joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e4cf
Capabilities:
Get common file path

Disassembly:
push 0x2c
mov eax, 0x477829
call fcn.00448ddd
mov esi, ecx
mov dword [ebp - 0x38], esi
push ecx
push 0x104
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], esi
call fcn.00410bb9
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov ecx, dword [ebp - 0x34]
mov edx, eax
mov eax, dword [ebp - 0x30]
sub eax, ecx
cmp edx, eax
jbe 0x42e532
lea eax, [ebp - 0x34]
push eax
push edx
mov ecx, eax
call fcn.00425854
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00403e12
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.0042aa4f
lea ecx, [ebp - 0x28]
call fcn.004049c7
lea ecx, [ebp - 0x34]
call fcn.0040c03a
mov eax, esi
call fcn.00448d87
ret

Function at 0x42e5a8
Capabilities:
Get common file path

Disassembly:
push 0x208
mov eax, 0x47786f
call fcn.00448ddd
mov esi, ecx
mov dword [ebp - 0x160], esi
push 0x104
xor ebx, ebx
mov dword [ebp - 0x160], esi
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.0044b900
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
push ebx
push ebx
push 0x8023
push ebx
call dword [sym.imp.shell32.dll_SHGetFolderPathA]
mov edi, eax
test edi, edi
jne 0x42e630
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x134]
call fcn.00403e12
lea edx, [ebp - 0x134]
mov dword [ebp - 4], 2
mov ecx, esi
call fcn.0042aa4f
lea ecx, [ebp - 0x134]
call fcn.004049c7
mov eax, esi
call fcn.00448d87
ret
lea ecx, [ebp - 0x214]
call fcn.00402b9d
push edi
push ecx
push 0x489fac
sub esp, 0xc
mov dword [ebp - 4], ebx
push str.__mode
push ecx
push 0x23
push 0x412372
push str.SHGetFolderPath_0x
mov ecx, eax
call fcn.0040544d
mov ecx, eax
call fcn.00412389
mov ecx, eax
call fcn.00413a79
pop ecx
mov ecx, eax
call fcn.0040544d
pop ecx
mov ecx, eax
call fcn.0042eaac
pop ecx
mov ecx, eax
call fcn.0040544d
pop ecx
push eax
lea ecx, [ebp - 0x17c]
call fcn.00433be6
mov edx, eax
push 0x1bf
push str.SysInfo::SHGetFolderPathAdapter
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u281_880_install_src_windows_common_SysInfo.cpp
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 1
call fcn.00402dde
push eax
lea ecx, [ebp - 0x15c]
call fcn.0042eabe
lea eax, [ebp - 0x15c]
mov dword [esp], 0x4a60a4
push eax
call fcn.004480ec
int3
Function at 0x42ef4f
Capabilities:
Create process on windows

Disassembly:
push 0x24
mov eax, 0x4779ea
call fcn.00448ddd
mov esi, ecx
cmp dword [0x4ac0bc], 1
jg 0x42efa4
lea eax, [esi + 0x30]
mov edx, str.Executor.exec__:
push eax
lea ecx, [ebp - 0x28]
call fcn.00409fb1
pop ecx
and dword [ebp - 4], 0
mov ecx, 0x4ac0bc
push eax
push str.Executor::startExecution
push 0x93
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u281_880_install_src_windows_common_Executor.cpp
push 1
call fcn.00427250
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004049c7
push 0x44
pop ebx
push ebx
lea edi, [esi + 0x70]
push 0
push edi
call fcn.0044b900
add esp, 0xc
mov dword [edi], ebx
lea ebx, [esi + 0x60]
push 0x10
push 0
push ebx
call fcn.0044b900
add esp, 0xc
cmp dword [esi + 0xb4], 1
jne 0x42efe8
or dword [esi + 0x9c], 1
xor eax, eax
mov word [esi + 0xa0], ax
mov dword [esi + 0x54], 0x8000000
cmp byte [esi + 0xc1], 0
je 0x42eff8
mov ecx, esi
call fcn.0042f436
lea ecx, [esi + 0x30]
cmp dword [ecx + 0x14], 0x10
mov edx, ecx
jb 0x42f005
mov edx, dword [ecx]
mov eax, dword [ecx + 0x10]
add eax, edx
cmp dword [ecx + 0x14], 0x10
jb 0x42f012
mov ecx, dword [ecx]
push dword [ebp - 0x2d]
xor edx, edx
push eax
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
call fcn.00410c35
lea eax, [ebp - 0x29]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x29], 0
call fcn.00411d31
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x42f04b
mov eax, dword [esi]
push ebx
push edi
push dword [esi + 0x5c]
push dword [esi + 0x58]
push dword [esi + 0x54]
push dword [esi + 0x50]
push dword [esi + 0x4c]
push dword [esi + 0x48]
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.0040c03a
mov al, bl
call fcn.00448d87
ret
Function at 0x4341d7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x7c
mov eax, 0x4787fa
call fcn.00448ddd
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x44]
push esi
call fcn.00433c44
xor ebx, ebx
cmp dword [ebp - 0x34], ebx
je 0x43426f
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x84]
push ebx
or eax, 0x20019
push eax
lea eax, [ebp - 0x44]
push eax
push dword [edi]
call fcn.00433c76
mov esi, dword [ebp - 0x84]
add esp, 0x10
cmp dword [ebp - 0x7c], ebx
je 0x434226
mov al, byte [ebp - 0x80]
jmp 0x43425b
push ebx
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x69], bl
push eax
mov al, byte [ebp - 0x80]
push ecx
push ecx
mov ecx, esp
mov byte [ecx + 4], al
lea eax, [ebp - 0x44]
push eax
mov dword [ecx], esi
lea ecx, [ebp - 0x68]
push edi
call fcn.00433e12
mov ecx, eax
call fcn.004341d7
lea ecx, [ebp - 0x68]
mov bl, al
call fcn.004480ec
mov al, byte [ebp - 0x69]
mov dword [ebp - 4], 1
test al, al
je 0x434296
push esi
call fcn.00436b4f
pop ecx
jmp 0x434296
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
jb 0x43427d
mov esi, dword [esi]
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
push ebx
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x434296
mov bl, 1
lea ecx, [ebp - 0x2c]
call fcn.004049c7
lea ecx, [ebp - 0x44]
call fcn.004049c7
mov al, bl
call fcn.00448d87
ret 8
Function at 0x4345ff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0xac
push 0xffffffffffffffff
push 0x4789b2
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x4a8068]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp + 0xb4]
lea ecx, [ebp + 0x78]
mov edi, dword [ebp + 0xb8]
mov eax, dword [ebp + 0xbc]
mov dword [ebp - 0x20], esi
push edi
mov dword [ebp - 0x20], eax
call fcn.00433c44
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x88], eax
je 0x43469c
push eax
lea eax, [ebp + 0x78]
push eax
push ebx
lea ecx, [ebp + 0x3c]
call fcn.00433eb1
push dword [ebp - 0x20]
lea ecx, [ebp + 0x90]
mov byte [ebp - 4], 1
push ecx
push esi
mov ecx, eax
call fcn.004345ff
lea ecx, [ebp + 0x3c]
call fcn.004480ec
jmp 0x434714
mov ecx, eax
mov dword [ebp - 0x10], eax
mov edx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov byte [ebp - 4], 2
mov eax, edx
sub eax, ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp ecx, edx
cmove ecx, eax
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x4346c5
mov eax, dword [edi]
lea edx, [ebp - 0x1c]
push edx
push ecx
push dword [ebp - 0x20]
push 0
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
cmp ebx, 0xea
je 0x43474e
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
jne 0x43476b
test ebx, ebx
jne 0x43476f
test ecx, ecx
jne 0x434751
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, eax
call fcn.00418eeb
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.00418ebe
lea ecx, [ebp - 0x18]
call fcn.0040c03a
lea ecx, [ebp + 0x90]
call fcn.004049c7
lea ecx, [ebp + 0x78]
call fcn.004049c7
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa8]
xor ecx, ebp
call fcn.004484c4
add ebp, 0xac
leave
ret 0xc
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, eax
call fcn.00418eeb
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x24]
jmp 0x4346ad
test ebx, ebx
je 0x4346f5
push str.query_value
lea ecx, [ebp + 0x60]
call fcn.00403e12
lea ecx, [ebp]
call fcn.00403e3f
mov ecx, dword [ebp - 0x24]
push eax
push edi
lea eax, [ebp + 0x60]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp + 0x48]
push eax
call fcn.0043507c
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 5
call fcn.00426e87
push str.System_error
push ebx
mov byte [ebp - 4], 6
lea eax, [ebp - 0xd4]
push dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x30]
push eax
call fcn.00435e5f
mov edx, eax
push 0x12b
push str.Registry::getValue
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u281_880_install_src_windows_common_Registry.cpp
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.00402dde
push eax
lea ecx, [ebp + 0x18]
call fcn.0041e178
lea eax, [ebp + 0x18]
mov dword [esp], 0x4a5da4
push eax
call fcn.004480ec
int3
Function at 0x434f39
Capabilities:
Delete registry value

Disassembly:
push 0x104
mov eax, 0x478b6f
call fcn.00448ddd
mov ebx, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push esi
call fcn.00433c44
cmp dword [ebp - 0x30], 0
je 0x434fd7
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x78]
push 0
or eax, 0x2001f
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebx]
call fcn.00433c76
mov edi, dword [ebp - 0x70]
add esp, 0x10
mov esi, dword [ebp - 0x78]
test edi, edi
je 0x434f87
mov al, byte [ebp - 0x74]
jmp 0x434fbc
push 0x4ab119
lea eax, [ebp - 0x28]
push eax
mov al, byte [ebp - 0x74]
push ecx
push ecx
mov ecx, esp
mov byte [ecx + 4], al
lea eax, [ebp - 0x40]
push eax
mov dword [ecx], esi
lea ecx, [ebp - 0x64]
push ebx
call fcn.00433e12
mov ecx, eax
call fcn.00434f39
lea ecx, [ebp - 0x64]
mov edi, eax
call fcn.004480ec
xor eax, eax
mov dword [ebp - 4], 1
test al, al
je 0x435062
push esi
call fcn.00436b4f
pop ecx
jmp 0x435062
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x434fe1
mov eax, dword [esi]
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, eax
test edi, edi
jne 0x435062
cmp dword [0x4ac0bc], eax
jg 0x435062
push ecx
push ecx
lea ecx, [ebp - 0x110]
call fcn.00403ead
mov edx, str.Deleted__
lea ecx, [ebp - 0x110]
call fcn.00406a2a
sub esp, 0x18
mov ecx, ebx
mov eax, esp
push esi
push eax
call fcn.00434128
lea ecx, [ebp - 0x110]
call fcn.00405461
mov esi, eax
mov edx, str.__value
mov ecx, esi
call fcn.00406a2a
push esi
push str.Registry::deleteValue
push 0x1d2
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u281_880_install_src_windows_common_Registry.cpp
push edi
mov ecx, 0x4ac0bc
call fcn.00402d4b
lea ecx, [ebp - 0x110]
call fcn.004480ec
lea ecx, [ebp - 0x28]
call fcn.004049c7
lea ecx, [ebp - 0x40]
call fcn.004049c7
mov eax, edi
call fcn.00448d87
ret 8
Function at 0x4390ad
Capabilities:
Check mutex on windows

Disassembly:
push 0xa4
mov eax, 0x47976c
call fcn.00448da9
mov edi, ecx
push str.Global_MSIExecute
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
mov esi, eax
mov byte [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x43915f
push edi
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x439158
cmp dword [0x4ac0bc], 1
jg 0x439158
push ecx
push ecx
lea ecx, [ebp - 0xb0]
call fcn.00403ead
mov edx, str.finish_waiting_for_mutex:
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb0]
call fcn.00406a2a
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb0]
call fcn.0040581e
lea eax, [ebp - 0xb0]
mov ecx, 0x4ac0bc
push eax
push str.msi::waitForInstallationCompletion
push 0x1c8
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u281_880_install_src_windows_common_MsiUtils.cpp
push 1
call fcn.00402d4b
lea ecx, [ebp - 0xb0]
call fcn.004480ec
mov eax, dword [ebp - 0x10]
cmp eax, 0x102
je 0x439161
mov bl, 1
push esi
mov dword [ebp - 4], 3
call fcn.00436a38
pop ecx
mov al, bl
call fcn.00448d72
ret

Function at 0x43fc90
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x23c]
sub esp, 0x23c
push 0xffffffffffffffff
push 0x47aa4c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4a8068]
xor eax, ebp
mov dword [ebp + 0x238], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [ebp + 0x30]
mov dword [ebp - 0x10], edi
push eax
xor ebx, ebx
push ebx
push ebx
push 0x2c
push ebx
call dword [sym.imp.shell32.dll_SHGetFolderPathW]
test eax, eax
jne 0x43fd6a
lea eax, [ebp + 0x30]
push eax
lea ecx, [ebp]
call fcn.0041d1c7
mov esi, eax
mov dword [ebp - 4], ebx
mov ebx, str.OracleJavajava.settings.cfg
push ebx
call fcn.004480ec
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.004480ec
xor ecx, ecx
mov byte [ebp - 0x10], cl
push dword [ebp - 0x10]
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x2c], ecx
lea ecx, [ebp + 0x18]
push eax
call fcn.0041d2a0
lea edx, [ebp + 0x18]
mov byte [ebp - 4], 1
mov ecx, edi
call fcn.0043f3d0
lea ecx, [ebp + 0x18]
call fcn.00419e55
lea ecx, [ebp]
call fcn.00419e55
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x238]
xor ecx, ebp
call fcn.004484c4
add ebp, 0x23c
leave
ret
push 0xc8
lea ecx, [ebp - 0x20]
call fcn.0041241e
push 0x4a5ce4
lea eax, [ebp - 0x20]
push eax
call fcn.004480ec
int3
Function at 0x44278c
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebx, ecx
push edi
mov edi, dword [esp + 0x24]
mov ebp, SysReAllocString
test edi, edi
jl 0x44280f
jg 0x4427b8
test esi, esi
je 0x44280f
test edi, edi
jg 0x4427b8
jl 0x4427b4
cmp esi, ebp
jae 0x4427b8
mov eax, esi
jmp 0x4427ba
mov eax, ebp
and dword [esp + 0x20], 0
cmp dword [esp + 0x18], 0xffffffff
je 0x442800
push 0
lea ecx, [esp + 0x24]
push ecx
push eax
push ebx
push dword [esp + 0x28]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x4427ea
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
je 0x44280a
jmp 0x442800
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x4427fb
add ebx, eax
cdq
sub esi, eax
sbb edi, edx
jmp 0x4427a0
cmp eax, 0xffffffff
jne 0x44280a
call fcn.00451cc1
cmp dword [eax], 4
je 0x4427a0
or eax, 0xffffffff
jmp 0x442811
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4480ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4480fb
pop dword [ebp - 0x1c]
mov eax, 0xc8b39009
sub eax, 0xc86f0f0e
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x4cf54
push 0
mov eax, 0x9b38c782
sub eax, 0x9af106d6
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x4e32
mov edi, eax
mov ebx, 0x86f9489f
add ebx, 0x79565d61
add ebx, dword [ebp - 0x1c]
mov esi, 0x19ff1ec7
sub esi, 0xaff2de7d
mov edx, dword [ebx]
sub dword [ebp - 0xc], 0xd407d9e2
xor edx, esi
add dword [ebp - 0xc], 0xd62500a1
mov dword [edi], edx
add dword [ebp - 0x10], ebx
add edi, 0x2b3bd206
add edi, 0xd4c42dfe
add ebx, 0x9ae930f2
sub ebx, 0x9ae930ee
loop 0x448154
add eax, 0x460b3662
add eax, 0xb9f5f539
xor ebx, ebx
add ebx, eax
add eax, 0x38f0347a
sub eax, 0x38f03475
mov ecx, 0x68fd344c
sub ecx, 0x68bd344c
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401cd8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4489a3
mov eax, dword fs:[0]
push eax
sub esp, 0x2b4
push esi
push edi
mov eax, dword [0x45f774]
xor eax, esp
push eax
lea eax, [esp + 0x2c0]
mov dword fs:[0], eax
lea eax, [esp + 0x6c]
push eax
call fcn.0040ab54
mov esi, 0x4512f3
xor edi, edi
push esi
lea ecx, [esp + 0x18c]
mov dword [esp + 0x2cc], edi
call fcn.00401afc
push esi
lea ecx, [esp + 0x17c]
call fcn.00401afc
lea esi, [esp + 0x10]
call fcn.00407d49
push str.user.dat
push eax
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x2d4], 1
call fcn.00402a70
add esp, 0xc
mov byte [esp + 0x2c8], 3
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004017b8
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401e50
push edi
push dword [esp + 0x10]
lea ecx, [esp + 0x1c]
call fcn.00419bf6
push edi
push 0x1000
push 1
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2d8], 4
call fcn.0041a4c9
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x2cc], 5
call fcn.0040aa6e
lea ecx, [esp + 0x24]
call fcn.0041a324
lea ecx, [esp + 0x14]
call fcn.0041959f
lea eax, [esp + 0x194]
push eax
call fcn.0040ab54
mov byte [esp + 0x2c8], 6
push dword [esp + 0x188]
lea ecx, [esp + 0x2b4]
call fcn.004029a8
test eax, eax
jne 0x401e22
push dword [esp + 0x2a0]
push dword [esp + 0x17c]
call fcn.00432d5b
mov edi, eax
neg edi
pop ecx
sbb edi, edi
pop ecx
inc edi
lea esi, [esp + 0x194]
call fcn.0040af80
lea ecx, [esp + 0x24]
mov byte [esp + 0x2c8], 4
call fcn.0041a48b
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c8], 3
call fcn.0041970e
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004017b8
lea esi, [esp + 0x6c]
call fcn.0040af80
mov eax, edi
mov ecx, dword [esp + 0x2c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401e82
Capabilities:
Accept command line arguments

Disassembly:
push 4
mov eax, 0x448946
call fcn.00434949
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0xa1
mov ecx, esi
call fcn.0041846d
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CMainDlg.0
call fcn.0040167b
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], ebx
lea eax, [esi + 0x94]
push eax
mov byte [ebp - 4], 1
call fcn.00401123
lea eax, [esi + 0x1b0]
push eax
mov byte [ebp - 4], 2
call fcn.00403b17
lea edi, [esi + 0x310]
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.0041337f
mov dword [edi], vtable.CTabSheet.0
mov dword [edi + 0x114], ebx
mov dword [edi + 0x118], ebx
lea edi, [esi + 0x42c]
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.0041337f
mov dword [edi], vtable.CRichEditCtrl.0
lea edi, [esi + 0x480]
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.0041337f
mov dword [edi], vtable.CExplorer1.0
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x10], 3
mov edi, eax
jl 0x401f66
push str.delete
push dword [edi + 4]
call fcn.0042f6c2
test eax, eax
pop ecx
pop ecx
jne 0x401f66
push ebx
push ebx
push ebx
push ebx
push dword [edi + 8]
push 0x40203b
call fcn.0041b759
mov eax, esi
call fcn.00434a21
ret 4
Function at 0x4083eb
Capabilities:
Delete directory
Delete file

Disassembly:
push 0x34
mov eax, 0x448142
call fcn.00434949
xor esi, esi
mov dword [ebp - 4], esi
call fcn.00419238
push eax
lea ecx, [ebp - 0x14]
call fcn.004017d2
mov byte [ebp - 4], 1
call fcn.00419238
push eax
lea ecx, [ebp - 0x24]
call fcn.004017d2
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0041e14f
mov byte [ebp - 4], 3
mov edi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x14]
push str._s.
push eax
call fcn.00402b1b
mov ebx, dword [ebp - 0x14]
add esp, 0xc
push esi
push ebx
lea ecx, [ebp - 0x40]
call fcn.0041e1db
test eax, eax
je 0x4084d6
lea ecx, [ebp - 0x40]
call fcn.0041de68
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x20], eax
call fcn.0041e116
test eax, eax
jne 0x4084d0
mov eax, dword [ebp - 0x40]
push 0x10
lea ecx, [ebp - 0x40]
call dword [eax + 0x38]
test eax, eax
lea ecx, [ebp - 0x40]
je 0x4084b3
push 1
lea eax, [ebp - 0x18]
push eax
call fcn.0041e37a
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x452428
push eax
push ecx
mov byte [ebp - 4], 4
call fcn.00402a70
add esp, 0xc
call fcn.004083eb
pop ecx
pop ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x18]
jmp 0x4084c8
lea eax, [ebp - 0x1c]
push eax
inc esi
call fcn.0041e37a
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004017b8
cmp dword [ebp - 0x20], 0
jne 0x408456
lea ecx, [ebp - 0x40]
call fcn.0041dd98
cmp dword [ebp + 0xc], 0
je 0x4084eb
push edi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0041e173
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.004017b8
lea ecx, [ebx - 0x10]
call fcn.004017b8
lea ecx, [edi - 0x10]
call fcn.004017b8
mov eax, esi
call fcn.00434a21
ret

Function at 0x40853c
Capabilities:
Clear file content
Extract resource via kernel32 functions
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor esi, esi
push esi
push 0x80
push 2
push esi
push 1
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x408596
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor ecx, ecx
cmp eax, edi
setne cl
mov esi, ecx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004017b8
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.004017b8
pop edi
mov eax, esi
pop esi
leave
ret
movzx eax, word [ebp + 0xc]
push ebx
push dword [ebp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push ebx
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push esi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor esi, esi
inc esi
pop ebx
jmp 0x40857a
Function at 0x409520
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x45f774]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push esi
push 5
xor esi, esi
push esi
push esi
push eax
push str.open
push esi
mov dword [ebp - 0x80], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov dword [ebp - 0x7c], eax
ja 0x409631
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 0x78]
push eax
push 1
push esi
push str..htm
push SysReAllocString
call ebx
cmp eax, esi
jne 0x40962f
lea eax, [ebp - 0x78]
push eax
lea edi, [ebp - 0x74]
call fcn.0040939d
cmp eax, esi
jne 0x40962f
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
push str._shellopencommand
mov eax, edi
push eax
call esi
lea eax, [ebp - 0x78]
push eax
push 1
push 0
mov eax, edi
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x40962f
lea eax, [ebp - 0x78]
push eax
call fcn.0040939d
test eax, eax
jne 0x40962f
mov eax, edi
push str.__1_
push eax
call fcn.0042f892
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x409609
lea eax, [ebp - 0x74]
push 0x452fe0
push eax
call fcn.0042f892
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x409609
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea edi, [ebp + eax - 0x75]
jmp 0x40960c
mov byte [edi], 0
push 0x452fe4
push edi
call esi
push dword [ebp - 0x80]
push edi
call esi
call dword [0x460b40]
push 5
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov dword [ebp - 0x7c], eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x194]
mov eax, dword [ebp - 0x7c]
xor ecx, ebp
pop esi
call fcn.0042f15c
add ebp, 0x198
leave
ret 4
Function at 0x40a225
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x4481d9
call fcn.00434949
call fcn.00419238
push eax
lea ecx, [ebp - 0x10]
call fcn.004017d2
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x40a24e
push dword [ebp + 0xc]
jmp 0x40a255
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x10]
push 0x453348
push eax
call fcn.00402b1b
mov edi, dword [ebp - 0x10]
add esp, 0xc
push edi
push dword [ebp + 8]
lea eax, [esi + 0x280]
push eax
call fcn.00421838
lea ecx, [esi + 0x2ac]
mov eax, dword [ecx]
call dword [eax + 0x4c]
push dword [esi + 0x78]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0
push 1
push 0x8001
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [edi - 0x10]
call fcn.004017b8
call fcn.00434a21
ret 8