joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421782
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x421808
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
mov esi, dword [ebp + 0x14]
test eax, eax
je 0x4217f3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
test esi, 0x100
ja 0x4217e5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [ebp - 8]
push eax
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and esi, 0x27
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
pop edi
leave
ret 0x10

Function at 0x421eb4
Capabilities:
Create directory

Disassembly:
push 8
mov eax, 0x4b3fd6
call fcn.0048501f
push dword [ebp + 8]
call fcn.0041de64
pop ecx
test eax, eax
je 0x421ed5
xor eax, eax
call fcn.004850f7
ret
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.00421dd4
mov edi, dword [ebp - 0x14]
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.0041deaa
push 0x5c
push edi
call fcn.00487408
add esp, 0xc
cmp eax, esi
jne 0x421f0b
push 0xf
pop esi
push edi
call fcn.0048540f
pop ecx
mov eax, esi
jmp 0x421ecf
xor ecx, ecx
push edi
mov word [eax], cx
call fcn.00421eb4
pop ecx
cmp eax, esi
je 0x421f1f
mov esi, eax
jmp 0x421f00
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x421f00
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x421f1b
jmp 0x421f00

Function at 0x4223b5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, ecx
mov dword [esi], ebx
mov dword [ebp + 0x10], eax
cmp dword [edi + 0x1444], ebx
jne 0x4223d8
push 6
pop eax
jmp 0x42244a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov dword [ebp + 8], ebx
cmp dword [edi + 0x1448], 0
jne 0x422451
mov eax, dword [ebp + 0xc]
sub eax, dword [esi]
mov ebx, 0x4e20
cmp eax, ebx
ja 0x4223fd
mov ebx, eax
call fcn.0041dfb0
lea ecx, [ebp + 8]
push ecx
push ebx
push dword [ebp + 0x10]
push dword [edi + 0x1444]
call dword [eax + 0x10]
test eax, eax
je 0x422458
mov ecx, dword [ebp + 8]
add dword [esi], ecx
add dword [ebp + 0x10], ecx
lea eax, [edi + 0x1458]
add dword [eax], ecx
adc dword [eax + 4], 0
test ecx, ecx
jbe 0x422436
mov eax, dword [ebp + 0xc]
cmp dword [esi], eax
jb 0x4223e4
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [ebp - 4]
cmp eax, 1
jb 0x422448
call esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, 0x4c7
jmp 0x42244a
mov ecx, edi
call fcn.0041e2cd
jmp 0x42244a
Function at 0x422518
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x4b4084
call fcn.0048501f
mov esi, dword [ebp + 0x214]
xor ebx, ebx
mov edi, ecx
cmp word [esi], bx
jne 0x4225a9
call fcn.0041e089
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x42258e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00484247
add ebp, 0x20c
leave
ret 4
lea esi, [edi + 0x1460]
push esi
push ebx
push 0x4c0edc
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x422563
lea ecx, [ebp - 0x14]
call fcn.00421db5
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.00421dd4
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 1
call fcn.0041decc
push dword [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.0048540f
push dword [ebp - 0x14]
call fcn.00421eb4
add esp, 0x14
cmp eax, ebx
je 0x4225fb
mov ebx, eax
push dword [ebp - 0x14]
call fcn.0048540f
pop ecx
mov eax, ebx
jmp 0x422569
mov ecx, edi
call fcn.0041e075
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x1668], eax
cmp eax, 0xffffffff
jne 0x4225eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4225e9
Function at 0x422713
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0xc], 0
or dword [esi + 8], 0xffffffff
test ebx, ebx
jne 0x42273d
xor eax, eax
jmp 0x422802
push edi
call fcn.0041e624
and dword [ebp - 0x10], 0
mov ecx, dword [ebp + 8]
lea edi, [esi + 0x10]
mov dword [ebp - 0x14], 0x12
mov eax, dword [ebp - 0x10]
xor edx, edx
div ebx
inc dword [ebp - 0x10]
mov al, byte [edx + ecx]
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x10]
xor edx, edx
div ebx
inc dword [ebp - 0x10]
mov al, byte [edx + ecx]
mov byte [ebp - 6], al
mov eax, dword [ebp - 0x10]
xor edx, edx
div ebx
inc dword [ebp - 0x10]
mov al, byte [edx + ecx]
mov byte [ebp - 7], al
mov eax, dword [ebp - 0x10]
xor edx, edx
div ebx
inc dword [ebp - 0x10]
mov al, byte [edx + ecx]
mov byte [ebp - 8], al
mov eax, dword [ebp - 8]
xor dword [edi], eax
add edi, 4
dec dword [ebp - 0x14]
jne 0x422754
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push 9
lea edi, [esi + 0x14]
pop ebx
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00420eb2
mov eax, dword [ebp - 0xc]
mov dword [edi - 4], eax
mov eax, dword [ebp - 8]
mov dword [edi], eax
add edi, 8
dec ebx
jne 0x4227af
lea edi, [esi + 0x5c]
mov dword [ebp - 0x14], 4
mov ebx, 0x80
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00420eb2
mov eax, dword [ebp - 0xc]
mov dword [edi - 4], eax
mov eax, dword [ebp - 8]
mov dword [edi], eax
add edi, 8
dec ebx
jne 0x4227da
dec dword [ebp - 0x14]
jne 0x4227d5
xor eax, eax
inc eax
mov dword [esi + 0xc], eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00484247
leave
ret 8
Function at 0x4238b9
Capabilities:
Check http status code

Disassembly:
push 0xc
mov eax, 0x4b428b
call fcn.0048501f
mov esi, ecx
mov ebx, dword [ebp + 0x18]
xor edi, edi
mov dword [ebx], edi
call fcn.0041e02c
cmp dword [esi + 0x1440], edi
jne 0x4238e6
push 6
pop eax
call fcn.004850f7
ret 0x14
cmp dword [esi + 0x142c], 3
je 0x4238f3
push 0x57
jmp 0x4238dd
lea ecx, [ebp - 0x18]
call fcn.00421db5
push dword [ebp + 0x14]
lea eax, [esi + 0x224]
push eax
lea eax, [ebp - 0x18]
push str._s_s
push eax
mov dword [ebp - 4], edi
call fcn.0041dcb4
or dword [esi + 0x1430], 0x400000
mov eax, dword [esi + 0x1430]
add esp, 0x10
cmp dword [esi + 0x1428], 4
jne 0x42393d
or eax, 0x800000
mov dword [esi + 0x1430], eax
call fcn.0041dfb0
push edi
push dword [esi + 0x1430]
push edi
push edi
push 0x4cd690
push dword [ebp - 0x18]
push dword [ebp + 8]
push dword [esi + 0x1440]
call dword [eax + 0x28]
mov dword [esi + 0x1444], eax
cmp eax, edi
jne 0x423982
mov ecx, esi
call fcn.0041e2cd
mov edi, eax
push dword [ebp - 0x18]
call fcn.0048540f
pop ecx
mov eax, edi
jmp 0x4238de
mov eax, dword [esi + 0x1c]
lea ecx, [ebp + 0x18]
push ecx
push eax
mov ecx, esi
call fcn.0041e2e2
test eax, eax
je 0x423969
call fcn.0041dfb0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push edi
push dword [esi + 0x1444]
call dword [eax + 0x2c]
test eax, eax
je 0x423969
push ebx
push 0x13
mov ecx, esi
call fcn.00422361
cmp eax, edi
jne 0x423970
cmp dword [ebp + 0x18], edi
je 0x4239d1
cmp dword [ebx], 0xce
je 0x4239d9
mov edi, 0x2f78
jmp 0x423972
cmp dword [ebx], 0xc8
jmp 0x4239c8
lea eax, [ebp - 0x10]
push eax
push 5
mov ecx, esi
call fcn.00422361
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x1450], eax
mov dword [esi + 0x1454], edi
jmp 0x423972

Function at 0x423dda
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
test byte [ebp + 0x10], 0x80
je 0x423de9
pop ebp
jmp method.Cabinet::CExtract.virtual_20
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0x18]

Function at 0x423e5c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
lea ecx, [esi + 0x48]
call fcn.00421c45
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
test eax, eax
jl 0x423e8a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
test eax, eax
jle 0x423e92
add dword [edi + 4], eax
jmp 0x423e92
call fcn.00488813
add esp, 0xc
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x42452f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00488813
mov esi, eax
add esp, 0xc
cmp esi, dword [ebp + 0x10]
je 0x424557
call fcn.004894d1
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, esi
pop esi
pop ebp
ret 0x10
Function at 0x42493f
Capabilities:
Delete file

Disassembly:
push 0x24
mov eax, 0x4b44de
call fcn.0048501f
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x1108], eax
je 0x424978
and dword [esi + 0x10e8], 0
add esi, 0x10cc
and dword [esi + 0x20], 0
mov dword [esi + 0x18], 0x3f3
jmp 0x424b5a
xor edi, edi
cmp dword [esi + 0x10f0], edi
je 0x424b5a
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 8]
mov dword [esi + 0x1104], eax
mov dword [esi + 0x10f4], edi
call fcn.00421638
lea ebx, [esi + 0x10cc]
mov ecx, ebx
mov dword [ebp - 0x10], ebx
call fcn.0041e36c
push dword [ebp + 0xc]
mov dword [esi + 0x4c], edi
lea edi, [esi + 0x58]
mov ecx, edi
call fcn.0041dbd5
push edi
call fcn.0041de81
mov dword [esp], 0x4c10f4
push dword [edi]
call fcn.00484833
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
lea ecx, [ebp - 0x30]
mov dword [esi + 0x10f8], eax
call fcn.00421db5
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00421db5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0041decc
add esp, 0xc
mov ecx, edi
call fcn.0041daea
cmp eax, 3
jb 0x424b39
lea ecx, [ebp - 0x30]
call fcn.0041daea
cmp eax, 2
jb 0x424b39
lea ecx, [ebp - 0x18]
call fcn.0041daea
cmp eax, 2
jb 0x424b39
lea edi, [esi + 0x60]
mov eax, dword [edi]
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x28]
call fcn.00421d98
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00421d98
mov ebx, 0x423d51
jmp 0x424aa5
mov ecx, edi
call fcn.0041daea
test eax, eax
je 0x424adc
push edi
lea ecx, [ebp - 0x18]
call fcn.0041dbd5
push dword [ebp - 0x20]
call fcn.0048540f
push dword [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0048540f
mov eax, dword [edi]
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x28]
call fcn.00421d98
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00421d98
push dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
push 0
push ebx
push 0
push dword [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.0041da92
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
call fcn.0041da92
push eax
push dword [esi + 0x10f0]
call dword [esi + 0x1114]
add esp, 0x1c
test eax, eax
jne 0x424a60
push dword [ebp - 0x20]
call fcn.0048540f
push dword [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0048540f
pop ecx
pop ecx
push dword [esi + 8]
mov ecx, esi
call fcn.00422b8c
cmp dword [esi + 0x10f4], 0
je 0x424b14
cmp dword [esi + 8], 0
je 0x424b14
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x10]
call fcn.0041e39c
push dword [ebp - 0x18]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call fcn.0048540f
push dword [ebp - 0x30]
call fcn.0048540f
pop ecx
pop ecx
mov eax, esi
jmp 0x424b5c
push dword [ebp - 0x18]
and dword [ebx + 0x1c], 0
and dword [ebx + 0x20], 0
mov dword [ebx + 0x18], 0x3ea
call fcn.0048540f
push dword [ebp - 0x30]
call fcn.0048540f
pop ecx
pop ecx
xor eax, eax
call fcn.004850f7
ret 0xc
Function at 0x424df7
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ebp, ebp
cmp dword [esi + 0x1108], eax
je 0x424e25
lea eax, [esi + 0x10cc]
mov dword [eax + 0x18], 0x3f3
mov dword [eax + 0x1c], ebp
mov dword [eax + 0x20], ebp
xor eax, eax
jmp 0x424f61
mov eax, dword [0x4ec054]
cmp eax, 0xffffffff
je 0x424e49
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebp
je 0x424e49
lea eax, [esi + 0x10cc]
mov dword [eax + 0x18], 0x3f4
jmp 0x424e18
push esi
push 1
call fcn.00421656
pop ecx
pop ecx
test eax, eax
jne 0x424e69
lea eax, [esi + 0x10cc]
mov dword [eax + 0x18], ebp
mov dword [eax + 0x1c], 0xe
jmp 0x424e1b
push ebx
lea ebx, [esi + 0x10cc]
mov ecx, ebx
call fcn.0041e36c
cmp dword [esi + 0x10f0], ebp
jne 0x424f1e
cmp dword [esi + 0x110c], ebp
jne 0x424f22
push edi
push str.Cabinet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICreate
push eax
mov dword [esi + 0x110c], eax
call edi
push str.FDICopy
push dword [esi + 0x110c]
mov dword [esi + 0x1110], eax
call edi
push str.FDIIsCabinet
push dword [esi + 0x110c]
mov dword [esi + 0x1114], eax
call edi
push str.FDIDestroy
push dword [esi + 0x110c]
mov dword [esi + 0x1118], eax
call edi
mov dword [esi + 0x111c], eax
pop edi
cmp dword [esi + 0x1110], ebp
je 0x424f0b
cmp dword [esi + 0x1114], ebp
je 0x424f0b
cmp dword [esi + 0x1118], ebp
je 0x424f0b
cmp eax, ebp
jne 0x424f22
mov dword [esi + 0x110c], ebp
mov dword [ebx + 0x18], 0x3e8
mov dword [ebx + 0x1c], ebp
mov dword [ebx + 0x20], ebp
xor eax, eax
jmp 0x424f60
push ebx
push 1
push 0x423d28
push fcn.00423d07
push 0x422985
push 0x423cde
push 0x424c05
push 0x42168b
push 0x421686
call dword [esi + 0x1110]
xor ecx, ecx
add esp, 0x24
cmp eax, ebp
setne cl
mov dword [esi + 0x10f0], eax
mov eax, ecx
pop ebx
pop esi
pop ebp
ret
Function at 0x4256b1
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 4
mov eax, 0x4b468e
call fcn.0048501f
mov esi, ecx
xor edi, edi
xor eax, eax
cmp dword [esi], edi
je 0x4256e5
inc eax
jmp 0x425856
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push edi
push eax
call fcn.00484150
add esp, 0xc
push 0x104
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040b680
push str._system32wininet.dll
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.0041cb8c
push dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call edi
mov ebx, eax
test ebx, ebx
jne 0x425740
push str.wininet.dll
call edi
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4c1614
push ebx
call edi
push 0x4c1600
push ebx
mov dword [esi + 4], eax
call edi
push 0x4c15ec
push ebx
mov dword [esi + 8], eax
call edi
push 0x4c15d8
push ebx
mov dword [esi + 0xc], eax
call edi
push 0x4c15c4
push ebx
mov dword [esi + 0x10], eax
call edi
push str.InternetGetLastResponseInfoW
push ebx
mov dword [esi + 0x14], eax
call edi
push 0x4c1588
push ebx
mov dword [esi + 0x18], eax
call edi
push 0x4c1574
push ebx
mov dword [esi + 0x1c], eax
call edi
push str.HttpAddRequestHeadersW
push ebx
mov dword [esi + 0x20], eax
call edi
push 0x4c1548
push ebx
mov dword [esi + 0x24], eax
call edi
push 0x4c1534
push ebx
mov dword [esi + 0x28], eax
call edi
push 0x4c1524
push ebx
mov dword [esi + 0x2c], eax
call edi
push str.FtpOpenFileW
push ebx
mov dword [esi + 0x30], eax
call edi
push str.FtpCommandW
push ebx
mov dword [esi + 0x34], eax
call edi
push str.FtpGetFileSize
push ebx
mov dword [esi + 0x38], eax
call edi
xor ecx, ecx
mov dword [esi + 0x3c], eax
cmp dword [esi + 4], ecx
je 0x425849
cmp dword [esi + 8], ecx
je 0x425849
cmp dword [esi + 0xc], ecx
je 0x425849
cmp dword [esi + 0x10], ecx
je 0x425849
cmp dword [esi + 0x14], ecx
je 0x425849
cmp dword [esi + 0x18], ecx
je 0x425849
cmp dword [esi + 0x1c], ecx
je 0x425849
cmp dword [esi + 0x20], ecx
je 0x425849
cmp dword [esi + 0x24], ecx
je 0x425849
cmp dword [esi + 0x28], ecx
je 0x425849
cmp dword [esi + 0x2c], ecx
je 0x425849
cmp dword [esi + 0x30], ecx
je 0x425849
cmp dword [esi + 0x34], ecx
je 0x425849
cmp dword [esi + 0x38], ecx
je 0x425849
cmp eax, ecx
je 0x425849
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040dd20
xor eax, eax
jmp 0x4256df
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040dd20
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00484247
add ebp, 0x20c
leave
ret
Function at 0x42880b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [ebp + 8]
push ebx
push esi
mov esi, dword [0x4ecd30]
push edi
push dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
xor edi, edi
cmp ebx, edi
jne 0x428836
xor eax, eax
jmp 0x4288d9
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x42882f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp ebx, edi
je 0x42882f
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, edi
jne 0x428873
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x42882f
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
jne 0x428888
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
jmp 0x42886b
push dword [ebp - 4]
push ebx
push eax
call fcn.0048a200
add esp, 0xc
push esi
mov dword [ebp + 8], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp + 8]
xor ebx, ebx
call fcn.00428417
push eax
push edi
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x4288c3
push edi
push dword [ebp + 8]
call fcn.00428301
pop ecx
pop ecx
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x4288d7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x428bd4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0xc]
xor esi, esi
push esi
call fcn.0042842d
cmp dword [ebp + 8], esi
jne 0x428bf2
xor eax, eax
jmp 0x428c11
push ebx
push esi
push esi
push 3
push esi
push esi
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x428c16
xor eax, eax
pop ebx
pop esi
leave
ret 8
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp dword [ebp - 8], esi
jle 0x428c31
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x428c10
push edi
push dword [ebp - 0xc]
call fcn.00485272
mov edi, eax
pop ecx
cmp edi, esi
je 0x428c6c
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp - 0xc]
mov dword [ebp + 8], esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push dword [ebp - 0xc]
push edi
call fcn.00428b21
push edi
mov esi, eax
call fcn.004845fc
pop ecx
pop edi
jmp 0x428c26
Function at 0x42d07b
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4c20c8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4c20cc]
mov dword [ebp - 8], eax
mov ax, word [ebp + 8]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x42d0b8
xor eax, eax
xor edx, edx
jmp 0x42d0e4
push 8
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00484150
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x42d0b2
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484247
leave
ret 4

Function at 0x42dd7e
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x1fa4]
mov eax, 0x2024
call fcn.00484950
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x1fa0], eax
push esi
mov esi, dword [ebp + 0x1fac]
test esi, esi
jne 0x42ddac
xor eax, eax
jmp 0x42de22
push 0x1e
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00484150
push 0x2000
lea eax, [ebp - 0x60]
push 0
push eax
mov dword [ebp - 0x7c], 3
call fcn.00484150
mov eax, 0x1000
push eax
push esi
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0048533c
lea eax, [ebp - 0x60]
push eax
call fcn.00484927
xor ecx, ecx
mov word [ebp + eax*2 - 0x60], cx
lea eax, [ebp - 0x60]
push eax
call fcn.00484927
xor ecx, ecx
mov word [ebp + eax*2 - 0x5e], cx
lea eax, [ebp - 0x60]
mov dword [ebp - 0x78], eax
mov eax, 0x614
mov word [ebp - 0x70], ax
add esp, 0x30
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp + 0x1fa0]
xor ecx, ebp
pop esi
call fcn.00484247
add ebp, 0x1fa4
leave
ret

Function at 0x42df88
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
test eax, eax
jne 0x42dfac
xor eax, eax
jmp 0x42e01a
cmp eax, 0x104
jg 0x42dfa8
push 0x410
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00484150
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0x2710
push 0x4c2188
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp word [ebp - 0x414], 0
je 0x42dfa8
lea eax, [ebp - 0x414]
push 0x4c2184
push eax
call fcn.0048a95e
pop ecx
pop ecx
test eax, eax
je 0x42dfa8
push eax
call fcn.0048a81c
pop ecx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00484247
leave
ret 4
Function at 0x42f2d3
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x4b5515
call fcn.0048501f
mov dword [ebp - 0x14], ecx
xor ebx, ebx
push 0x5c
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.0042e769
push 0x4ce4dc
lea ecx, [ebp + 8]
call fcn.0041cb8c
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
jle 0x42f363
push ebx
lea ecx, [ebp + 8]
call fcn.0042e1e4
cmp ax, 0x5c
jne 0x42f35a
push ebx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.0041a88c
mov esi, dword [ebp - 0x10]
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42f34e
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov edi, eax
test edi, edi
jne 0x42f367
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
call fcn.0042f254
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0
call fcn.0040dd20
mov eax, dword [ebp + 8]
inc ebx
cmp ebx, dword [eax - 0xc]
jl 0x42f306
xor edi, edi
jmp 0x42f36f
lea ecx, [esi - 0x10]
call fcn.0040dd20
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040dd20
mov eax, edi
call fcn.004850f7
ret 4