joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4211da
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x47634f
call fcn.00467ed8
sub esp, 0x138
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
and byte [ebp - 0x144], bl
xor eax, eax
lea edi, [ebp - 0x143]
mov dword [ebp - 0x14], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x10], ebx
push 1
lea eax, [ebp - 0x10]
pop esi
push eax
push 0x4968c0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4212bc
cmp dword [ebp + 0xc], esi
mov dword [ebp - 0x18], 0x104
mov eax, 0x4968b0
je 0x421243
mov eax, 0x4968a0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x144]
push ecx
push ebx
push ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0xf]
push ebx
push eax
lea eax, [ebp - 0x144]
mov edi, 0x47e4b8
mov esi, 0x47e4b0
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x20], esi
call fcn.00405ab2
push 0x495d74
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00407248
lea ecx, [ebp - 0x40]
call fcn.00420d1e
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push 0
push eax
mov ecx, ebx
mov dword [ebx], edi
mov dword [ebx + 0x20], esi
call fcn.00405983
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
jmp 0x421311
lea eax, [ebp + 0xf]
push ebx
push eax
lea eax, [ebp - 0x144]
mov edi, 0x47e4b8
mov esi, 0x47e4b0
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x20], esi
call fcn.00405ab2
push 0x495d74
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.00407248
mov ebx, dword [ebp + 8]
push 0
push eax
mov ecx, ebx
mov dword [ebx], edi
mov dword [ebx + 0x20], esi
call fcn.00405983
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00407d51
cmp dword [ebp - 0x10], 0
je 0x421325
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4249b4
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x476ac7
call fcn.00467ed8
sub esp, 0x224
push ebx
push esi
lea eax, [ebp - 0x230]
push edi
xor ebx, ebx
push eax
push 0x104
mov dword [ebp - 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4249f8
lea ecx, [ebp - 0x2c]
call fcn.00407e1a
lea eax, [ebp - 0x2c]
push 0x4869b0
push eax
call fcn.00467ef7
push 0x24
xor eax, eax
pop ecx
lea edi, [ebp - 0x128]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
mov edi, 0x47e4b8
mov esi, 0x47e4b0
je 0x424b21
cmp dword [ebp - 0x11c], 1
jne 0x424b21
lea eax, [ebp - 0xd]
push ebx
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x18], esi
call fcn.00405ab2
push 0x496a9c
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], ebx
call fcn.00407248
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea ecx, [ebp - 0x38]
call fcn.00406617
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x424aff
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.00420055
pop ecx
pop ecx
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
push ecx
mov ecx, eax
call fcn.00406f52
push dword [0x47e51c]
mov ecx, eax
add eax, 4
mov byte [ebp - 4], 2
neg ecx
sbb ecx, ecx
push ebx
and ecx, eax
push ecx
lea ecx, [ebp - 0x34]
call fcn.00406741
lea ecx, [ebp - 0x98]
call fcn.00407d51
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.00407d51
push 0x496a90
lea ecx, [ebp - 0x38]
call fcn.00407248
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x38]
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00405983
lea ecx, [ebp - 0x38]
jmp 0x424b61
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x38]
call fcn.00406617
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00407d51
lea eax, [ebp - 0xe]
push ebx
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x44], esi
call fcn.00405ab2
push 0x495d74
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 3
call fcn.00407248
mov ecx, dword [ebp + 8]
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00405983
lea ecx, [ebp - 0x64]
call fcn.00407d51
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x424b78
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x476b10
call fcn.00467ed8
sub esp, 0x104
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [ebp - 0x48]
xor ebx, ebx
neg edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x44]
sbb edi, edi
mov dword [ebp - 0x14], ebx
and edi, eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x110]
push eax
call fcn.00424d1d
push 4
lea ecx, [ebp - 0xc0]
pop esi
mov dword [ebp - 4], ebx
push esi
push ebx
push ecx
mov ecx, eax
call fcn.00405c5e
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x98]
push eax
mov byte [ebp - 4], 1
call fcn.00406d7c
push dword [ebp - 0x20]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.004205d0
add esp, 0xc
push dword [0x47e51c]
mov ecx, eax
add eax, esi
mov byte [ebp - 4], 3
neg ecx
sbb ecx, ecx
push ebx
and ecx, eax
mov eax, dword [ebp - 0x18]
push ecx
lea ecx, [eax + 4]
call fcn.00406741
lea ecx, [ebp - 0xe8]
call fcn.00407d51
lea ecx, [ebp - 0x98]
call fcn.00407d51
lea ecx, [ebp - 0xc0]
call fcn.00407d51
lea ecx, [ebp - 0x110]
call fcn.00407d51
lea eax, [ebp - 0x19]
push ebx
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], 0x47e4b8
mov dword [ebp - 0x28], 0x47e4b0
call fcn.0040590e
lea eax, [ebp - 0x54]
push 0x104
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], esi
call fcn.00406c57
mov esi, eax
mov ecx, dword [esi]
mov byte [ebp - 4], 5
call fcn.00406617
movzx ecx, word [ebp - 0x10]
push ecx
push 0x496aac
push eax
mov dword [esi + 8], eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 4
call fcn.00405d74
push dword [0x47e51c]
push ebx
mov eax, dword [ebp - 0x18]
push edi
lea ecx, [eax + 4]
call fcn.0040763e
mov ecx, dword [ebp - 0x18]
call fcn.00406617
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x424d04
inc dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00407d51
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffff
jl 0x424ba8
push 0x50
lea ecx, [ebp - 0x70]
call fcn.00414228
lea eax, [ebp - 0x70]
push 0x4869b0
push eax
call fcn.00467ef7
lea ecx, [ebp - 0x48]
call fcn.00407d51
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42547c
Capabilities:
Create thread

Disassembly:
mov eax, 0x476ba4
call fcn.00467ed8
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x14], edi
lea ebx, [esi + 0x14]
jne 0x425519
push 0x496ac4
push edi
push edi
push edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], eax
lea eax, [esi + 0x10]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x18]
push edi
push eax
push 0x425203
push edi
push edi
call fcn.00468f44
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0xc]
add esp, 0x18
cmp eax, dword [ebp - 0x14]
je 0x4254df
cmp eax, edi
je 0x4254d9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], edi
mov eax, dword [ebp - 0x14]
mov dword [esi + 0xc], eax
push 0x7530
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push 0x47f070
push dword [ebp - 0x18]
call dword [sym.imp.ole32.dll_CoGetInterfaceAndReleaseStream]
mov eax, dword [ebx]
push dword [esi + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], edi
je 0x425519
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebx]
push dword [ebp + 8]
mov eax, dword [ebx]
push 0x47f070
push ebx
call dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4292a9
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x477170
call fcn.00467ed8
sub esp, 0x114
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.004291d8
mov edi, eax
cmp edi, esi
je 0x4292f3
cmp dword [ebp - 0x10], esi
je 0x4292ec
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x429390
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x429364
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x10]
push eax
call fcn.004292a9
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x429351
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x120]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x429316
cmp dword [ebp - 0x10], esi
je 0x42935f
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x429390
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x429377
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x42938e
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4310ca
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x4310dd
xor eax, eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x431111
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.00463949
test al, al
jne 0x431144
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.00418886
lea eax, [ebp - 0x4c]
push 0x485550
push eax
call fcn.00467ef7
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x431144
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.00407dae
lea eax, [ebp - 0x48]
push 0x481f58
push eax
call fcn.00467ef7
mov eax, dword [ebp + 8]
pop esi
leave
ret 8
Function at 0x43116d
Capabilities:
Delete file

Disassembly:
mov eax, 0x477f05
call fcn.00467ed8
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi - 4], 0x47ee3c
mov dword [esi], 0x47ee38
mov dword [ebp - 4], 5
call fcn.00418ffc
cmp dword [esi + 0xcc], 0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
je 0x4311b5
lea ecx, [esi + 0xc0]
call fcn.00406617
push eax
call edi
cmp dword [esi + 0xf4], 0
je 0x4311cc
lea ecx, [esi + 0xe8]
call fcn.00406617
push eax
call edi
mov eax, dword [esi + 0x118]
mov byte [ebp - 4], 4
test eax, eax
je 0x4311e0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x114]
mov byte [ebp - 4], 3
test eax, eax
je 0x4311f4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esi + 0xe8]
mov byte [ebp - 4], 2
call fcn.00407d51
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 1
call fcn.00407d51
and byte [ebp - 4], 0
lea ecx, [esi + 0x98]
call fcn.00407d51
lea edi, [esi - 4]
neg edi
sbb edi, edi
and edi, esi
mov dword [ebp - 0x10], edi
mov dword [edi], 0x47ed94
mov ecx, edi
mov dword [ebp - 4], 6
call fcn.00418ffc
or dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0xc]
call fcn.00407d51
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4315a2
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00406617
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x4315d9
push 1
lea ecx, [ebp - 0x48]
push dword [ebp + 8]
call fcn.00407dae
lea eax, [ebp - 0x48]
push 0x481f58
push eax
call fcn.00467ef7
leave
ret
Function at 0x4316dd
Capabilities:
Delete file
Move file

Disassembly:
mov eax, 0x477fcc
call fcn.00467ed8
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esp
lea eax, [ebp + 0x30]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp + 8]
push eax
call fcn.0041d77b
pop ecx
test al, al
pop ecx
je 0x431715
and byte [ebp - 4], 0
jmp 0x4317f7
lea eax, [ebp - 0x1c]
lea ecx, [ebp + 0x30]
push eax
mov byte [ebp - 4], 2
call fcn.00406c3c
push dword [eax + 8]
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.00431848
cmp byte [ebp - 0x18], 0
mov byte [ebp - 4], 2
je 0x431748
mov ecx, dword [ebp - 0x1c]
push dword [ecx + 0x1c]
call fcn.00405c35
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 0x30]
call fcn.00406617
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4317a1
call edi
mov esi, eax
cmp esi, 3
je 0x4317a1
cmp esi, 2
je 0x4317a1
lea eax, [ebp - 0x1c]
lea ecx, [ebp + 0x30]
push eax
call fcn.00406c3c
push dword [eax + 8]
mov ecx, ebx
mov byte [ebp - 4], 4
push esi
call fcn.004318a9
cmp byte [ebp - 0x18], 0
mov byte [ebp - 4], 2
je 0x43174e
mov ecx, dword [ebp - 0x1c]
push dword [ecx + 0x1c]
call fcn.00405c35
jmp 0x43174e
lea ecx, [ebp + 8]
call fcn.00406617
lea ecx, [ebp + 0x30]
mov esi, eax
call fcn.00406617
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x4317f3
lea eax, [ebp - 0x1c]
lea ecx, [ebp + 0x30]
push eax
call fcn.00406c3c
push dword [eax + 8]
mov byte [ebp - 4], 5
call edi
push eax
mov ecx, ebx
call fcn.004318a9
cmp byte [ebp - 0x18], 0
mov byte [ebp - 4], 2
je 0x4317a1
mov ecx, dword [ebp - 0x1c]
push dword [ecx + 0x1c]
call fcn.00405c35
jmp 0x4317a1
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00407d51
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x30]
call fcn.00407d51
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x50

Function at 0x431848
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
mov ebp, ecx
push 0
call fcn.0041dcd3
pop ecx
test al, al
pop ecx
je 0x4318a2
mov ecx, esi
call fcn.00406617
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
mov ecx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00406617
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push eax
call edi
test eax, eax
jne 0x4318a2
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, ebp
call fcn.004318a9
push ebx
mov ecx, esi
call fcn.00406617
push eax
jmp 0x431882
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x436bcc
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x4789bc
call fcn.00467ed8
sub esp, 0x168
push ebx
push esi
push 0x496340
lea eax, [ebp - 0x34]
push dword [ebp + 8]
push eax
call fcn.004076d0
add esp, 0xc
lea ecx, [ebp - 0x174]
xor ebx, ebx
push ecx
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00406617
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [ebp + 8], esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.00407d51
cmp esi, 0xffffffff
jne 0x436c26
mov al, 1
jmp 0x436c55
lea eax, [ebp - 0x174]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push eax
push esi
call edi
test eax, eax
je 0x436c49
lea eax, [ebp - 0x174]
push eax
push esi
call edi
test eax, eax
jne 0x436c4b
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x437604
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x1c]
mov ebp, ecx
call fcn.0041dcd3
pop ecx
test al, al
pop ecx
je 0x437666
mov ecx, esi
call fcn.00406617
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
mov ecx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00406617
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push eax
call edi
test eax, eax
jne 0x437666
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push esi
mov ecx, ebp
call fcn.004374c1
push ebx
mov ecx, esi
call fcn.00406617
push eax
jmp 0x437640
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x43766d
Capabilities:
Delete file

Disassembly:
mov eax, 0x478afc
call fcn.00467ed8
push esi
push edi
mov edi, ecx
push dword [ebp + 0x34]
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
call fcn.00437604
lea ecx, [ebp + 8]
call fcn.00406617
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call esi
test eax, eax
jne 0x4376cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x4376cd
cmp eax, 2
je 0x4376cd
push dword [ebp + 0x34]
mov ecx, edi
push eax
lea eax, [ebp + 8]
push dword [ebp + 0x30]
push eax
call fcn.004374c1
lea ecx, [ebp + 8]
call fcn.00406617
push eax
jmp 0x43769a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00407d51
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0x30
Function at 0x4376e9
Capabilities:
Delete directory

Disassembly:
mov eax, 0x478b28
call fcn.00467ed8
sub esp, 0x34
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 0x34]
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
call fcn.00437604
lea ecx, [ebp + 8]
call fcn.00406617
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push eax
call edi
test eax, eax
jne 0x437852
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 3
je 0x437852
cmp ebx, 2
je 0x437852
cmp ebx, 5
jne 0x437756
lea eax, [ebp + 8]
push eax
call fcn.00436bcc
test al, al
pop ecx
jne 0x43775e
mov ebx, 0x91
cmp ebx, 0x91
je 0x43777b
push dword [ebp + 0x34]
lea eax, [ebp + 8]
mov ecx, esi
push ebx
push dword [ebp + 0x30]
push eax
call fcn.004374c1
lea ecx, [ebp + 8]
call fcn.00406617
push eax
jmp 0x43771a
xor edi, edi
mov dword [ebp + 0x30], edi
mov eax, dword [esi]
mov dword [ebp - 0x10], edi
lea edx, [ebp + 0x30]
mov byte [ebp - 4], 1
mov eax, dword [eax + 4]
push edx
push 0x496750
push 0x4811ec
mov eax, dword [eax + esi]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp eax, edi
jl 0x4377b4
mov eax, dword [ebp + 0x30]
lea edx, [ebp - 0x10]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp word [ebp - 0x10], di
je 0x437841
sub esp, 0x28
lea eax, [ebp + 0x37]
mov dword [ebp - 0x14], esp
mov ecx, esp
push 0
mov esi, 0x49f73c
mov ebx, 0x47e4b8
mov edi, 0x47e4b0
push eax
push esi
mov dword [ecx], ebx
mov dword [ecx + 0x20], edi
call fcn.00405a16
sub esp, 0x28
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x18], esp
push 1
push eax
mov byte [ebp - 4], 2
call fcn.0041b994
mov byte [ebp - 4], 1
call fcn.00460826
add esp, 0x50
test eax, eax
je 0x437841
lea eax, [ebp + 0x37]
push 0
push eax
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x20], edi
call fcn.00405a16
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp + 8]
push eax
call fcn.00460bf5
pop ecx
mov byte [ebp - 4], 1
pop ecx
lea ecx, [ebp - 0x40]
call fcn.00407d51
mov eax, dword [ebp + 0x30]
and byte [ebp - 4], 0
test eax, eax
je 0x437852
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00407d51
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x30
Function at 0x43a9c8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x478fb8
call fcn.00467ed8
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4804c0
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x1c]
mov dword [esi + 0x18], ebx
mov byte [ebp - 4], 1
mov byte [ecx], al
mov al, byte [ebp - 0xd]
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.0043ab04
lea eax, [ebp - 0xd]
push 1
push eax
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 2
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call fcn.0040562c
lea eax, [ebp - 0xe]
push 1
push eax
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 3
call fcn.0040562c
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x84], bl
mov dword [esi], 0x480328
mov dword [esi + 4], 0x480318
mov dword [esi + 8], 0x480300
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44943e
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x47a6a0
call fcn.00467ed8
sub esp, 0x130
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 4], edi
mov ebx, 0x80070000
jne 0x4494b2
call esi
test eax, eax
jg 0x44948e
call esi
jmp 0x449497
call esi
and eax, 0xffff
or eax, ebx
cmp eax, edi
jge 0x4494b2
push eax
lea ecx, [ebp - 0x38]
call fcn.004077d6
lea eax, [ebp - 0x38]
push 0x482270
push eax
call fcn.00467ef7
mov dword [ebp - 0x14], edi
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0x104
push eax
lea eax, [ebp - 0x13c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.msi.dll_MsiRecordSetStringA
mov edi, eax
test edi, edi
jne 0x44953e
cmp dword [ebp + 0x10], eax
je 0x44952f
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x13c]
push dword [ebp + 0x10]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x449510
call esi
test eax, eax
jg 0x449503
call esi
jmp 0x44950c
call esi
and eax, 0xffff
or eax, ebx
test eax, eax
jl 0x449565
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0x10]
je 0x44952f
call esi
test eax, eax
jg 0x449522
call esi
jmp 0x44952b
call esi
and eax, 0xffff
or eax, ebx
test eax, eax
jl 0x44957c
mov eax, dword [ebp + 0x10]
add dword [ebp - 0x14], eax
test eax, eax
jbe 0x449593
jmp 0x4494b5
mov esi, edi
and edi, 0xf7ff
or edi, 0x80040800
neg esi
sbb esi, esi
and esi, edi
cmp dword [ebp - 0x10], 0xffffffff
je 0x449561
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x4495a4
push eax
lea ecx, [ebp - 0x38]
call fcn.004077d6
lea eax, [ebp - 0x38]
push 0x482270
push eax
call fcn.00467ef7
push eax
lea ecx, [ebp - 0x38]
call fcn.004077d6
lea eax, [ebp - 0x38]
push 0x482270
push eax
call fcn.00467ef7
cmp dword [ebp - 0x10], 0xffffffff
je 0x4495a2
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret