joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f290
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4464cb
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x45c3a4]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push esi
mov eax, dword [0x45c3a4]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x24]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, eax
cmp eax, 0x20a
jae 0x40f385
xor ecx, ecx
mov word [esp + eax + 0x24], cx
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], ecx
mov word [esp + 0xc], ax
cmp word [esp + 0x24], ax
je 0x40f325
lea ecx, [esp + 0x24]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f316
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.00403a10
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x24c], 0
call fcn.0040f390
cmp dword [esp + 0x20], 8
mov bl, al
jb 0x40f360
push dword [esp + 0xc]
call fcn.0041b8e3
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0041b8d4
mov esp, ebp
pop ebp
ret
call fcn.0041c98b
int3
Function at 0x40f390
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446498
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x45c3a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
cmp dword [edi + 0x10], 0
je 0x40f4bf
cmp dword [ebx + 0x20], 0
je 0x40f3f8
call fcn.0040f4f0
mov eax, dword [ebx + 0x1c]
lea ecx, [ebx + 0x1c]
push dword [eax + 4]
call fcn.0040fac0
mov eax, dword [ebx + 0x1c]
mov dword [eax + 4], eax
mov eax, dword [ebx + 0x1c]
mov dword [eax], eax
mov eax, dword [ebx + 0x1c]
mov dword [eax + 8], eax
mov dword [ebx + 0x20], 0
lea esi, [ebx + 4]
cmp esi, edi
je 0x40f40b
push 0xffffffffffffffff
push 0
push edi
mov ecx, esi
call fcn.004036a0
cmp dword [esi + 0x14], 8
jb 0x40f415
mov ecx, dword [esi]
jmp 0x40f417
mov ecx, esi
mov eax, dword [esi + 0x10]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x40f430
push 1
push 0x452138
mov ecx, esi
call fcn.00403130
push 0xa
push str.KOSUpdate_
mov ecx, esi
call fcn.00403130
push 8
lea eax, [ebp - 0x28]
push eax
call fcn.0040f9d0
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00403020
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 8
jb 0x40f474
push dword [ebp - 0x28]
call fcn.0041b8e3
add esp, 4
push 1
xor eax, eax
push 0x452138
mov ecx, esi
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00403130
cmp dword [esi + 0x14], 8
jb 0x40f4a0
mov eax, dword [esi]
jmp 0x40f4a2
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40f4d5
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], eax
jb 0x40f4ba
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40f4f0
Capabilities:
Delete directory
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x45c3a4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 0x14], 0
push edi
mov dword [esp + 0xc], ebx
je 0x40f61f
mov edi, dword [ebx + 0x1c]
mov esi, dword [edi]
cmp esi, edi
je 0x40f5de
lea eax, [ebx + 4]
mov ebx, eax
lea esp, [esp]
lea eax, [esi + 0x10]
push eax
mov edx, ebx
lea ecx, [esp + 0x18]
call fcn.00408490
add esp, 4
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40f57c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x28], 8
push 4
lea eax, [esp + 0x18]
cmovae eax, dword [esp + 0x18]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [esp + 0x28], 8
jb 0x40f58f
push dword [esp + 0x14]
call fcn.0041b8e3
add esp, 4
cmp byte [esi + 0xd], 0
jne 0x40f5d2
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x40f5b4
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x40f5d2
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x40f5a8
jmp 0x40f5d2
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x40f5d0
lea ecx, [ecx]
cmp esi, dword [eax + 8]
jne 0x40f5d0
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x40f5c0
mov esi, eax
cmp esi, edi
jne 0x40f530
mov ebx, dword [esp + 0xc]
cmp dword [ebx + 0x18], 8
lea esi, [ebx + 4]
jb 0x40f5eb
mov eax, dword [esi]
jmp 0x40f5ed
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x40f61f
cmp dword [esi + 0x14], 8
jb 0x40f600
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.CTempWorkspace::CleanupWorkspace
push str.Failed_to_remove_temp_directory___s__LastError__0x_08X_
push 0x462e98
call fcn.004025d0
add esp, 0x14
mov eax, dword [ebx + 0x1c]
lea ecx, [ebx + 0x1c]
push dword [eax + 4]
call fcn.0040fac0
mov eax, dword [ebx + 0x1c]
mov dword [eax + 4], eax
mov eax, dword [ebx + 0x1c]
mov dword [eax], eax
mov eax, dword [ebx + 0x1c]
mov dword [eax + 8], eax
mov dword [ebx + 0x20], 0
cmp dword [ebx + 0x18], 8
mov dword [ebx + 0x14], 0
jb 0x40f66c
mov eax, dword [ebx + 4]
xor ecx, ecx
mov word [eax], cx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0041b8d4
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
pop edi
xor eax, eax
pop esi
mov word [ebx + 4], ax
pop ebx
xor ecx, esp
call fcn.0041b8d4
mov esp, ebp
pop ebp
ret
Function at 0x412ed0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x45c3a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x110
lea eax, [ebp - 0x11c]
push 0
push eax
mov esi, ecx
mov dword [ebp - 0x120], 0x114
call fcn.00427e80
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jb 0x412f4b
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x12
push esi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x412f4b
xor eax, eax
cmp dword [ebp - 8], 3
pop esi
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041b8d4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
pop esi
call fcn.0041b8d4
mov esp, ebp
pop ebp
ret

Function at 0x4135b0
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esi], vtable.CUpdateTaskFile.0
cmp eax, 0xffffffff
je 0x4135e7
push eax
call ebx
lea eax, [esi + 0x18]
mov dword [esi + 0x14], 0xffffffff
cmp dword [eax + 0x14], 8
jb 0x4135e4
mov eax, dword [eax]
push eax
call edi
mov eax, dword [esi + 0x34]
cmp eax, 0xffffffff
je 0x413607
push eax
call ebx
lea eax, [esi + 0x38]
mov dword [esi + 0x34], 0xffffffff
cmp dword [eax + 0x14], 8
jb 0x413604
mov eax, dword [eax]
push eax
call edi
cmp dword [esi + 0x4c], 8
jb 0x413618
push dword [esi + 0x38]
call fcn.0041b8e3
add esp, 4
xor eax, eax
mov dword [esi + 0x4c], 7
mov dword [esi + 0x48], 0
mov word [esi + 0x38], ax
cmp dword [esi + 0x2c], 8
jb 0x41363d
push dword [esi + 0x18]
call fcn.0041b8e3
add esp, 4
xor eax, eax
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], 0
mov word [esi + 0x18], ax
mov edi, dword [esi + 0x10]
or ebx, 0xffffffff
test edi, edi
je 0x41367e
lea eax, [edi + 4]
mov ecx, ebx
lock xadd dword [eax], ecx
jne 0x41367e
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lea eax, [edi + 8]
mov edx, ebx
lock xadd dword [eax], edx
jne 0x41367e
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov esi, dword [esi + 8]
test esi, esi
je 0x4136aa
lea eax, [esi + 4]
mov ecx, ebx
lock xadd dword [eax], ecx
jne 0x4136aa
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], ebx
dec ebx
jne 0x4136aa
mov eax, dword [esi]
pop edi
mov ecx, esi
pop esi
pop ebx
jmp dword [eax + 4]
pop edi
pop esi
pop ebx
ret
Function at 0x413b50
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 8
mov edi, ecx
jb 0x413b64
mov ecx, dword [esi]
jmp 0x413b66
mov ecx, esi
mov eax, dword [edi + 4]
add eax, 0x1c
cmp dword [eax + 0x14], 8
jb 0x413b74
mov eax, dword [eax]
push 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x413bc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp ecx, 2
je 0x413c35
mov eax, dword [edi + 4]
add eax, 0x1c
cmp dword [eax + 0x14], 8
jb 0x413ba1
mov eax, dword [eax]
push ecx
push eax
push str.CUpdateTaskFile::Backup
push str.Failed_to_move___s_._LastError__0x_08X_
push 0x462e98
call fcn.004025d0
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebp
ret 4
cmp dword [esi + 0x14], 8
jb 0x413bcc
mov eax, dword [esi]
jmp 0x413bce
mov eax, esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x34], eax
cmp eax, 0xffffffff
jne 0x413c24
mov esi, dword [edi + 4]
add esi, 0x1c
cmp dword [esi + 0x14], 8
jb 0x413bfd
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.CUpdateTaskFile::Backup
push str.Failed_to_lock___s_._LastError__0x_08X_
push 0x462e98
call fcn.004025d0
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebp
ret 4
lea ecx, [edi + 0x38]
cmp ecx, esi
je 0x413c35
push 0xffffffffffffffff
push 0
push esi
call fcn.004036a0
pop edi
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x413c40
Capabilities:
Delete file
Move file

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x34], 0xffffffff
je 0x413d0c
mov eax, dword [edi + 4]
add eax, 0x1c
cmp dword [eax + 0x14], 8
jb 0x413c5c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x413c8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
je 0x413c8e
push 0x453a04
push str.Failed_to_rollback_file._File_already_exists
push 0x462e98
call fcn.00402460
add esp, 0xc
xor al, al
pop edi
pop esi
ret
mov eax, dword [edi + 4]
add eax, 0x1c
cmp dword [eax + 0x14], 8
jb 0x413c9c
mov eax, dword [eax]
cmp dword [edi + 0x4c], 8
lea esi, [edi + 0x38]
jb 0x413ca9
mov ecx, dword [esi]
jmp 0x413cab
mov ecx, esi
push 2
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x413ced
mov eax, dword [edi + 4]
add eax, 0x1c
cmp dword [eax + 0x14], 8
jb 0x413cc7
mov eax, dword [eax]
cmp dword [esi + 0x14], 8
jb 0x413ccf
mov esi, dword [esi]
push eax
push esi
push str.CUpdateTaskFile::Rollback
push str.Failed_to_rollback_file._From__s__To__s_
push 0x462e98
call fcn.004025d0
add esp, 0x14
xor al, al
pop edi
pop esi
ret
push dword [edi + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x34], 0xffffffff
cmp dword [esi + 0x14], 8
jb 0x413d05
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
mov al, 1
pop esi
ret
Function at 0x414b50
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4467b8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x45c3a4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [ecx + 0x68]
mov esi, dword [edi]
cmp esi, edi
je 0x414c30
lea esp, [esp]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 8]
call fcn.004136b0
mov dword [esp + 0x28], 0
mov eax, dword [eax]
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x414bb2
mov eax, dword [eax]
push eax
push str.CUpdater::Apply
push str.Applying___s_
push 0x462e98
call fcn.004025d0
mov dword [esp + 0x38], 0xffffffff
mov ebx, dword [esp + 0x28]
add esp, 0x10
test ebx, ebx
je 0x414bff
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x414bff
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lea eax, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x414bff
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov eax, dword [esi + 0xc]
add eax, 0x1c
cmp dword [eax + 0x14], 8
jb 0x414c0d
mov eax, dword [eax]
cmp dword [esi + 0x34], 8
lea ecx, [esi + 0x20]
jb 0x414c18
mov ecx, dword [ecx]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x414c45
mov esi, dword [esi]
cmp esi, edi
jne 0x414b90
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x34], 8
lea ecx, [esi + 0x20]
jb 0x414c50
mov ecx, dword [ecx]
mov eax, dword [esi + 0xc]
add eax, 0x1c
cmp dword [eax + 0x14], 8
jb 0x414c5e
mov eax, dword [eax]
push ecx
push eax
push str.CUpdateTaskFile::Apply
push str.Failed_to_apply_update.___s______s_.
push 0x462e98
call fcn.004025d0
add esp, 0x14
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414c90
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebx + 0x68]
mov esi, dword [edi]
cmp esi, edi
je 0x414cfe
mov ecx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x1c]
cmp eax, 0xffffffff
je 0x414cce
push eax
call ecx
lea eax, [esi + 0x20]
mov dword [esi + 0x1c], 0xffffffff
cmp dword [eax + 0x14], 8
jb 0x414cc1
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x3c]
cmp eax, 0xffffffff
je 0x414cf2
push eax
call ecx
lea eax, [esi + 0x40]
mov dword [esi + 0x3c], 0xffffffff
cmp dword [eax + 0x14], 8
jb 0x414ceb
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esi]
mov ecx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, edi
jne 0x414ca4
mov eax, dword [ebx + 0x68]
mov edi, dword [eax]
mov dword [eax], eax
mov eax, dword [ebx + 0x68]
mov dword [eax + 4], eax
mov dword [ebx + 0x6c], 0
cmp edi, dword [ebx + 0x68]
je 0x414d33
mov eax, dword [edi + 8]
mov esi, dword [edi]
lea ecx, [edi + 8]
push 0
call dword [eax]
push edi
call fcn.0041b8e3
add esp, 4
mov edi, esi
cmp esi, dword [ebx + 0x68]
jne 0x414d17
pop edi
pop esi
pop ebx
ret
Function at 0x4159d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4469c9
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x45c3a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp - 0x1c], esi
mov word [esi], ax
mov dword [ebp - 4], 1
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x20], 1
jb 0x415a38
mov eax, dword [edi]
jmp 0x415a3a
mov eax, edi
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
jne 0x415a73
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0x45225c
call fcn.0041bb11
push 0x4589e8
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], vtable.std::runtime_error.0
call fcn.0041de2b
mov ecx, dword [esi + 0x10]
cmp ebx, ecx
ja 0x415a97
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], ebx
jb 0x415a8d
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + ebx*2], cx
jmp 0x415aa5
mov eax, esi
xor ecx, ecx
mov word [eax + ebx*2], cx
jmp 0x415aa5
mov eax, ebx
sub eax, ecx
push 0x20
push eax
mov ecx, esi
call fcn.00403260
cmp dword [esi + 0x14], 8
jb 0x415aaf
mov eax, dword [esi]
jmp 0x415ab1
mov eax, esi
cmp dword [edi + 0x14], 8
jb 0x415ab9
mov edi, dword [edi]
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x415aff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x18], 0x45225c
call fcn.0041bb11
push 0x4589e8
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], vtable.std::runtime_error.0
call fcn.0041de2b
mov ecx, dword [ebp - 0x1c]
call fcn.00402dd0
mov eax, 0x415afc
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041b8d4
mov esp, ebp
pop ebp
ret
Function at 0x415b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x45c3a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov eax, dword [edi]
test eax, eax
je 0x415b94
cmp byte [edi + 4], 0
je 0x415b8e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [edi + 4], 0
mov dword [edi], 0
lea ebx, [edi + 8]
push 0x45406c
mov dword [ebx], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [edi], eax
test eax, eax
jne 0x415c22
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
add eax, eax
cmp eax, 0x20a
jae 0x415ca1
xor ecx, ecx
mov word [ebp + eax - 0x210], cx
cmp word [ebp - 0x210], cx
je 0x415c91
push str.wintrust.dll
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.0041d488
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x415c91
mov byte [edi + 4], 1
push str.WintrustGetRegPolicyFlags
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WintrustSetRegPolicyFlags
push dword [edi]
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [edi + 0xc]
mov dword [edi + 0x10], eax
test ecx, ecx
je 0x415c60
test eax, eax
je 0x415c60
push ebx
call ecx
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041b8d4
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
test eax, eax
je 0x415c7d
cmp byte [edi + 4], 0
je 0x415c77
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [edi + 4], 0
mov dword [edi], 0
mov dword [ebx], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0041b8d4
mov esp, ebp
pop ebp
ret
call fcn.0041c98b
int3
Function at 0x41a220
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x41a22b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0041a240
Function at 0x42bc2d
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x42bbd8
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x42bbf6
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x42bc54
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
add byte [eax], al
invalid
add byte [eax], al
or byte [ebx - 0x2cc4e7b3], 0x74
add al, 0x80
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x42bc3b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x42bc44
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x42bc4e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x42bc30
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x42bbba
invalid
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x42c1fd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.0042b511
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042b4c6
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
invalid