joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402dbc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
call sub.kernel32.dll_WriteFile
test eax, eax
setne al
movsx eax, al
push eax
call fcn.00402c5c
mov esi, eax
cmp dword [0x407e54], 0xffffffff
je 0x402e1d
mov eax, dword [ebp + 0x14]
cmp eax, dword [0x407e50]
jne 0x402e1d
lea eax, [ebp - 0x1c]
push eax
push dword [0x407e50]
call sub.kernel32.dll_GetConsoleScreenBufferInfo
movsx eax, word [ebp - 0x18]
mov dword [0x407e5c], eax
movsx eax, word [ebp - 0x16]
mov dword [0x407e60], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x402f34
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
push esi
push edi
mov edi, 3
push 0x408980
call fcn.00406390
mov esi, dword [eax]
push 0x408980
call fcn.00406390
mov dword [eax], 0x40
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x38c]
push eax
push 0
call fcn.00405bf8
call fcn.00405a74
lea eax, [ebp - 0x150]
push eax
push 1
call fcn.00405b00
call fcn.004043c0
test eax, eax
jne 0x403075
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 0x40
push 0
call fcn.00405bd8
call fcn.004043c0
test eax, eax
jne 0x402feb
cmp word [ebp - 0x190], 0x5a4d
jne 0x402feb
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00405b1c
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 2
push 0
call fcn.00405bd8
jmp 0x402ff5
mov dword [ebp - 0x154], 0
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00405b1c
call fcn.004043c0
test eax, eax
jne 0x403059
cmp word [ebp - 0x190], 0x4550
jne 0x403059
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x288]
push eax
push 0xf8
push 0
call fcn.00405bd8
call fcn.004043c0
test eax, eax
jne 0x403059
cmp dword [ebp - 0x288], 0x4550
jne 0x403059
cmp word [ebp - 0x22c], 3
jne 0x403059
mov edi, 2
lea eax, [ebp - 0x150]
push eax
call fcn.00405b4c
push 0x408978
call fcn.00406390
mov dword [eax], 0
push 0x408980
call fcn.00406390
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4030cc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
call sub.kernel32.dll_CreateThread
mov esi, eax
push esi
call sub.kernel32.dll_CloseHandle
test esi, esi
setne al
movsx eax, al
push eax
call fcn.00402c5c
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x403170
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
cmp dword [0x407ef4], 0
je 0x403192
mov eax, dword [0x407ef4]
mov dword [ebp - 4], eax
jmp 0x403227
push 0x104
call fcn.00404494
mov dword [ebp - 4], eax
push 0x104
push dword [ebp - 4]
push 0
call sub.kernel32.dll_GetModuleFileNameA
push dword [ebp - 4]
call fcn.00403f5c
inc eax
mov ebx, eax
call sub.kernel32.dll_GetCommandLineA
mov esi, eax
mov al, byte [esi]
dec al
cmp al, 0x1f
jbe 0x4031d7
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.00403108
mov esi, eax
inc esi
push esi
call fcn.00403f5c
inc eax
mov edi, eax
lea eax, [ebp - 4]
push eax
mov eax, ebx
add eax, edi
inc eax
push eax
call fcn.004044f4
call sub.kernel32.dll_AreFileApisANSI
test eax, eax
jne 0x403208
push edi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push esi
call sub.user32.dll_CharToOemBuffA
jmp 0x403215
push esi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push edi
call fcn.00404fb4
mov eax, dword [ebp - 4]
add eax, ebx
add eax, edi
mov byte [eax], 0
mov eax, dword [ebp - 4]
mov dword [0x407ef4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403304
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x24], 0x52414853
mov dword [ebp - 0x20], 0x454d4445
mov dword [ebp - 0x1c], 0x5356354d
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0xb
call fcn.00404f28
xor eax, eax
mov bl, 0
cmp dword [0x407e98], 0
jne 0x403352
push 0x407be8
push 1
call fcn.00402b68
mov dword [0x407e98], eax
cmp dword [0x407e98], 0
jne 0x40336b
push 0x8000
call fcn.00404494
mov esi, eax
mov bl, 1
jmp 0x4033a5
lea eax, [ebp - 0x24]
push eax
push 0
push 6
call dword [0x407e98]
test eax, eax
jne 0x403395
lea eax, [ebp - 0x24]
push eax
push 0x8000
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov bl, 1
push 0
push 0
push 0
push 6
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test bl, bl
je 0x4033ce
push esi
push 0x8000
push 0xff
call fcn.00405010
push esi
push 0x24
push 0
call fcn.00405010
mov eax, esi
add eax, 0xc
push eax
call fcn.0040457c
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40377c
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push esi
call fcn.00403708
lea edx, [ebp - 0x400]
movzx ecx, word [ebp + 0x14]
dec ecx
xor esi, esi
jmp 0x4037b4
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
mov word [edx + 2], ax
mov eax, dword [ebp + 0x18]
movzx eax, byte [eax]
mov word [edx], ax
inc dword [ebp + 0x18]
add edx, 4
inc esi
cmp ecx, esi
jge 0x40379a
mov ax, word [ebp + 0x14]
mov word [ebp - 0x404], ax
mov word [ebp - 0x402], 1
mov word [ebp - 0x408], 0
mov word [ebp - 0x406], 0
mov ax, word [ebp + 0x10]
mov word [ebp - 0x410], ax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x40e], ax
movzx ecx, word [ebp + 0x10]
movzx eax, word [ebp + 0x14]
add ecx, eax
dec ecx
mov word [ebp - 0x40c], cx
mov ax, word [ebp + 0xc]
mov word [ebp - 0x40a], ax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x408]
push dword [ebp - 0x404]
lea eax, [ebp - 0x400]
push eax
push dword [0x407e50]
call sub.kernel32.dll_WriteConsoleOutputA
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x403b5c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x403b7c
mov al, byte [ebp - 4]
jmp 0x403b7f
mov al, byte [ebp + 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405eb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
or edi, 0xffffffff
or eax, 0xffffffff
mov dword [ebp - 0x24], 0
xor esi, esi
mov edx, dword [0x408248]
add edx, 0x24
mov esi, edx
cmp dword [edx], 0xffffffff
je 0x405eee
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x405ee9
mov ecx, dword [edx + 8]
cmp ecx, dword [esi + 8]
jbe 0x405ee9
mov esi, edx
add edx, 0x10
jmp 0x405ed2
mov edx, esi
cmp dword [edx], 0xffffffff
je 0x406002
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x406002
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x406000
mov ecx, dword [edx + 8]
sub dword [ebp + 0x10], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [edx + 0xc]
test edx, edx
je 0x406000
mov cl, byte [edx]
sub cl, 0x3c
jne 0x405f36
jmp 0x406000
sub cl, 3
jne 0x405f50
inc edx
mov dword [ebp - 0xc], edx
movzx ecx, byte [edx]
inc ecx
add edx, ecx
mov byte [ebp - 0x25], 1
jmp 0x405ffb
inc cl
jne 0x405f64
movzx ecx, word [edx + 1]
add edi, ecx
add edx, 3
jmp 0x405ffb
inc cl
jne 0x405f78
movzx ecx, word [edx + 1]
add edi, ecx
mov ecx, dword [edx + 3]
add eax, ecx
add edx, 7
jmp 0x405f8b
movzx ecx, byte [edx]
shr ecx, 6
add edi, ecx
mov cl, byte [edx]
and cl, 0x3f
movzx ecx, cl
add eax, ecx
inc edx
cmp eax, dword [ebp + 0x10]
jne 0x405f95
mov esi, eax
mov dword [ebp - 0x24], edi
cmp eax, dword [ebp + 0x10]
jl 0x405ff2
sub eax, dword [ebp + 0x10]
cmp eax, 0xa
jle 0x405fa8
cmp byte [ebp - 0x25], 0
jne 0x405ff0
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov eax, dword [ebp + 0xc]
mov byte [eax], cl
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp eax, dword [ebp - 0x14]
jle 0x405fde
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov dl, byte [eax + ecx]
xor dl, 0xaa
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov byte [eax + ecx], dl
jmp 0x405fb9
movzx eax, word [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
add esi, dword [ebp - 0x18]
mov eax, esi
jmp 0x406002
jmp 0x406000
mov esi, eax
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x25], 0
jmp 0x405f28
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4064d8
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10
cld
push ecx
call fcn.004064b4
call fcn.00403304
mov dword [0x408248], eax
lea edx, [eax + 0x18]
mov dword [0x4082a8], edx
pop edx
call fcn.00406334
call sub.kernel32.dll_GetEnvironmentStrings
mov dword [0x408274], eax
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x408288], eax
mov dword [0x4082b0], eax
call fcn.00402f34
cmp eax, 3
setb byte [0x408251]
call fcn.00403f54
lea eax, [esp]
xor edx, edx
mov ecx, dword fs:[edx]
mov dword fs:[edx], eax
mov dword [eax], ecx
mov dword [eax + 4], 0x406764
mov dword [eax + 8], ebp
jmp dword [esp + 0x10]
Function at 0x408dac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408dea
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408df1
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
mov dword [esp + 4], str._s_S.dll
add edx, 0x40c688
add eax, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4

Function at 0x408f90
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x43b424], 0
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
push ebx
jne 0x408fcd
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x408fb8
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x408faa
mov dword [ecx*4 + 0x43b420], eax
inc ecx
cmp ecx, 0x100
jne 0x408fa3
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x408ff0
inc edx
mov cl, byte [edx - 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43b420]
jmp 0x408fd7
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x689d0d48
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x29bd3a61
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4010ac
Capabilities:
Create process on windows

Disassembly:
push 1
xor eax, eax
push eax
push eax
push dword [esp + 0x10]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret 4

Function at 0x4010ca
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x794
push edi
call fcn.004a9266
xor edi, edi
test al, al
je 0x40111e
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x4010e5
sub eax, edx
sar eax, 1
mov ecx, 0x3ca
cmp eax, ecx
jb 0x40111e
mov edx, dword [ebp + 8]
push esi
push ecx
lea esi, [ebp - 0x794]
call fcn.004a8ff7
push 1
push edi
push edi
mov eax, esi
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
jmp 0x40112d
push 1
push edi
push edi
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
leave
ret 4

Function at 0x40117f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.005970f0
mov ax, word [ebp + 0xc]
mov edx, dword [ebp + 8]
mov word [ebp - 0x28], ax
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0x58], esi
push 0x208
lea esi, [ebp - 0x468]
mov dword [ebp - 0x2c], 1
stosd dword es:[edi], eax
call fcn.004a8ff7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
mov eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401217
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0x4e20
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x10]
mov edi, eax
call esi
mov eax, edi
neg eax
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x20
jmp 0x401219
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40125a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
push esi
push edi
mov edi, eax
call fcn.004a9266
test al, al
je 0x40127c
cmp edi, 5
jle 0x40127c
xor al, al
jmp 0x4012dc
mov esi, 0x11c
push esi
lea eax, [esp + 0xc]
push 0
push eax
call fcn.005970f0
mov eax, dword [ebp + 8]
add esp, 0xc
push 3
mov dword [esp + 0x10], edi
pop edi
push edi
push 2
push 0
mov dword [esp + 0x14], esi
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0
mov dword [esp + 0x20], eax
call esi
push edi
push 1
push edx
push eax
call esi
push edi
push 0x20
push edx
push eax
call esi
push edi
push 0x10
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x401a72
Capabilities:
Move file

Disassembly:
push 3
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
neg eax
sbb eax, eax
neg eax
ret 8
Function at 0x401a8b
Capabilities:
Copy file

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x401aa4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0x410]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor eax, eax
inc eax
push eax
mov dword [ebp + 8], eax
call esi
mov edi, str.Switch__lu__d
jmp 0x401ae3
inc dword [ebp + 8]
push dword [ebp + 8]
call esi
push eax
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.00401000
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
push ebx
call fcn.00401f2d
push ebx
call fcn.00401b98
test al, al
jne 0x401adb
push ebx
call fcn.00401b83
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x401b98
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 4

Function at 0x401baf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401bc2
xor al, al
jmp 0x401bc8
shr eax, 4
and eax, 1
ret 4

Function at 0x401bcb
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test ax, 0x400
je 0x401c0f
lea eax, [ebp - 0x254]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x401c0f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test dword [ebp - 0x230], 0xa000000c
je 0x401c0f
mov al, 1
jmp 0x401c11
xor al, al
leave
ret 4
Function at 0x401c15
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa28
push ebx
push esi
push edi
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 8]
call fcn.005908d3
add esp, 0x14
cmp word [ebp - 0x410], 0
je 0x401c78
lea eax, [ebp - 0x410]
push eax
push 0x5b0804
mov esi, 0x104
lea edi, [ebp - 0x618]
call fcn.004a9039
pop ecx
pop ecx
mov eax, edi
push eax
jmp 0x401d8d
cmp word [ebp - 0x208], 0x5c
jne 0x401d8b
cmp word [ebp - 0x206], 0x5c
jne 0x401d8b
lea eax, [ebp - 0x208]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x401c9d
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [ebp - 0x208]
push eax
call ebx
cmp eax, 1
jne 0x401d83
cmp esi, 4
jb 0x401d64
lea eax, [ebp - 0x208]
push 0x5b080c
push eax
call fcn.0058fe77
test eax, eax
pop ecx
pop ecx
je 0x401d64
cmp esi, 4
jne 0x401d00
push 0x100
lea edx, [ebp - 0x820]
lea esi, [ebp - 0x200]
call fcn.004a8ff7
lea eax, [ebp - 0x208]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x401d09
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [ebp - 0x200]
push 0x5c
push eax
call fcn.00590248
test eax, eax
pop ecx
pop ecx
je 0x401d40
mov word [eax], 0x3a
inc eax
inc eax
mov word [eax], 0x5c
and word [eax + 2], 0
jmp 0x401d59
mov esi, 0x104
sub esi, edi
push 0x5b0818
lea edi, [ebp + edi*2 - 0x208]
call fcn.004a9039
pop ecx
lea eax, [ebp - 0x200]
push eax
call ebx
jmp 0x401d93
push 2
lea eax, [ebp - 0x208]
push 0x5b0820
push eax
call fcn.0059091d
add esp, 0xc
test eax, eax
jne 0x401d83
push 4
pop eax
jmp 0x401d93
lea eax, [ebp - 0x208]
jmp 0x401d5f
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40214c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._Ix__wt
mov esi, 0x104
lea edi, [ebp - 0x410]
call fcn.004a9039
pop ecx
pop ecx
mov eax, edi
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call fcn.00401f2d
push 0x1388
push 2
push 0
push 0xc0000000
lea eax, [ebp - 0x208]
push eax
call fcn.004a1f44
cmp eax, 0xffffffff
pop edi
pop esi
je 0x4021c0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
jmp 0x4021c2
xor al, al
leave
ret 4
Function at 0x404adb
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x208]
push eax
push ebx
push ebx
push 0x26
push ebx
mov word [ebp - 0x208], bx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, 0x5b07d8
push esi
push 0x5b0828
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.004a2dab
push dword [ebp + 0xc]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.00401f2d
mov edi, str..exe
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x618]
push eax
push dword [ebp + 0x10]
call fcn.004a2dab
push dword [ebp + 0x10]
call fcn.00401b98
test al, al
je 0x404b61
mov al, 1
jmp 0x404cb2
lea eax, [ebp - 0x208]
call fcn.004a20d8
push esi
push 0x5b0828
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.004a2dab
push esi
push str.Program_Files
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x820]
push eax
call fcn.004a2dab
push dword [ebp + 0xc]
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.00401f2d
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x618]
push eax
push dword [ebp + 0x10]
call fcn.004a2dab
push dword [ebp + 0x10]
call fcn.00401b98
test al, al
jne 0x404b5a
cmp byte [ebp + 8], bl
jne 0x404cb2
lea eax, [ebp - 0x208]
push eax
push ebx
push ebx
push 0x26
push ebx
mov word [ebp - 0x208], bx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
mov ebx, str.NCH_Swift_Sound
push ebx
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.004a2dab
push dword [ebp + 0xc]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.00401f2d
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x618]
push eax
push dword [ebp + 0x10]
call fcn.004a2dab
push dword [ebp + 0x10]
call fcn.00401b98
test al, al
jne 0x404b5a
lea eax, [ebp - 0x208]
call fcn.004a20d8
push esi
push ebx
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.004a2dab
push esi
push str.Program_Files
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x820]
push eax
call fcn.004a2dab
push dword [ebp + 0xc]
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.00401f2d
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x618]
push eax
push dword [ebp + 0x10]
call fcn.004a2dab
push dword [ebp + 0x10]
call fcn.00401b98
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x405c6c
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x208
push 0x104
lea eax, [esp + 4]
push eax
push str.LQUIET
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
neg eax
sbb eax, eax
neg eax
add esp, 0x208
ret

Function at 0x40938b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe1c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, eax
mov ecx, dword [esi]
push edi
lea eax, [ebp - 0x410]
call fcn.004016d4
mov eax, dword [ebx]
push 0
push str.RCA_VOC
mov ecx, ebx
call dword [eax + 0x20]
mov eax, dword [ebx]
push 1
lea ecx, [ebp - 0x410]
push ecx
mov ecx, ebx
call dword [eax + 0x20]
mov eax, dword [ebp + 8]
mov dword [eax], 2
lea eax, [ebp - 0x618]
push eax
push str.devoc
push ebx
call fcn.00402374
test al, al
je 0x40946e
lea eax, [ebp - 0x208]
push eax
call fcn.00401b1f
lea eax, [ebp - 0x208]
push eax
push dword [esi]
call fcn.00401a8b
mov edi, dword [esi + 4]
push str..wav
lea edx, [ebp - 0x208]
call fcn.004a2d01
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x618]
push eax
push str.__s___w___s_
mov esi, 0x400
lea edi, [ebp - 0xe18]
call fcn.004a9039
mov eax, dword [ebx]
add esp, 0xc
mov ecx, ebx
call dword [eax + 0x28]
push 0xffffffffffffffff
mov eax, edi
push eax
push ebx
lea eax, [ebp + 0xc]
push eax
call fcn.004b3385
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x2c]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x409478
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.0059fbd0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [esi]
push edi
lea eax, [ebp - 0x618]
call fcn.004016d4
mov eax, dword [ebx]
push 0
push 0x5bce44
mov ecx, ebx
call dword [eax + 0x20]
mov eax, dword [ebx]
push 1
lea ecx, [ebp - 0x618]
push ecx
mov ecx, ebx
call dword [eax + 0x20]
mov eax, dword [ebp + 8]
mov dword [eax], 2
lea eax, [ebp - 0x410]
push eax
push str.qcpdec
push ebx
call fcn.00402374
test al, al
je 0x40956d
lea eax, [ebp - 0x208]
push eax
call fcn.00401b1f
lea eax, [ebp - 0x208]
push eax
push dword [esi]
call fcn.00401a8b
mov edi, dword [esi + 4]
push str..wav
lea edx, [ebp - 0x208]
call fcn.004a2d01
lea eax, [ebp - 0x820]
push eax
mov eax, dword [esi]
call fcn.00401016
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
push 0x5bc804
mov esi, 0x400
lea edi, [ebp - 0x1020]
call fcn.004a9039
mov eax, dword [ebx]
add esp, 0xc
mov ecx, ebx
call dword [eax + 0x28]
push 0xffffffffffffffff
mov eax, edi
push eax
push ebx
lea eax, [ebp + 0xc]
push eax
call fcn.004b3385
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x2c]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8