joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408650
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4236db
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x42c798]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0040dc94
push 4
mov dword [ebp - 4], 0
call fcn.0040e82d
mov edi, eax
add esp, 4
test edi, edi
je 0x4086d0
call fcn.0040c0d1
mov dword [edi], eax
call fcn.0040be90
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0040bdc5
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4086c6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0040bded
jmp 0x4086d2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e0f9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c798]
jne 0x40e103
repz ret
jmp fcn.00413dc8

Function at 0x41698d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4169b4
call fcn.0041281d
mov dword [eax], esi
call fcn.0041280a
push 0x16
pop esi
mov dword [eax], esi
call fcn.00414252
mov eax, esi
jmp 0x416a09
test dword [ebp + 0xc], 0xfffffff9
jne 0x41699a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4169e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00412830
pop ecx
call fcn.0041280a
mov eax, dword [eax]
jmp 0x416a09
test al, 0x10
jne 0x416a07
test al, 1
je 0x416a07
test byte [ebp + 0xc], 2
je 0x416a07
call fcn.0041281d
mov dword [eax], 5
call fcn.0041280a
mov dword [eax], 0xd
jmp 0x4169d8
xor eax, eax
pop esi
pop ebp
ret
Function at 0x41e7db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42c798]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004146a1
and dword [ebp - 0x14], 0
cmp dword [0x42eca0], 0
mov dword [ebp - 0x18], eax
jne 0x41e88e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41e936
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41e936
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42eca0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42eca4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42eca8], eax
call edi
push eax
call esi
mov dword [0x42ecb0], eax
test eax, eax
je 0x41e88e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42ecac], eax
mov eax, dword [0x42ecac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41e8e7
cmp dword [0x42ecb0], ecx
je 0x41e8e7
push eax
call esi
push dword [0x42ecb0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41e8e7
test ebx, ebx
je 0x41e8e7
call edi
test eax, eax
je 0x41e8de
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41e8de
test byte [ebp - 8], 1
jne 0x41e8e7
or dword [ebp + 0x10], 0x200000
jmp 0x41e91a
mov eax, dword [0x42eca4]
cmp eax, dword [ebp - 0x18]
je 0x41e91a
push eax
call esi
test eax, eax
je 0x41e91a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41e91a
mov eax, dword [0x42eca8]
cmp eax, dword [ebp - 0x18]
je 0x41e91a
push eax
call esi
test eax, eax
je 0x41e91a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42eca0]
call esi
test eax, eax
je 0x41e936
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41e938
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e0f9
leave
ret
Function at 0x417c10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417c36
mov eax, dword [0x6357e0]
test eax, eax
je 0x417c2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6357e0], eax
test eax, eax
pop ebx
je 0x417cd1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov ecx, dword [0x6357e0]
push str.DirectSoundEnumerateA
push ecx
mov dword [0x6357dc], eax
call esi
mov ecx, dword [0x6357dc]
mov dword [0x6357e4], eax
test ecx, ecx
je 0x417cc7
test eax, eax
je 0x417cc7
mov eax, 1
pop esi
add esp, 0x50
ret
mov dword [0x6357e0], 0
xor eax, eax
pop esi
add esp, 0x50
ret

Function at 0x423591
Capabilities:
Encode data using xor

Disassembly:
sbb dword [eax - 0x1c51a75f], esp
mov eax, dword [0xb370ffac]
invalid

Function at 0x450f71
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov al, 0xdf
mov byte [0x1f66e3cb], al
out 0x3b, al
add cl, byte es:[ebp + 0xecddcbd]
push cs
dec edx
add ch, cl
jae 0x450f51
fsubr st(1), st(0)
cmp al, 0xe8
or eax, 0x8e4f7bcf
mov cl, byte [0x6a8b3a26]
add edx, dword [edx]
aad 0xfa
cmpsb byte [esi], byte es:[edi]
ror dword [ebx + 0x66bebff8], cl
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
movsb byte es:[edi], byte [esi]
sub eax, 0x10cb2ca4
jns 0x450f6c
jo 0x450f42
dec ebp
xor byte [esi], 0xa3
clc
fcmove st(0), st(4)
lodsb al, byte [esi]
push ebx
cld
sub dword [esi], esp
sar bh, 0xe2
add bh, dh
loopne 0x450f7d
dec esp
push ebp
sbb dword [edx - 0x55b1bdef], 0x130bb70c
xchg byte [esi + 0x62], dh
or byte [ecx + 0x3aac42df], dh
lea esi, [edx]
mov dword [0xe5648bfa], eax
repne lodsd eax, dword [esi]
push eax
sbb dh, byte [edx]
adc eax, 0x8c06dcd2
jmp [esi]
Function at 0x499b44
Capabilities:
Encode data using xor

Disassembly:
add dword [esi + 0xac7ca47], 0x3499aab8
rcr byte [esi + 0x3e60efa9], 0xa7
stosb byte es:[edi], al
cdq
xor al, 0xc0
sahf
test eax, 0xa73e60ef
js 0x499b38
xchg byte [esi + 0x291e12b7], bl
xchg cl, al
mov dword [0x67478ecc], eax
pushal
jno 0x499b31
xchg ebx, eax
xor ebx, dword [eax + 0x723c233a]
nop
cdq
cmp al, 0xfc
mov dl, 0x48
loopne 0x499bd6
pop eax
xor bh, ch
sbb ch, byte [ecx + 0x53]
outsd dx, dword [esi]
invalid
xor eax, 0x855013b4
and byte [eax + 0x6797ac53], bl
cmp dword [edi - 0x40], edi
cmp dword [bx - 0x40], edi
cmc
fisttp dword [eax]
jg 0x499bcc
jno 0x499c2a
sub dl, ch
push edx
or dl, byte [ecx - 0x3d]
fdiv dword [ebx]
adc ch, 0x84
mov edi, 0xae207258
test dword [esi + 0x42], esp
inc eax
sbb edi, dword [edx + 0xe65b180]
and edx, dword [edx]
mov edi, 0xaad973bf
inc eax
sahf
dec ecx
clc
retf 0xdded
dec esp
push esp
xchg edx, eax
das
or al, 0xd5
test dword [0xb46828fe], edx
wait
lodsb al, byte [esi]
mov word [ebx + 0x47db360f], fs
salc
inc ecx
and al, 0xc3
aas
lcall 0x477a, 0xe8033f9e
invalid

Function at 0x49cac7
Capabilities:
Encode data using xor

Disassembly:
cmp byte [edx], 0x37
fistp word [ecx - 0x77]
shl dword [ecx - 0x1f8b2cd1], 1
sub dl, bh
sbb byte [eax], ch
push es
pop esp
bnd retf 0x79b1
inc eax
pop ebx
movntq qword [eax - 0x3d], mm2
inc esi
inc eax
jmp 0x40a3344b
loop 0x49ca94
cwde
mov ch, dh
loopne 0x49ca5c
test al, 0xc6
mov bh, 0xc0
pop esp
adc byte [edx], bl
add esp, dword [edi + 0x3e]
inc ecx
outsb dx, byte [esi]
pop ds
push edi
and ah, byte [esi - 0x10d70eb0]
sahf
cld
adc ebx, dword [edi]
cmp al, cl
mov dl, 0x75
lodsb al, byte [esi]
sbb eax, 0x21e74d0f
push eax
inc esp
xor eax, dword [esp + ebx*2]
push ebp
loope 0x49cad8
in al, 0xc1
mov edx, 0x46c15891
ret

Function at 0x4ac2d4
Capabilities:
Encode data using xor

Disassembly:
inc ebx
dec eax
pop es
nop
out dx, eax
mov ah, 0xbc
insd dword es:[edi], dx
add ch, 0xae
in al, 0x42
inc edx
shr byte [esi - 0x24], 0xd2
xor cl, byte [ecx]
mov word [edi - 0x50], cs
outsd dx, dword [esi]
mov cl, 0x84
jo 0x4ac268
or ah, bl
pop edi
lea esp, [ecx - 0x34df603c]
enter 0x2478, 0x78
aam 0xe0
daa
loope 0x4ac2a5
and al, 0xd6
jo 0x4ac2ab
mov ch, 0xcc
mov dl, 0x82
sub ebp, dword [ebp - 0x5f]
add cl, dl
push ds
pop ds
insb byte es:[edi], dx
mov cl, 0xe5
mov dword [0xe72c88d9], eax
std
dec esp
jle 0x4ac2ef
pop edx
sal cl, 0x7b
arpl word [0xd5d64086], sp
jl 0x4ac301
inc eax
salc
aad 0x7c
push ecx
jmp [eax + esi*4 - 0x5744d1a0]
mov ebx, eax
cld
jns 0x4ac25b
and al, 0xb
jnp 0x4ac304
outsb dx, byte [esi]
arpl cx, cx
mov byte [0x6dc346b9], al
rcr byte fs:[eax + 0x55], 0x2a
in al, 0x92
arpl bx, di
adc byte [ebp - 0x52], bh
lahf
fcmovne st(0), st(4)
imul ebp, esp, 0xff07f0ed
mov al, 0x71
arpl word [eax], sp
pop edx
cmp al, 0x8c
xchg edx, eax
shl cl, 4
adc edi, dword [0xc8acfea3]
insb byte es:[edi], dx
mov eax, dword [0xd3b05c69]
shr esi, 0x68
fsubr dword [edi - 0x352f3744]
in eax, dx
insd dword es:[edi], dx
cmpsb byte [esi], byte es:[edi]
jmp 0xebaf8de1
Function at 0x4aed65
Capabilities:
Encode data using xor

Disassembly:
rcl dword [eax - 0x30], cl
xor dword [edi - 0x27f555ec], edx
pop ecx
fnstcw word [ecx - 0x41e166e7]
ficomp word [esi - 0x22]
sahf
push ds
lahf
aas
fistp word [edi - 0x24]
mov esp, 0xb012921c
rcl byte [eax - 0x2a]
aaa
xchg edi, eax
adc al, 0x94
xor eax, 0xbaea55d5
sbb bl, byte [ebx + 0x5edeb818]
fidivr word [edi]
pushfd
sbb eax, 0x50d33292
sal dword [ecx - 0x48e868ea], 1
aam 0x54
aam 0x35
stosb byte es:[edi], al
sbb bl, byte [edx - 0x21a724c5]
mov edi, 0xb0109012
rcl dword [ecx - 0x2f]
xchg esi, eax
push ss
xchg esi, eax
xlatb
push esp
aad 0xb5
adc eax, 0xdaba1aaa
pop ebx
fdivr dword [eax]
cdq
push ds
sahf
ficomp word ds:[esi - 0x21]
mov edi, 0xb0139312
rcl dword [ecx - 0x2a]
aaa
xchg esp, eax
adc eax, 0x5ada3aaa
fidivr dword [edx - 0x47e764e5]
fcomp dword [eax - 0x21]
cmp al, 0x93
adc edx, dword [ebx - 0x28ac2ccd]
mov ah, 0x2a
lcall 0x3812, 0xf8d8b81b
push esp
sbb dword [esi + 0x3a], edx
pop ss
push esp
sbb dh, byte [edi - 0x4e236f25]
sbb eax, 0x506c1f51
sbb al, 0x55
cmp ebx, dword [edx]
push edi
sbb eax, 0xdf93d5fc
lea edx, [eax]
pop esp
adc dword [0x3e521e51], edi
adc bl, byte [esi + 0x13]
mov edi, 0xb8d39fd3
adc eax, 0x56391559
sbb dl, byte [edi + 0x3b]
pop ss
push esp
sbb byte [ecx + ebx*8 + 0x1bb6d995], dh
push eax
and dword [eax + edx*2], edi
sbb eax, 0x5d113d51
adc dword [esi - 0x412d612e], edi
adc bl, byte [esi + 0x12]
push edx
pop ds
push ebx
aas
adc ebx, dword [edi + 0x13]
mov edi, 0xb8d39fd3
adc al, 0x58
adc al, 0x38
push esp
sbb byte [ebp + 0x39], dl
adc eax, 0xd6b91559
lcall 0x3b17, 0x5a16bad6
push edi
adc al, 0x58
xor al, 0x1a
push edi
sbb eax, 0xe093dfb1
mov ebp, 0x3a155f12
push edi
adc al, 0x5a
aaa
pop ds
insb byte es:[edi], dx
adc byte [ecx + edx*8 + 0x14bfd29e], bh
pop ecx
adc eax, 0x581b5739
xor al, 0x19
push ebp
sbb cl, byte [eax + edx*8 - 0x62]
fdiv qword [ebx + 0x3f135e20]
push ebx
sbb byte [esp + esi + 0x1b], dl
insb byte es:[edi], dx
sar byte [edi - 0x402c602d], 1
adc ebx, dword [edi + 0x14]
cmp dword [esi + 0x1b], edx
pop eax
xor al, 0x1b
push eax
push ds
mov bl, 0xdf
lodsb al, byte [esi]
sar byte [ebp + 0x3d115d11], 1
push ecx
push ds
push edx
adc ebx, dword ds:[eax + 0x15]
mov edx, 0xb0db97d7
sbb eax, 0x5f321e51
adc esp, dword [eax + 0x3c]
adc dword [edi + 0x14], ebx
mov ebx, 0xb1dc90da
sbb eax, 0x60331f52
sbb al, 0x51
adc al, 0x5a
pop ss
mov ah, 0xdc
nop
fisttp qword [ebp + edx + 0x55391559]
adc al, 0x59
xor byte [0xd08c1f52], bl
popfd
loopne 0x4aeeb2
adc dword [esi + 0x14], ebx
cmp dword [esi + 0x1b], edx
push edi
xor al, 0xcb
push ebp
xor dword [ecx - 0x26], ecx
xchg edi, eax
xchg byte [esi - 0x780f4684], cl
punpcklbw mm1, dword [edi + 0xf]
mov ebx, 0xa09e46cc
dec eax
invalid
Function at 0x4b7a05
Capabilities:
Encode data using xor

Disassembly:
loopne 0x4b7a26
cmp eax, 0x26de394
dec edx
js 0x4b7a36
cmc
cmp al, 0xff
jl 0x4b7a82
cmp edi, edi
mov ebp, 0x368db519
inc esp
invalid
jge 0x4b7a8b
rcr byte [ecx + esi*8 + 0x4b54ee62], 0xed
out dx, al
push esp
dec ebx
in eax, dx
test byte [ebx], 0x5d
xor eax, 0x75eb6955
rcl bl, 0xf7
and ecx, ebp
jbe 0x4b7a2c
jmp 0x4b7aad
in eax, dx
pop ebp
mov edx, 0xd295e9ef
jecxz 0x4b7a3e
dec esi
xchg ebp, eax
push edx
push esi
int 0x81
popfd
insd dword es:[edi], dx
push 0xa49878da
fidivr dword [eax - 0x68]
movsb byte es:[edi], byte [esi]
xor dword [ebp - 0x36], edx
xor ch, byte [esp + 0x10]
jp 0x4b7aaf
retf 0x6c32
jbe 0x4b7a9e
iretd
adc dl, byte [ebp - 0x18]
jp 0x4b7a8a
sbb eax, ebp
xor esp, dword [esi + 0x702b272e]
adc dword [edi], ecx
sub ch, ah
cmpsb byte [esi], byte es:[edi]
daa
sub esi, dword [eax + 0x11]
movaps xmm4, xmm5
or edi, esp
jge 0x4b7ab4
mov esp, 0xc7811704
jecxz 0x4b7afb
int1
daa
imul ebx, dword [eax + 0x340a92b5], 0xb2fc4e43
and byte [ebp + edi - 0x35], al
xor eax, esi
mov ah, 0x8f
and dh, byte [0x2fcc38bc]
inc edi
retf
invalid
mov esp, 0x472fcc38
loopne 0x4b7a56
mov dl, 0xdc
mov ebx, 0x3709e343
mov ch, byte [eax + 0x22]
sub dword [edi], esp
call 0xb4b88afa
cdq
add edx, ebx
mov byte [0x4cb0de87], al
xor dword [edx + 0x43332022], ebx
bound eax, qword [ebx + 0x6f]
inc ecx
salc
not byte [ecx]
lahf
xor al, dl
popal
inc ebp
add al, 0x7f
sub byte [ebp - 0x20], dl
pop edi
jmp 0x13fda586
mov ch, 0x82
jno 0x4b7b6e
xor edi, ebx
invalid
and cl, bl
pop esp
rcl dword [eax], cl
cmp ecx, dword [edi + 0x12]
invalid
in eax, 0xe2
mov esp, 0xd0a82dd2
mov esp, fs
mov cl, byte [edx - 0x5a6a1dcc]
inc esp
jge 0x4b7b95
xor cl, byte [edx]
inc eax
cli
adc edx, dword [edx - 0x7f68a66d]
mov dword [0xac12f8ee], eax
dec esi
sbb al, 0xed
sub byte [edx + 0xc], 0x5d
out dx, al
clc
adc ch, byte [esi + edi - 0x7d12e3b2]
push 0xc
pop ebp
pushal
and esp, eax
xor al, 0xb8
xor esi, dword [ebx + 0x134c823d]
loop 0x4b7b2e
rol byte [ebp + 0x5b], 1
and al, 0x1f
xor eax, 0x8454d205
cmp ebx, dword [edx + 0x6cd0faa9]
jecxz 0x4b7b50
cli
shr byte [ebx - 0x4a], 1
bound esi, qword [ebx + 0x358f98d5]
sahf
mov esi, 0x9120c2b5
cld
fild qword [ebp - 0xc]
pop esp
ret 0x63b8
Function at 0x628e31
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6323b0
cmp edx, dword [eax]
je 0x628e53
add eax, 8
inc ecx
cmp eax, 0x632440
jl 0x628e44
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6323b0]
jne 0x628f81
mov eax, dword [0x636d8c]
cmp eax, 1
je 0x628f5b
test eax, eax
jne 0x628e84
cmp dword [0x6322dc], 1
je 0x628f5b
cmp edx, 0xfc
je 0x628f81
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x628ebb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629810
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629ca0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628efe
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629ca0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62eac4
push edi
call fcn.0062bb70
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629810
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629820
lea eax, [ebp - 0xa0]
push 0x62eaa4
push eax
call fcn.00629820
push dword [esi + 0x6323b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629820
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062bae4
add esp, 0x2c
pop edi
jmp 0x628f81
lea eax, [ebp + 8]
lea esi, [esi + 0x6323b4]
push 0
push eax
push dword [esi]
call fcn.00629ca0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x405fa0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x240
lea eax, [esp + 0x13c]
push ebx
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x148]
push str.svchost.exe
push ecx
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
jne 0x4060a3
lea edx, [esp + 0x148]
push 0x409c7c
push edx
call sub.MSVCRT.dll_fopen
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4060a3
lea eax, [esp + 0xc]
lea ecx, [esp + 0x68]
push eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
push ebx
call fcn.00405950
add esp, 0x14
test al, al
je 0x40608b
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x68]
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.00405a90
add esp, 0x10
mov edi, eax
push 0x40
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x4060a3
mov edx, dword [esp + 0xc]
push esi
lea eax, [esp + 0x6c]
push edx
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x34]
push ecx
push edx
push ebx
call fcn.00405b20
mov eax, dword [esp + 0x24]
push edi
push esi
lea ecx, [esp + 0x88]
push eax
lea edx, [esp + 0x34]
push ecx
lea eax, [esp + 0x50]
push edx
push eax
call fcn.00405db0
add esp, 0x30
push ebx
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x240
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x240
ret
Function at 0x406a40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486bc0
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.00458510
push ebx
push esi
mov eax, dword [0x4db434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.004028a0
add esp, 8
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x406a8c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
sete bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, 8
jb 0x406ab4
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.00403b20
xor eax, eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
test bl, bl
je 0x406b14
mov edx, esi
lea ecx, [ebp - 0x24]
call fcn.00402830
mov esi, eax
mov dword [ebp - 4], 1
cmp dword [esi + 0x14], 0x10
jb 0x406ae7
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea eax, [ebp - 0x1030]
push str.Could_not_delete_file_at___s____i_.
push eax
call fcn.004052e0
add esp, 0x10
lea eax, [ebp - 0x1030]
push 0x4d8cc4
push eax
call fcn.00459b3b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406b30
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486bc0
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.00458510
push ebx
push esi
mov eax, dword [0x4db434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.004028a0
add esp, 8
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x406b7c
mov eax, dword [eax]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
sete bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, 8
jb 0x406ba8
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.00403b20
xor eax, eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
test bl, bl
je 0x406c08
mov edx, esi
lea ecx, [ebp - 0x24]
call fcn.00402830
mov esi, eax
mov dword [ebp - 4], 1
cmp dword [esi + 0x14], 0x10
jb 0x406bdb
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea eax, [ebp - 0x1030]
push str.Could_not_mark_file___s__for_deletion_on_reboot___i_.
push eax
call fcn.004052e0
add esp, 0x10
lea eax, [ebp - 0x1030]
push 0x4d8cc4
push eax
call fcn.00459b3b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406c70
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486c18
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
mov eax, dword [0x4db434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea eax, [ebp - 0x24]
push eax
call fcn.004028a0
add esp, 8
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x406cb2
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
cmp ecx, 8
jb 0x406cd7
inc ecx
push ecx
push dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
call fcn.00403b20
xor eax, eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
cmp ebx, 0xffffffff
je 0x406d07
test bl, 0x10
jne 0x406d07
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4078f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4db434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 8]
push 0
push edx
push dword [ebp + 8]
mov dword [ebp - 8], 0
push eax
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x407934
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor ecx, ebp
call fcn.004584f8
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x2c]
push str.Could_not_write__i_bytes_to_file_stream___i_.
push eax
call fcn.00407760
add esp, 0x10
lea eax, [ebp - 0x2c]
push 0x4d8df0
push eax
call fcn.00459b3b
int3
Function at 0x4091f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00458510
mov eax, dword [0x4db434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 8]
push 0
push edx
push dword [ebp + 8]
mov dword [ebp - 8], 0
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40923a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor ecx, ebp
call fcn.004584f8
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1014]
push str.Could_not_read__i_bytes_from_file_stream___i_.
push eax
call fcn.004052e0
add esp, 0x10
lea eax, [ebp - 0x1014]
push 0x4d8cc4
push eax
call fcn.00459b3b
int3