joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4158ca
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x51a230]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, 0x208
lea eax, [ebp - 0x20c]
push ebx
push 0
push eax
mov esi, ecx
call fcn.004bac70
lea eax, [esi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x415903
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x4eb140
push eax
call fcn.00407ea0
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41593b
lea eax, [ebp - 0x20c]
push eax
call fcn.00421975
pop ecx
push ebx
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.004bac70
push str.userconfig.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x4eb104
push eax
call fcn.00407ea0
lea eax, [ebp - 0x61c]
push eax
call fcn.004ca0fb
add esp, 0x20
lea ecx, [esi + 0x8c]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.00407d80
push ebx
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.004bac70
push str.Config.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x4eb104
push eax
call fcn.00407ea0
lea eax, [ebp - 0x824]
push eax
call fcn.004ca0fb
add esp, 0x20
lea ecx, [esi + 0xa4]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.00407d80
push ebx
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004bac70
lea eax, [ebp - 0xa44]
push str.XsfyPath
push eax
call fcn.00421c7f
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x415a02
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x414]
push 0x4ea730
push eax
call fcn.00407ea0
add esp, 0xc
lea ecx, [ebp - 0xa44]
call fcn.00407230
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x415a40
lea eax, [ebp - 0x414]
push eax
call fcn.00421975
pop ecx
push ebx
lea eax, [ebp - 0xa2c]
push 0
push eax
call fcn.004bac70
push str.Config.ini
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push 0x4eb104
push eax
call fcn.00407ea0
lea eax, [ebp - 0xa2c]
push eax
call fcn.004ca0fb
add esp, 0x20
lea ecx, [esi + 0xbc]
push eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.00407d80
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00490604
leave
ret
Function at 0x415a9c
Capabilities:
Check if file exists

Disassembly:
push 0x90
mov eax, 0x4e2696
call fcn.004908c5
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push eax
call fcn.0040c180
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp - 0x30], edi
jne 0x415add
mov ecx, esi
call fcn.00414b81
mov esi, eax
push esi
call fcn.004ca0fb
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.00407d80
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x40]
push eax
call esi
test eax, eax
je 0x415c84
push str.HaoKanWallPaper.exe
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0041474a
add esp, 0xc
cmp dword [ebp - 0x74], 8
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x88]
push eax
call esi
test eax, eax
je 0x415b35
xor edi, edi
inc edi
jmp 0x415c79
lea eax, [ebp - 0x70]
push str.9755104754656314543663180836632607635531116508026850084024582929
push eax
call fcn.00421613
pop ecx
pop ecx
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x8c], edi
push 0x4ea524
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.0040c180
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
cmovae eax, dword [ebp - 0x70]
push eax
call fcn.0040c180
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0041c3cd
add esp, 0xc
lea ecx, [ebp - 0x58]
call fcn.00407230
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00407230
mov esi, dword [ebp - 0x94]
jmp 0x415c48
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x415bc4
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x58]
call fcn.0040c180
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
push 1
push edi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 7
push eax
sub esp, 0x18
lea eax, [ebp - 0x58]
mov ecx, esp
mov dword [ebp - 0x98], esp
push eax
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.004164bb
sub esp, 0x18
mov byte [ebp - 4], 8
mov ecx, esp
lea eax, [ebp - 0x40]
push eax
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.004164bb
mov byte [ebp - 4], 7
call fcn.0041a695
mov eax, dword [ebp - 0x18]
add esp, 0x3c
sub eax, dword [ebp - 0x1c]
cdq
push 0x18
pop ecx
idiv ecx
lea ecx, [ebp - 0x1c]
test eax, eax
jne 0x415c56
call fcn.00416594
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.00407230
push 0x18
pop eax
add esi, eax
cmp esi, dword [ebp - 0x90]
jne 0x415bba
jmp 0x415c66
call fcn.00416594
lea ecx, [ebp - 0x58]
call fcn.00407230
xor edi, edi
inc edi
lea ecx, [ebp - 0x94]
call fcn.00416594
lea ecx, [ebp - 0x70]
call fcn.00407230
lea ecx, [ebp - 0x88]
call fcn.00407230
lea ecx, [ebp - 0x40]
call fcn.00407230
mov eax, edi
call fcn.00490880
ret 4
Function at 0x415fe0
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x4e26d4
call fcn.004908c5
mov ebx, ecx
call fcn.00414b81
mov esi, eax
push esi
call fcn.004ca0fb
pop ecx
push eax
lea edi, [ebx + 0xd4]
push esi
mov ecx, edi
call fcn.00407d80
mov esi, str.HaoKanWallPaper.cfg
push esi
call fcn.004ca0fb
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00410290
push str.hkbzgf
push 0x4eb1ec
push str.AppInfo
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.00414c54
and dword [ebp - 4], 0
lea eax, [ebp - 0x248]
lea esi, [ebx + 0xec]
push eax
mov ecx, esi
call fcn.00414b0c
push str.hkbzgf
mov ecx, esi
call fcn.00416566
test al, al
je 0x4160c7
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004bac70
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x416086
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.hkbzgf
push eax
push edi
push 0x4eb1ec
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.004ca0fb
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00407d80
jmp 0x4160cc
mov edi, str.hkbzgf
push edi
mov ecx, esi
call fcn.00416566
test al, al
je 0x41618c
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004bac70
and dword [ebp - 0x220], 0
lea eax, [ebx + 0x5c]
and dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x230]
add esp, 0xc
push eax
call fcn.004164bb
push str.HaoKanWallPaper.cfg
mov byte [ebp - 4], 1
call fcn.004ca0fb
pop ecx
push eax
push str.HaoKanWallPaper.cfg
lea ecx, [ebp - 0x230]
call fcn.00410290
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push 0x4eb1ec
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.004ca0fb
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00407d80
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00407230
push edi
mov ecx, esi
call fcn.00416566
test al, al
je 0x4161c4
push edi
push 0x4eb1ec
push str.AppInfo
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.00414d8c
push eax
mov ecx, esi
call fcn.00414ae3
lea ecx, [ebp - 0x230]
call fcn.00407230
lea ecx, [ebp - 0x248]
call fcn.00407230
call fcn.00490880
ret

Function at 0x41735b
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
mov dword [esi + 4], eax
pop esi
pop ebp
ret 4

Function at 0x418495
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x418c78
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push str.337ff0efabed8556b9a9860eda2ec45a
mov dword [ebp - 4], esi
call fcn.004ca120
mov edi, dword [ebp + 0xc]
mov edx, eax
mov ebx, dword [ebp + 8]
pop ecx
mov ecx, esi
test edi, edi
je 0x418cb3
mov al, byte [esi + str.337ff0efabed8556b9a9860eda2ec45a]
xor byte [ecx + ebx], al
inc esi
xor eax, eax
cmp esi, edx
cmovge esi, eax
inc ecx
cmp ecx, edi
jb 0x418c9d
lea eax, [ebp - 4]
push eax
push edi
push ebx
call fcn.00401090
test eax, eax
je 0x418cd5
mov edx, dword [ebp - 4]
test edx, edx
je 0x418cd5
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x418cdf
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x418fb1
Capabilities:
Create directory

Disassembly:
push 0x49c
mov eax, 0x4e29e0
call fcn.004908c5
mov ebx, ecx
mov edi, dword [ebp + 8]
test edi, edi
jne 0x418fd0
xor eax, eax
jmp 0x41914c
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.004bac70
lea eax, [ebp - 0x110]
push edi
push eax
call fcn.004ca6e0
push edi
xor esi, esi
call fcn.004ca120
mov edi, eax
mov dword [ebp - 0x214], 7
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x218], ecx
mov word [ebp - 0x228], ax
push 0x100
push ecx
lea eax, [ebp - 0x210]
mov dword [ebp - 4], ecx
push eax
call fcn.004bac70
add esp, 0x24
cmp byte [ebp + edi - 0x111], 0x5c
je 0x41903f
mov byte [ebp + edi - 0x110], 0x5c
cmp byte [ebp - 0x110], 0
je 0x41913e
mov al, byte [ebp + esi - 0x110]
cmp al, 0x3a
jne 0x41905f
push 2
pop eax
jmp 0x41912e
cmp al, 0x5c
jne 0x41912b
push esi
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004ba170
add esp, 0xc
cmp esi, 0x100
jae 0x419164
lea eax, [ebp - 0x210]
mov byte [ebp + esi - 0x210], 0
push eax
lea ecx, [ebp - 0x240]
call fcn.0041485a
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x258]
mov ecx, ebx
push eax
call fcn.004196c7
push eax
lea ecx, [ebp - 0x228]
call fcn.00414ae3
lea ecx, [ebp - 0x258]
call fcn.00407230
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0
call fcn.0040c3c0
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x4a8]
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x41912b
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
push 0
cmovae eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x419154
xor eax, eax
inc eax
add esi, eax
cmp byte [ebp + esi - 0x110], 0
jne 0x41904c
lea ecx, [ebp - 0x228]
call fcn.00407230
xor eax, eax
inc eax
call fcn.00490880
ret 4
lea ecx, [ebp - 0x228]
call fcn.00407230
jmp 0x418fc9
call fcn.00490749
int3
Function at 0x419699
Capabilities:
Create thread

Disassembly:
mov edx, dword [ecx + 0x300]
or eax, 0xffffffff
cmp edx, eax
je 0x4196ab
cmp edx, 1
jne 0x4196c6
xor eax, eax
push eax
push eax
push ecx
push 0x419439
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret
Function at 0x41a695
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x4ac
mov eax, 0x4e2b17
call fcn.004908c5
mov esi, dword [ebp + 0x38]
xor eax, eax
lea ecx, [ebp - 0x260]
inc eax
push 0x4ea437
mov dword [ebp - 4], eax
call fcn.0041485a
push 0x208
xor ebx, ebx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004bac70
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004ca068
lea eax, [ebp - 0x218]
push 0x4eb520
push eax
call fcn.004ca068
add esp, 0x1c
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41a8fa
test byte [ebp - 0x4b0], 0x10
lea eax, [ebp - 0x484]
lea ecx, [ebp - 0x230]
push eax
je 0x41a827
call fcn.0040c180
push 0x4ea5ec
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 3
call fcn.00416566
test al, al
jne 0x41a8ce
push 0x4eb528
lea ecx, [ebp - 0x230]
call fcn.00416566
test al, al
jne 0x41a8ce
lea eax, [ebp + 8]
mov dword [ebp - 0x238], ebx
push eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], ebx
call fcn.004164bb
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x248]
push eax
mov byte [ebp - 4], 4
call fcn.00410290
push 0x4eb0a8
call fcn.004ca0fb
pop ecx
push eax
push 0x4eb0a8
lea ecx, [ebp - 0x248]
call fcn.00410290
cmp dword [ebp + 0x3c], 0
jne 0x41a8c3
push ebx
push ebx
push esi
sub esp, 0x18
lea eax, [ebp + 0x20]
mov ecx, esp
mov dword [ebp - 0x4b4], esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.004164bb
sub esp, 0x18
mov byte [ebp - 4], 5
mov ecx, esp
lea eax, [ebp - 0x248]
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.004164bb
mov byte [ebp - 4], 4
call fcn.0041a695
add esp, 0x3c
jmp 0x41a8c3
call fcn.0040c180
cmp dword [ebp + 0x34], 8
lea eax, [ebp + 0x20]
push ebx
cmovae eax, dword [ebp + 0x20]
lea ecx, [ebp - 0x230]
push eax
mov byte [ebp - 4], 6
call fcn.00410600
cmp eax, 0xffffffff
mov ecx, ebx
push 1
pop eax
cmovne ecx, eax
test ecx, ecx
je 0x41a8ce
lea eax, [ebp + 8]
mov dword [ebp - 0x238], ebx
push eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], ebx
call fcn.004164bb
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x248]
push eax
mov byte [ebp - 4], 8
call fcn.00410290
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x41a8b4
lea eax, [ebp - 0x248]
mov ecx, esi
push eax
call fcn.00419f89
jmp 0x41a8c3
lea ecx, [ebp - 0x248]
push ecx
push eax
mov ecx, esi
call fcn.00419fab
lea ecx, [ebp - 0x248]
call fcn.00407230
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.00407230
lea eax, [ebp - 0x4b0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41a720
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x260]
call fcn.0040c3c0
lea ecx, [ebp + 8]
call fcn.00407230
lea ecx, [ebp + 0x20]
call fcn.00407230
call fcn.00490880
ret
Function at 0x41a91b
Capabilities:
Check if file exists
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41a92d
pop ebp
ret
push esi
push edi
xor esi, esi
push esi
push 0x80
push 4
push esi
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41a962
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x41a968
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x51a230]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x61c]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x208
push esi
push 0
push eax
mov dword [ebp - 0x620], ebx
call fcn.004bac70
push esi
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004bac70
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.004ca0d9
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.004ca0d9
lea eax, [ebp - 0x61c]
push eax
call fcn.004cae01
lea eax, [ebp - 0x414]
push eax
call fcn.004cae01
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.004ca099
add esp, 0x38
test eax, eax
je 0x41aabc
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41aabc
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor esi, esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004bac70
add esp, 0xc
lea eax, [ebp - 0x20c]
test esi, esi
jne 0x41aa45
push edi
push str._s.bak
push eax
call fcn.00407ea0
add esp, 0xc
jmp 0x41aa55
push esi
push edi
push str._s.bak_d
push eax
call fcn.00407ea0
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41aa73
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.004caea4
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push edi
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 5
test eax, eax
lea eax, [ebp - 0x20c]
push 0
push eax
jne 0x41aaba
call ebx
cmp esi, 0xa
jge 0x41aabc
inc esi
jmp 0x41aa14
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00490604
leave
ret

Function at 0x41b46f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call fcn.004bac70
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], 0x200
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x28], eax
call fcn.0042292b
test eax, eax
mov ecx, str.runas
cmovne ecx, dword [ebp - 0x30]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x41b4cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
inc eax
leave
ret
Function at 0x41b69a
Capabilities:
Enumerate processes

Disassembly:
push 0x260
mov eax, 0x4e2c42
call fcn.004908c5
mov eax, dword [ebp + 8]
test eax, eax
je 0x41b75f
push eax
lea ecx, [ebp - 0x40]
call fcn.0040c180
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0041c5ea
mov edi, 0x22c
lea eax, [ebp - 0x26c]
push edi
push ebx
push eax
call fcn.004bac70
add esp, 0x10
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x41b755
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x41b74a
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040c180
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0041c5ea
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00416536
test al, al
jne 0x41b765
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00407230
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41b705
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.00407230
mov eax, ebx
call fcn.00490880
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x264]
lea ecx, [ebp - 0x28]
call fcn.00407230
jmp 0x41b755
Function at 0x41bee1
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x51a230]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41c025
push ebx
push edi
xor edi, edi
xor ebx, ebx
push edi
push 0x80
push 4
push edi
inc ebx
mov dword [ebp - 0x10c], edi
push ebx
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41bf42
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10c], eax
jmp 0x41bf48
mov eax, dword [ebp - 0x10c]
lea esi, [eax + 1]
push esi
call fcn.00490862
and dword [ebp - 0x11c], 0
pop ecx
push 0
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x118], eax
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004bac70
lea eax, [ebp - 0x108]
push str.3c2904a5ac8f0eb4731c39df4b666116
push eax
call fcn.004ca6e0
lea eax, [ebp - 0x108]
push eax
call fcn.004ca120
mov edi, dword [ebp - 0x10c]
add esp, 0x18
mov dword [ebp - 0x114], eax
xor eax, eax
mov dword [ebp - 0x110], eax
test edi, edi
jle 0x41c013
mov edx, dword [ebp - 0x118]
mov cl, byte [ebp - 0x108]
cmp byte [edx], cl
jne 0x41c007
xor ecx, ecx
xor esi, esi
cmp dword [ebp - 0x114], ecx
jle 0x41c001
mov al, byte [edx + ecx]
cmp al, byte [ebp + ecx - 0x108]
jne 0x41bffb
mov eax, dword [ebp - 0x114]
inc esi
cmp esi, eax
je 0x41c015
inc ecx
cmp ecx, eax
jl 0x41bfdf
mov eax, dword [ebp - 0x110]
mov cl, byte [ebp - 0x108]
inc eax
inc edx
mov dword [ebp - 0x110], eax
cmp eax, edi
jl 0x41bfcf
xor ebx, ebx
push dword [ebp - 0x118]
call fcn.00490615
pop ecx
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00490604
leave
ret
Function at 0x41ed5f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x4e3177
call fcn.00490891
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00421475
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.004214a9
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x41ed9f
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41edff
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x41edda
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41edff
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.00421488
call fcn.0049086b
ret 0xc
Function at 0x41f224
Capabilities:
Get common file path

Disassembly:
push 0x240
mov eax, 0x4e3212
call fcn.004908c5
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor esi, esi
mov dword [ebp - 0x24c], edi
push esi
push eax
call fcn.004bac70
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x19
push eax
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call esi
test eax, eax
je 0x41f2e2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040c180
and dword [ebp - 4], 0
push 0x4eb0a8
call fcn.004ca0fb
pop ecx
push eax
push 0x4eb0a8
lea ecx, [ebp - 0x230]
call fcn.00410290
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push edi
cmovae eax, dword [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.0041eee8
mov edi, eax
lea ecx, [ebp - 0x230]
test edi, edi
je 0x41f2d3
call fcn.00407230
mov eax, edi
jmp 0x41f35b
or dword [ebp - 4], 0xffffffff
call fcn.00407230
mov edi, dword [ebp - 0x24c]
push 0
push 0x10
lea eax, [ebp - 0x218]
push eax
push 0
call esi
test eax, eax
je 0x41f359
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040c180
mov esi, 0x4eb0a8
mov dword [ebp - 4], 1
push esi
call fcn.004ca0fb
pop ecx
push eax
push esi
lea ecx, [ebp - 0x248]
call fcn.00410290
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push edi
cmovae eax, dword [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.0041eee8
lea ecx, [ebp - 0x248]
mov esi, eax
call fcn.00407230
test esi, esi
je 0x41f359
mov eax, esi
jmp 0x41f35b
xor eax, eax
call fcn.00490880
ret 4