov eax, edi
shr eax, 4
inc eax
movzx ecx, ax
push 6
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x4b7545
pop edi
pop ebp
xor eax, eax
pop ebx
ret 0xc
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4b753d
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4b758b
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4b7580
mov edi, edi
cmp esi, eax
jae 0x4b758b
sub edi, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4b7570
cmp esi, eax
jae 0x4b758b
movzx edi, word [esi]
test edi, edi
jne 0x4b7594
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
ret 0xc
mov ebx, dword [esp + 0x1c]
push edi
mov ecx, ebx
call fcn.004144c4
lea ecx, [edi + edi]
push ecx
add esi, 2
push esi
push eax
call fcn.0049b060
add esp, 0xc
push edi
mov ecx, ebx
call fcn.00409200
pop esi
mov eax, edi
pop edi
pop ebp
pop ebx
ret 0xc

Function at 0x4b8931
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x88]
call edx
test eax, eax
jne 0x4b8947
pop esi
pop ecx
ret 0xc
cmp dword [esi + 0x28], 0
jne 0x4b8978
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
mov edx, dword [esi + 0x44]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
pop esi
pop ecx
ret 0xc
mov edx, dword [esi + 0x44]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
push eax
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push ebx
push edx
call ebp
test eax, eax
je 0x4b89a6
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret 0xc
push edi
mov edi, dword [esp + 0x1c]
cmp dword [edi], 0
jne 0x4b89ec
mov eax, dword [esp + 0x18]
push eax
call fcn.004461fb
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov dword [edi], eax
add esp, 4
mov dword [ecx], edx
mov eax, dword [edi]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esi + 0x44]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push ebx
push edx
call ebp
pop edi
neg eax
pop ebp
sbb eax, eax
pop ebx
inc eax
pop esi
pop ecx
ret 0xc
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
cmp ecx, dword [esp + 0x18]
jae 0x4b89c9
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret 0xc
Function at 0x4baf50
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x30], 0
mov dword [esi], vtable.CXTPPropExchangeIniFile.0
jne 0x4baf75
mov eax, dword [esi + 0x48]
cmp dword [eax - 0xc], 0
je 0x4baf75
cmp dword [esi + 0x4c], 0
je 0x4baf75
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0x48]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4baf94
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x44]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4bafb3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, esi
pop esi
jmp fcn.004b8330

Function at 0x4bd190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x54]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4bd1b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x50]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4bd1d1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x4bd1e0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esi + 0x48]
test eax, eax
je 0x4bd1ef
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esi + 0x44]
test eax, eax
je 0x4bd1fe
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, esi
pop esi
jmp fcn.004b8330

Function at 0x4bdb64
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x51f4f4]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
push edi
jne 0x4bdbe2
mov eax, dword [esi + 0x48]
cmp dword [eax - 0xc], 0
lea edi, [esi + 0x48]
jne 0x4bdbdb
lea ecx, [esp + 8]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4bdba7
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.004451b5
add esp, 0x414
ret
lea edx, [esp + 0x210]
push edx
push 0
push 0x4fcbe0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4bdb8e
lea ecx, [esp + 0x210]
push ecx
mov ecx, edi
call fcn.0040a090
mov dword [esi + 0x4c], 1
mov dword [esi + 0x38], 1
mov edx, dword [esi + 0x48]
mov ecx, dword [esp + 0x418]
xor eax, eax
cmp dword [edx - 0xc], eax
pop edi
setne al
pop esi
xor ecx, esp
call fcn.004451b5
add esp, 0x414
ret
Function at 0x4c57a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x10
push ebx
mov bl, byte [edx + 8]
cmp bl, 3
je 0x4c594a
mov ecx, dword [esp + 0x20]
push ebp
mov ebp, dword [edx]
push esi
xor esi, esi
push edi
mov dword [esp + 0x24], esi
test bl, 2
je 0x4c57f8
movzx eax, byte [edx + 9]
movzx esi, byte [ecx]
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 1]
mov dword [esp + 0x10], edi
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 2]
sub eax, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov edi, 3
jmp 0x4c580b
movzx eax, byte [ecx + 3]
movzx edi, byte [edx + 9]
sub edi, eax
mov dword [esp + 0x10], edi
mov edi, 1
test bl, 4
je 0x4c581f
movzx ecx, byte [ecx + 4]
movzx eax, byte [edx + 9]
sub eax, ecx
mov dword [esp + edi*4 + 0x10], eax
inc edi
xor ecx, ecx
xor eax, eax
cmp edi, ecx
jle case.0x4c5866.3
jmp 0x4c5830
cmp dword [esp + eax*4 + 0x10], ecx
jg 0x4c583c
mov dword [esp + eax*4 + 0x10], ecx
jmp 0x4c5841
mov esi, 1
inc eax
cmp eax, edi
jl 0x4c5830
cmp si, cx
je case.0x4c5866.3
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x4c5866.3
movzx eax, byte [eax + 0x4c5964]
jmp dword [eax*4 + 0x4c5950]
mov edx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp edx, ecx
jbe case.0x4c5866.3
lea esp, [esp]
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x4c5880
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [edx + 4]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov ecx, edx
mov eax, 0xf0
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x4c5866.3
mov edi, edi
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x4c58c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x4c5866.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [esp + edx*4 + 0x10]
shr byte [esi - 1], cl
cmp ebx, ebp
jb 0x4c58e6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x4c5866.3
mov edi, edi
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, 0x100
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [esp + edx*4 + 0x10]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, ebp
jb 0x4c5910
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4011f0
Capabilities:
Authenticate hmac

Disassembly:
pushal
mov edx, 0xce9d09bf
sal eax, 0x1e
rcr ecx, cl
rcl ebx, 0x99
shr esi, 0x3d
movsx eax, di
add eax, eax
movsx ecx, cl
not ebx
shrd esi, edi, 0x90
call 0x40124e
imul eax, ebx
dec edi
imul eax, ebx, 0x582558f7
adc ebp, ebp
adc ecx, ecx
inc ebp
dec ecx
mov edi, 0x8d4f
imul ecx, eax
mov cl, dh
bsf ebp, ebp
add edi, 0x265b
movzx ecx, dx
lea ecx, [0x42c4f8c1]
bswap ecx
xor edx, edi

Function at 0x401248
Capabilities:
Authenticate hmac

Disassembly:
rcl esi, 1
dec ebp
xadd bl, ch
test esi, 0x27b1cf4f
xchg bh, bl
cmp eax, 0xc4f6
jno 0x401262
dec ebx
not esi
sub al, dh
invalid
invalid

Function at 0x40124e
Capabilities:
Authenticate hmac

Disassembly:
rcl esi, 1
dec ebp
xadd bl, ch
test esi, 0x27b1cf4f
xchg bh, bl
cmp eax, 0xc4f6
jno 0x401262
dec ebx
not esi
sub al, dh
invalid
invalid

Function at 0x401470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
test edi, edi
je 0x40151c
xor edx, edx
cmp edx, ecx
jge 0x4014ac
cmp edi, dword [esi + 0xc]
je 0x4014ac
lea eax, [esi + 0xc]
nop
lea esi, [esi]
add eax, 0x28
inc edx
cmp edx, ecx
jge 0x4014ac
cmp edi, dword [eax]
jne 0x4014a0
cmp edx, ecx
je 0x401520
lea edx, [edx + edx*4]
shl edx, 3
mov ecx, dword [esi + edx + 0x10]
mov dword [ebx + 8], ecx
test ecx, ecx
je 0x40151c
mov eax, dword [esi + edx + 8]
mov dword [ebx], eax
mov eax, dword [esi + edx + 0xc]
mov dword [ebx + 4], eax
mov eax, dword [esi + edx + 0x14]
mov dword [ebx + 0xc], eax
cmp ecx, 0x100000
ja 0x401520
push 0
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_SetFilePointer
add esp, 0xfffffff4
push dword [ebx + 8]
call sub.msvcrt.dll_malloc
mov edx, eax
mov dword [ebx + 0x10], edx
add esp, 0x10
test edx, edx
je 0x401520
add esp, 0xfffffff4
push 0
lea eax, [ebp - 4]
push eax
push dword [ebx + 8]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x401520
mov al, 1
jmp 0x401522
mov al, 0
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x407650
Capabilities:
Query environment variable

Disassembly:
push ebx
mov eax, 0x4018
call fcn.0040e300
sub esp, eax
mov eax, dword [esp + 0x4020]
mov dword [esp + 8], 0
lea ebx, [esp + 0x10]
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.004088e0
mov dword [esp + 8], 0x2000
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub esp, 0xc
test eax, eax
jne 0x4076b0
add esp, 0x4018
xor eax, eax
pop ebx
ret
lea eax, [esp + 0x2010]
mov dword [esp + 8], 0x2000
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub esp, 0xc
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.00408700
test eax, eax
je 0x40769c
cmp byte [eax], 0
je 0x40769c
mov dword [esp], eax
call sub.msvcrt.dll__strdup
add esp, 0x4018
pop ebx
ret

Function at 0x407770
Capabilities:
Set environment variable

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.004088e0
mov dword [esp + 4], 0
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
sub esp, 8
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret

Function at 0x407bc0
Capabilities:
Delete directory

Disassembly:
push ebp
mov eax, 0x445c
push edi
push esi
push ebx
call fcn.0040e300
sub esp, eax
mov eax, dword [esp + 0x4470]
mov dword [esp + 8], 0x1000
lea ebx, [esp + 0x44c]
mov dword [esp + 4], eax
lea eax, [esp + 0x244e]
mov dword [esp], eax
call fcn.004088e0
lea eax, [esp + 0x244e]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscpy
mov dword [esp], ebx
call sub.msvcrt.dll_wcslen
mov ebp, eax
movzx eax, word [esp + eax*2 + 0x44a]
cmp ax, 0x2f
je 0x407c2e
cmp ax, 0x5c
jne 0x407cd0
mov dword [esp + 4], 0x41b4b4
mov dword [esp], ebx
call sub.msvcrt.dll_wcscat
lea eax, [esp + 0x230]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll__wfindfirst]
mov dword [esp + 0x22c], eax
cmp eax, 0xffffffff
jne 0x407c80
lea eax, [esp + 0x244e]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wrmdir]
add esp, 0x445c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, 0x87
mov edi, esp
lea esi, [esp + 0x230]
mov eax, ebx
rep movsd dword es:[edi], dword [esi]
mov edx, ebp
call fcn.00407cf0
lea eax, [esp + 0x230]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x22c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wfindnext]
test eax, eax
je 0x407c80
mov eax, dword [esp + 0x22c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__findclose]
jmp 0x407c5e
mov dword [esp + 4], 0x41b4b0
add ebp, 1
mov dword [esp], ebx
call sub.msvcrt.dll_wcscat
jmp 0x407c2e
Function at 0x407cf0
Capabilities:
Delete file

Disassembly:
push edi
push esi
push ebx
push eax
mov eax, 0x101c
call fcn.0040e300
sub esp, eax
mov edi, edx
mov eax, dword [esp + eax]
lea esi, [esp + 0x1044]
mov dword [esp + 4], 0x41b4b8
mov dword [esp], esi
mov ebx, eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x407d30
add esp, 0x1020
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], 0x41b4bc
mov dword [esp], esi
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x407d22
xor eax, eax
mov word [ebx + edi*2], ax
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_wcscat
test byte [esp + 0x1030], 0x10
je 0x407d90
mov dword [esp + 4], ebx
lea ebx, [esp + 0x1f]
mov dword [esp], ebx
mov dword [esp + 8], 0x1000
call fcn.00408700
mov dword [esp], ebx
call fcn.00407bc0
add esp, 0x1020
pop ebx
pop esi
pop edi
ret
mov dword [esp], ebx
mov esi, dword [sym.imp.msvcrt.dll__wremove]
call esi
test eax, eax
je 0x407d22
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
mov dword [esp], ebx
call esi
jmp 0x407d22
Function at 0x408330
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [esp], 0x2000
mov edi, dword [esp + 0x58]
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x408498
mov eax, dword [esp + 0x50]
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0040ec30
test eax, eax
js 0x408498
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call fcn.0040ed20
cdq
mov ecx, eax
mov dword [esp + 0x18], eax
mov eax, edi
mov dword [esp + 0x1c], edx
xor edx, edx
cmp ecx, edi
mov ecx, dword [esp + 0x1c]
sbb ecx, edx
jb 0x408498
add eax, 0xffffffff
mov ebp, ebx
adc edx, 0xffffffff
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x1c]
cmp eax, 0x2000
mov ecx, edx
mov ebx, 0
mov dword [esp + 0x18], eax
sbb ecx, ebx
mov dword [esp + 0x1c], edx
jae 0x4083de
mov dword [esp + 0x18], 0x2000
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov esi, eax
add ecx, 0xffffe000
adc ebx, 0xffffffff
sub esi, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ebx
cmp edi, esi
ja 0x408492
mov eax, dword [esp + 0x50]
mov dword [esp + 8], 0
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.0040ec30
test eax, eax
js 0x408492
mov eax, dword [esp + 0x50]
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], ebp
call sub.msvcrt.dll_fread
cmp eax, esi
jne 0x408492
sub eax, edi
mov ebx, ebp
lea esi, [eax + 1]
jmp 0x408470
mov eax, dword [esp + 0x54]
lea ebp, [esi - 1]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
lea eax, [ebx + ebp]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x4084b0
mov esi, ebp
test esi, esi
jne 0x408450
mov eax, dword [esp + 0x28]
mov ebp, ebx
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
add eax, ebx
adc edx, esi
or esi, ebx
jne 0x4083b6
mov ebx, ebp
lea esi, [esi]
xor esi, esi
xor edi, edi
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x3c
mov eax, esi
mov edx, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
add eax, 0xffffdfff
adc edx, 0xffffffff
xor edi, edi
add esi, eax
adc edi, edx
jmp 0x40849c
Function at 0x408b20
Capabilities:
Create directory

Disassembly:
push ebp
mov eax, 0x203c
push edi
push esi
push ebx
call fcn.0040e300
sub esp, eax
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x20]
mov dword [esp + 4], 8
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
sub esp, 0xc
lea edi, [esp + 0x24]
test eax, eax
jne 0x408c40
xor ebx, ebx
lea esi, [esp + 0x30]
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x408b99
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov ebx, dword [esp + 0x30]
mov eax, str.S_1_3_4
mov dword [esp], esi
mov dword [esp + 8], str.D:_A__FA____s_
test ebx, ebx
mov dword [esp + 4], 0x1000
cmovne eax, ebx
mov dword [esp + 0xc], eax
call dword [sym.imp.msvcrt.dll__snwprintf]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
sub esp, 0x10
test eax, eax
je 0x408ce8
mov eax, dword [esp + 0x2050]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
sete al
movzx eax, al
neg eax
add esp, 0x203c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call esi
sub esp, 0x14
test eax, eax
jne 0x408c81
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x408b76
mov ebp, dword [esp + 0x24]
mov dword [esp], 1
mov dword [esp + 4], ebp
call sub.msvcrt.dll_calloc
mov ebx, eax
mov eax, dword [esp + 0x20]
test ebx, ebx
je 0x408b76
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], eax
call esi
sub esp, 0x14
lea esi, [esp + 0x30]
test eax, eax
je 0x408b7c
mov dword [esp + 4], esi
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
sub esp, 8
jmp 0x408b7c
mov eax, 0xffffffff
jmp 0x408c2d

Function at 0x40d650
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00417070
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00417070
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]