joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b7c50
Capabilities:
Allocate thread local storage
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov ebx, 0x8e4d80
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
sub esp, 0xc
cmp eax, 0xc15730e2
je 0x5b7df7
lea edx, [ebp - 0x60]
mov esi, str.C15730E2_145C_4c5e_B005_3BC753F42475_once_flag
mov ecx, 0x31
mov edi, edx
rep movsb byte es:[edi], byte [esi]
mov al, bl
and eax, 0xf
add eax, 0x41
mov byte [ebp - 0x30], al
mov eax, ebx
sar eax, 4
and eax, 0xf
add eax, 0x41
mov byte [ebp - 0x2f], al
mov eax, ebx
sar eax, 8
and eax, 0xf
add eax, 0x41
mov byte [ebp - 0x2e], al
mov eax, ebx
sar eax, 0xc
and eax, 0xf
add eax, 0x41
mov byte [ebp - 0x2d], al
mov eax, ebx
sar eax, 0x10
and eax, 0xf
add eax, 0x41
mov byte [ebp - 0x2c], al
mov eax, ebx
sar eax, 0x14
and eax, 0xf
add eax, 0x41
mov byte [ebp - 0x2b], al
mov eax, ebx
sar eax, 0x18
and eax, 0xf
add eax, 0x41
mov byte [ebp - 0x2a], al
shr ebx, 0x1c
add ebx, 0x41
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x6c], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov cl, al
and ecx, 0xf
add ecx, 0x41
mov byte [ebp - 0x28], cl
mov ecx, eax
shr ecx, 4
and ecx, 0xf
add ecx, 0x41
mov byte [ebp - 0x27], cl
mov ecx, eax
shr ecx, 8
and ecx, 0xf
add ecx, 0x41
mov byte [ebp - 0x26], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0xf
add ecx, 0x41
mov byte [ebp - 0x25], cl
mov ecx, eax
shr ecx, 0x10
and ecx, 0xf
add ecx, 0x41
mov byte [ebp - 0x24], cl
mov ecx, eax
shr ecx, 0x14
and ecx, 0xf
add ecx, 0x41
mov byte [ebp - 0x23], cl
mov ecx, eax
shr ecx, 0x18
and ecx, 0xf
add ecx, 0x41
mov byte [ebp - 0x22], cl
shr eax, 0x1c
add eax, 0x41
mov byte [ebp - 0x21], al
mov byte [ebp - 0x20], 0
mov edx, dword [ebp - 0x6c]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov ebx, eax
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
cmp dword [0x8e4d80], 0xc15730e2
je 0x5b7de2
call fcn.005b9868
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x8e4d70], eax
mov dword [esp + 4], 0xc15730e2
mov dword [esp], 0x8e4d80
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
sub esp, 8
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
mov eax, dword [ebp - 0x1c]
lea edx, [eax - 1]
cmp edx, 0xfffffffd
jbe 0x5b7e00
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
jmp 0x5b7df7
Function at 0x5b9660
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x8e4d70]
test eax, eax
jne 0x5b967a
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
push esi
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x5b9672
cmp dword [eax + 0x14], 0
je 0x5b970a
mov ebx, dword [eax + 0x10]
test ebx, ebx
je 0x5b96fd
nop
mov edx, dword [ebx + 4]
mov dword [eax + 0x10], edx
mov eax, dword [ebx]
test eax, eax
je 0x5b9778
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov esi, dword [ebx]
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call edi
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
call edi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 0x10]
test ebx, ebx
jne 0x5b9698
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [eax + 0x14]
test ebx, ebx
jne 0x5b9783
mov ebx, dword [eax + 0x10]
test ebx, ebx
jne 0x5b9698
call fcn.005b7c50
mov dword [esp + 4], 0
mov eax, dword [0x8e4d70]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
push ebx
push ebx
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x5b9672
lea eax, [ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push ecx
test eax, eax
jne 0x5b9672
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
jmp 0x5b9672
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x5b96d9
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x14], edx
mov eax, dword [ebx + 4]
test eax, eax
je 0x5b979f
mov edx, dword [eax]
mov ecx, dword [ebx + 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 8]
mov esi, dword [ebx + 8]
test esi, esi
je 0x5b97b3
mov eax, 0xffffffff
lock xadd dword [esi + 4], eax
dec eax
je 0x5b97d5
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
sub esp, 0xc
mov eax, dword [ebp - 0x1c]
jmp 0x5b9703
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 8]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x5b97b3
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 0xc]
jmp 0x5b97b3

Function at 0x5b9808
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
leave
jmp fcn.005b9660
Function at 0x5c623c
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
add eax, 4
mov dword [eax], 0xefcdab89
mov eax, dword [ebp + 8]
add eax, 8
mov dword [eax], 0x98badcfe
mov eax, dword [ebp + 8]
add eax, 0xc
mov dword [eax], 0x10325476
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [eax], 0xc3d2e1f0
leave
ret
Function at 0x5d0200
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
add eax, 4
mov dword [eax], 0xefcdab89
mov eax, dword [ebp + 8]
add eax, 8
mov dword [eax], 0x98badcfe
mov eax, dword [ebp + 8]
add eax, 0xc
mov dword [eax], 0x10325476
leave
ret

Function at 0x5fa5fc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov dword [ebp - 0x18], 0
jmp 0x5fa6d7
mov eax, dword [ebp - 0x18]
mov al, byte [eax + str.cw]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
mov edx, eax
shl edx, 8
movzx eax, byte [ebp - 0x11]
shl eax, 0x10
mov ebx, edx
or ebx, eax
movzx eax, byte [ebp - 0x11]
shl eax, 1
mov dword [ebp - 0x24], eax
mov al, byte [ebp - 0x11]
shr al, 7
movzx ecx, al
mov edx, ecx
shl edx, 2
add edx, ecx
lea eax, [edx*8]
sub eax, edx
shl eax, 2
add eax, ecx
shl eax, 1
add eax, ecx
xor eax, dword [ebp - 0x24]
shl eax, 0x18
or eax, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
movzx eax, byte [ebp - 0x11]
lea ebx, [eax + eax]
mov al, byte [ebp - 0x11]
shr al, 7
movzx ecx, al
mov edx, ecx
shl edx, 2
add edx, ecx
lea eax, [edx*8]
sub eax, edx
shl eax, 2
add eax, ecx
shl eax, 1
add eax, ecx
mov edx, ebx
xor edx, eax
movzx eax, byte [ebp - 0x11]
xor eax, edx
or eax, dword [ebp - 0x10]
mov edx, 0
mov ecx, eax
mov ebx, edx
mov ebx, ecx
mov ecx, 0
mov eax, dword [ebp - 0x10]
mov edx, 0
mov esi, ecx
or esi, eax
mov edi, ebx
or edi, edx
mov eax, dword [ebp - 0x20]
mov dword [eax*8 + 0x8e5e50], esi
mov dword [eax*8 + 0x8e5e54], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xff
setle al
test al, al
jne 0x5fa611
mov dword [0x8e6658], 0
mov dword [0x8e665c], 0
mov eax, dword [0x8e6658]
mov edx, dword [0x8e665c]
mov dword [0x8e6650], eax
mov dword [0x8e6654], edx
mov byte [0x8e6e60], 1
add esp, 0x18
pop ebx
pop esi
pop edi
leave
ret
Function at 0x608570
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov byte [esp + 4], al
lea eax, [ebp - 0x26]
mov dword [esp], eax
call fcn.006af5d8
lea eax, [ebp - 0x26]
mov dword [esp], eax
call fcn.006da620
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.006d440c
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_CryptGenRandom
sub esp, 0xc
test eax, eax
sete al
test al, al
je 0x60868f
lea eax, [ebp - 0x1d]
mov dword [esp], eax
call fcn.006fba34
lea eax, [ebp - 0x1d]
mov dword [esp + 8], eax
mov dword [esp + 4], str.CryptGenRandom
lea eax, [ebp - 0x24]
mov dword [esp], eax
call fcn.007041ec
lea esi, [ebp - 0x24]
mov dword [esp], 0xc
call fcn.00767ac4
mov ebx, eax
mov eax, ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.006080c2
lea eax, [ebp - 0x24]
mov dword [esp], eax
call fcn.0070479c
jmp 0x608647
lea eax, [ebp - 0x1d]
mov dword [esp], eax
call fcn.006fba4c
mov dword [esp + 8], 0x66aeac
mov dword [esp + 4], 0x80c418
mov dword [esp], ebx
call fcn.007682d4
cmp edx, 0xffffffff
jne 0x608674
call fcn.00760488
mov ebx, edx
mov esi, eax
lea eax, [ebp - 0x1d]
mov dword [esp], eax
call fcn.006fba4c
mov eax, esi
mov edx, ebx
mov dword [esp], eax
call sub.libgcc_s_dw2_1.dll__Unwind_Resume
lea esp, [ebp - 0xc]
add esp, 0
pop ebx
pop esi
pop edi
leave
ret
Function at 0x60fbf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x60fc16
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x60fcaa
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x60fc65
cmp eax, 0x40
je 0x60fc65
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x60fc09
cmp eax, 0x40
je 0x60fc09
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x60fc09
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sub.msvcrt.dll__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x6378c8
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x1c]
cmp esi, 0xa5100000
jne 0x6378fe
cmp edi, 2
jne 0x6378fe
mov dword [esp + 4], 0x2726
mov dword [esp], ebx
call fcn.0064bb44
mov esi, 0xffffffff
jmp 0x637973
mov dword [esp], 0
call sub.WSOCK32.DLL_WSASetLastError
sub esp, 4
call fcn.00597864
mov dword [ebx + 4], eax
mov dword [ebx], 0
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WSOCK32.DLL_setsockopt
sub esp, 0x14
mov esi, eax
call fcn.00597864
mov edi, eax
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [ebx + 4], edi
mov dword [ebx], eax
test esi, esi
jne 0x637973
mov dword [esp], 0
call sub.WSOCK32.DLL_WSASetLastError
sub esp, 4
call fcn.00597864
mov dword [ebx + 4], eax
mov dword [ebx], 0
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x637a44
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 0x14]
mov dword [esp], 0
call sub.WSOCK32.DLL_WSASetLastError
sub esp, 4
call fcn.00597864
mov dword [ebx + 4], eax
mov dword [ebx], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.DLL_WSASocketA
sub esp, 0x18
mov esi, eax
call fcn.00597864
mov edi, eax
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [ebx + 4], edi
mov dword [ebx], eax
cmp esi, 0xffffffff
je 0x637b0d
cmp dword [ebp + 8], 0x17
jne 0x637af0
mov dword [ebp - 0x1c], 0
mov dword [esp + 0x10], 4
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 0x29
mov dword [esp], esi
call sub.WSOCK32.DLL_setsockopt
sub esp, 0x14
mov dword [esp], 0
call sub.WSOCK32.DLL_WSASetLastError
sub esp, 4
call fcn.00597864
mov dword [ebx + 4], eax
mov dword [ebx], 0
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x63a390
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
lea eax, [ebp - 0x198]
mov dword [esp + 4], eax
mov dword [esp], 2
call sub.WSOCK32.DLL_WSAStartup
sub esp, 8
mov edx, dword [ebp + 8]
mov dword [edx], eax
leave
ret
Function at 0x664558
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp edx, esi
je 0x66459f
xor eax, eax
lea esi, [esi]
movsx ebx, byte [edx]
mov ecx, eax
shl ecx, 6
lea ebx, [ebx + ecx - 0x61c88647]
mov ecx, eax
shr ecx, 2
lea ecx, [ebx + ecx]
xor eax, ecx
inc edx
cmp esi, edx
jne 0x66456c
mov edx, 0x7fffd8ee
mov ecx, edx
xor edx, edx
div ecx
lea eax, [edx + 0x2710]
pop ebx
pop esi
leave
ret
mov eax, 0x2710
jmp 0x66459b
Function at 0x70a8b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebx, eax
cmp eax, 0xffffffff
je 0x70a8e8
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x70a8bf
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x40b659
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push 8
push 0
push edi
call fcn.0043e1d0
add esp, 0xc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40b6aa
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40b6a9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], ebx
inc eax
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x40b6f3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x80
push 1
push 0
push 1
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40b725
xor eax, eax
jmp 0x40b745
mov edx, dword [esi + 8]
mov ecx, dword [esi + 4]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push edi
call fcn.0040b748
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
leave
ret

Function at 0x40b748
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xf98]
mov eax, 0x1018
call fcn.0045fdc0
mov eax, dword [0x483260]
xor eax, ebp
mov dword [ebp + 0xf94], eax
mov eax, dword [ebp + 0xfa0]
push ebx
push esi
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xfa4]
push edi
mov edi, edx
mov dword [ebp - 0x7c], eax
test ecx, ecx
je 0x40b83e
test edi, edi
jle 0x40b83e
mov eax, edi
cdq
and edx, 0xfff
add eax, edx
mov esi, eax
sar esi, 0xc
and edi, 0x80000fff
jns 0x40b7ae
dec edi
or edi, 0xfffff000
inc edi
and dword [ebp - 0x70], 0
and dword [ebp - 0x78], 0
mov dword [ebp - 0x74], ecx
test esi, esi
jle 0x40b801
mov ebx, 0x1000
push ebx
push dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.0043e250
add esp, 0xc
push 0
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b83e
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x40b7f6
mov ecx, dword [ebp - 0x70]
add dword [eax], ecx
add dword [ebp - 0x74], ebx
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], esi
jl 0x40b7c2
test edi, edi
jle 0x40b839
push edi
push dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.0043e250
add esp, 0xc
push 0
lea eax, [ebp - 0x70]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b83e
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x40b839
mov ecx, dword [ebp - 0x70]
add dword [eax], ecx
xor eax, eax
inc eax
jmp 0x40b840
xor eax, eax
mov ecx, dword [ebp + 0xf94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b155
add ebp, 0xf98
leave
ret
Function at 0x412928
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push 0x820
mov eax, 0x46b418
call fcn.004437b0
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x820], eax
mov eax, dword [0x487d3c]
mov dword [ebp - method.CResourceUnpack.virtual_0], vtable.CResourceUnpack.0
mov dword [ebp - 0x828], edi
mov dword [ebp - 0x824], edi
push 0x476864
push 0x47686c
push eax
lea esi, [ebp - 0x82c]
mov dword [ebp - 4], edi
call fcn.0040b6af
test eax, eax
jne 0x412982
call fcn.00443833
ret 4
mov ebx, 0x485f6c
mov ecx, ebx
lea esi, [ebp - 0x81c]
call fcn.00402b4a
push edi
mov eax, esi
push eax
lea eax, [ebp - 0x82c]
push eax
mov byte [ebp - 4], 1
call fcn.0040b871
test eax, eax
jne 0x4129be
mov eax, dword [ebp - 0x81c]
add eax, 0xfffffff0
call fcn.004031f6
mov eax, edi
jmp 0x41297a
push 0x800
lea eax, [ebp - 0x814]
push edi
push eax
call fcn.0043e1d0
mov edi, dword [ebp - 0x81c]
add esp, 0xc
push 0x47688c
push edi
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ecx, ebx
lea esi, [ebp - 0x818]
call fcn.00402b4a
mov ebx, esi
mov byte [ebp - 4], 2
call fcn.0040236e
mov esi, dword [ebp - 0x818]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412a3c
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x412a3c
mov ecx, edi
call fcn.00416bd5
mov edi, dword [ebp - 0x820]
add edi, 0x2c
lea eax, [ebp - 0x818]
call fcn.00402b81
push dword [edi]
call fcn.004019b6
pop ecx
push 4
push 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [esi - 0x10]
call fcn.004031f6
xor edi, edi
inc edi
jmp 0x4129ac

Function at 0x412a74
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
cmp dword [esi + 0x34], 0
je 0x412a83
call fcn.004019dc
and dword [esi + 0x34], 0
push ebx
push dword [esi + 0x2c]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call ebx
test eax, eax
je 0x412ab2
push edi
xor edi, edi
push dword [esi + 0x2c]
inc edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x412ab1
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 5
jl 0x412a96
pop edi
push dword [esi + 0x2c]
call ebx
pop ebx
test eax, eax
je 0x412ac9
push 4
push 0
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
ret
Function at 0x412aca
Capabilities:
Get disk information
Terminate process

Disassembly:
push 0x34
mov eax, 0x46bd97
call fcn.004437b0
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [0x487d3c]
cmp ebx, edx
je 0x412c8f
mov dword [ebp - 0x40], vtable.CResourceUnpack.0
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
push 0x476858
push ecx
push eax
lea esi, [ebp - 0x40]
mov dword [ebp - 4], edx
call fcn.0040b6af
test eax, eax
je 0x412c8f
push ebx
mov eax, esi
push eax
call fcn.0040b95c
mov edi, 0x485f6c
mov ecx, edi
lea esi, [ebp - 0x24]
call fcn.00402b4a
push 0x47688c
push ebx
mov eax, esi
push 0x475124
push eax
mov byte [ebp - 4], 1
call fcn.00402e53
mov esi, dword [ebp - 0x2c]
xor ecx, ecx
add esi, 0x2c
add esp, 0x10
inc ecx
lea edx, [ebp - 0x30]
mov eax, esi
call fcn.004089c3
xor ecx, ecx
inc ecx
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.004089c3
mov byte [ebp - 4], 3
push dword [ebp - 0x28]
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x20], 1
call fcn.0040bb50
test eax, eax
je 0x412b8b
mov dword [ebp - 0x20], 3
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
push esi
call fcn.00402445
pop ecx
pop ecx
push 3
pop ecx
cmp eax, ecx
jne 0x412c36
mov dword [0x48818c], ecx
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movzx eax, word [ebx]
push eax
lea eax, [ebp - 0x1c]
push str._c:_
push eax
call fcn.0040323a
add esp, 0xc
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov edi, eax
cmp edi, esi
je 0x412c11
test byte [ebp - 0x20], 8
je 0x412c11
push ebx
lea eax, [ebp - 0x34]
push eax
call fcn.00402ad3
mov ecx, dword [ebp - 0x2c]
push eax
mov byte [ebp - 4], 5
call fcn.00412c99
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
call fcn.004031f6
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
call fcn.004031f6
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
call fcn.004031f6
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.004031f6
mov eax, edi
jmp 0x412c91
cmp eax, 2
jne 0x412baa
cmp dword [0x487d40], 0
jne 0x412c87
mov ecx, edi
lea esi, [ebp - 0x20]
call fcn.00402b4a
mov byte [ebp - 4], 4
push dword [ebp - 0x24]
mov eax, esi
push 0x476050
push eax
call fcn.00402e53
mov esi, dword [ebp - 0x20]
add esp, 0xc
push 0x10000
push 0x476084
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esi - 0x10]
call fcn.004031f6
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
call fcn.00443833
ret 4