joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e480
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x90]
cmp eax, 5
jb 0x47e4c5
cmp dword [ebp - 0x8c], 0
jbe 0x47e4bc
mov byte [0x4e7a10], 8
jmp 0x47e539
mov byte [0x4e7a10], 7
jmp 0x47e539
cmp eax, 3
jbe 0x47e539
cmp dword [ebp - 0x84], 2
jne 0x47e4dc
mov byte [0x4e7a10], 1
jmp 0x47e539
and dword [ebp - 0x88], 0xffff
mov eax, dword [ebp - 0x8c]
cmp eax, 0x5a
jb 0x47e4fa
mov byte [0x4e7a10], 6
jmp 0x47e539
cmp eax, 0xa
jb 0x47e51d
cmp dword [ebp - 0x88], 0x8ae
jb 0x47e514
mov byte [0x4e7a10], 5
jmp 0x47e539
mov byte [0x4e7a10], 4
jmp 0x47e539
cmp dword [ebp - 0x88], 0x3e8
jb 0x47e532
mov byte [0x4e7a10], 3
jmp 0x47e539
mov byte [0x4e7a10], 2
mov esp, ebp
pop ebp
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x3b582e2e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x3427573a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x404b50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x4d6470], 0
jne 0x404c41
mov edx, 0x1a
lea ecx, [ebp - 0x18]
call fcn.00420510
lea eax, [ebp - 0x18]
mov ecx, 0x4d6460
push eax
call fcn.00403f10
mov edx, dword [ebp - 4]
cmp edx, 8
jb 0x404bb8
mov ecx, dword [ebp - 0x18]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404bae
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404c4a
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov ecx, dword [0x4d6470]
test ecx, ecx
je 0x404c41
cmp dword [0x4d6474], 8
mov eax, 0x4d6460
cmovae eax, dword [0x4d6460]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x404be9
push 0x5c
mov ecx, 0x4d6460
call fcn.00409da0
push 0xb
push str.CSGDataInfo
mov ecx, 0x4d6460
call fcn.004047e0
cmp dword [0x4d6474], 8
mov eax, 0x4d6460
cmovae eax, dword [0x4d6460]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x404c30
cmp dword [0x4d6474], 8
mov ecx, 0x4d6460
cmovae ecx, dword [0x4d6460]
call fcn.00426b60
push 0xf
push str.csg_config.ini
mov ecx, 0x4d6460
call fcn.004047e0
mov eax, 0x4d6460
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
int3

Function at 0x404c50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac4c0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4d6488], 0
jne 0x404d74
mov edx, 0x1a
lea ecx, [ebp - 0x24]
call fcn.00420510
lea eax, [ebp - 0x24]
mov ecx, 0x4d6478
push eax
call fcn.00403f10
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x404cd7
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404ccd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404d83
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov ecx, dword [0x4d6488]
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
test ecx, ecx
je 0x404d74
cmp dword [0x4d648c], 8
mov eax, 0x4d6478
cmovae eax, dword [0x4d6478]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x404d1c
push 0x5c
mov ecx, 0x4d6478
call fcn.00409da0
push 0xb
push str.CSGDataInfo
mov ecx, 0x4d6478
call fcn.004047e0
cmp dword [0x4d648c], 8
mov eax, 0x4d6478
cmovae eax, dword [0x4d6478]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x404d63
cmp dword [0x4d648c], 8
mov ecx, 0x4d6478
cmovae ecx, dword [0x4d6478]
call fcn.00426b60
push 0xc
push str.csg_log.ini
mov ecx, 0x4d6478
call fcn.004047e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
int3
Function at 0x404f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac525
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x34
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
push ecx
xor edx, edx
mov dword [ebp - 4], 0
xor ecx, ecx
call fcn.0040a720
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x44], 0
lea edx, [ecx + 1]
add esp, 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x65646e69
mov dword [ebp - 0x1c], 0x74682e78
mov word [ebp - 0x18], 0x6c6d
mov byte [ebp - 0x16], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404fb4
sub ecx, edx
lea eax, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.00404570
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x24]
je 0x404ffc
movups xmm0, xmmword [ebp - 0x44]
mov dword [eax], 0
mov edx, 0xf
mov byte [ebp - 0x44], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x34]
movq qword [eax + 0x10], xmm0
add dword [ebp - 0x28], 0x18
jmp 0x40500c
lea ecx, [ebp - 0x44]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040a590
mov edx, dword [ebp - 0x30]
mov byte [ebp - 4], 0
cmp edx, 0x10
jb 0x40503d
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405033
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405080
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov ecx, dword [ebp - 0x2c]
cmp esi, ecx
je 0x405059
cmp dword [ecx + 0x14], 0x10
mov eax, ecx
jb 0x40504e
mov eax, dword [ecx]
push dword [ecx + 0x10]
mov ecx, esi
push eax
call fcn.00404570
lea ecx, [ebp - 0x2c]
call fcn.00409d00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0047aa50
int3
Function at 0x405730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac64d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x64696162
lea edx, [eax + 1]
mov dword [ebp - 0x18], 0x74682e75
mov word [ebp - 0x14], 0x6c6d
mov byte [ebp - 0x12], 0
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4057a0
sub eax, edx
lea ecx, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00404570
cmp dword [ebp - 0x20], 0x10
lea edx, [ebp - 0x34]
push esi
cmovae edx, dword [ebp - 0x34]
xor ecx, ecx
call fcn.00405380
mov edx, dword [ebp - 0x20]
mov esi, eax
cmp edx, 0x10
jb 0x4057fb
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4057f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405817
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
int3

Function at 0x4070b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x64], 0x740068
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x60], 0x700074
push edi
mov dword [ebp - 0x5c], 0x3a0073
lea edx, [ecx + 2]
mov dword [ebp - 0x58], 0x2f002f
mov dword [ebp - 0x54], 0x790079
mov dword [ebp - 0x50], 0x630073
mov dword [ebp - 0x4c], 0x2e0032
mov dword [ebp - 0x48], 0x73006f
mov dword [ebp - 0x44], 0x2d0073
mov dword [ebp - 0x40], 0x6e0063
mov dword [ebp - 0x3c], 0x73002d
mov dword [ebp - 0x38], 0x610068
mov dword [ebp - 0x34], 0x67006e
mov dword [ebp - 0x30], 0x610068
mov dword [ebp - 0x2c], 0x2e0069
mov dword [ebp - 0x28], 0x6c0061
mov dword [ebp - 0x24], 0x790069
mov dword [ebp - 0x20], 0x6e0075
mov dword [ebp - 0x1c], 0x730063
mov dword [ebp - 0x18], 0x63002e
mov dword [ebp - 0x14], 0x6d006f
mov dword [ebp - 0x10], 0x62002f
mov dword [ebp - 0xc], 0x740065
mov dword [ebp - 8], 0x2f
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407173
sub ecx, edx
lea eax, [ebp - 0x64]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00404350
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
Function at 0x407a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aca8d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004244c0
cmp dword [esi + 0x10], 0
je 0x407b8c
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x680043
lea edx, [eax + 2]
mov dword [ebp - 0x2c], 0x6f0072
mov dword [ebp - 0x28], 0x65006d
mov dword [ebp - 0x24], 0x650053
mov dword [ebp - 0x20], 0x750074
mov dword [ebp - 0x1c], 0x2e0070
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407b16
sub eax, edx
lea ecx, [ebp - 0x48]
sar eax, 1
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00404350
push 1
push 0x4c4740
mov ecx, esi
call fcn.004047e0
cmp dword [ebp - 0x34], 8
lea eax, [ebp - 0x48]
push dword [ebp - 0x38]
cmovae eax, dword [ebp - 0x48]
mov ecx, esi
push eax
call fcn.004047e0
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x407b8c
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407b82
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407ba8
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
int3
Function at 0x407bb0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4acad5
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, 0x1c
lea ecx, [ebp - 0x28]
call fcn.00420510
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00403f10
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x407c2d
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407c23
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407d6d
push edx
push ecx
call fcn.0044b3bd
add esp, 8
cmp dword [esi + 0x10], 0
je 0x407d51
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
push 9
push str.MicroFile
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00404350
push 0x14
push str.FastAuthProvider.dll
lea ecx, [ebp - 0x28]
call fcn.00404350
push 1
push 0x4c4740
mov ecx, esi
call fcn.004047e0
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
mov ecx, esi
push eax
call fcn.004047e0
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x407cb6
mov eax, dword [esi]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 1
push 0x4c4740
mov ecx, esi
call fcn.004047e0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004047e0
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x407d1b
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407d11
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407d72
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x407d51
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407d47
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407d72
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
call fcn.0047aa50
int3
Function at 0x407d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aca8d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004244c0
cmp dword [esi + 0x10], 0
je 0x407e89
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x490041
lea edx, [eax + 2]
mov dword [ebp - 0x2c], 0x650057
mov dword [ebp - 0x28], 0x530062
mov dword [ebp - 0x24], 0x740065
mov dword [ebp - 0x20], 0x700075
mov dword [ebp - 0x1c], 0x65002e
mov dword [ebp - 0x18], 0x650078
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407e13
sub eax, edx
lea ecx, [ebp - 0x48]
sar eax, 1
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00404350
push 1
push 0x4c4740
mov ecx, esi
call fcn.004047e0
cmp dword [ebp - 0x34], 8
lea eax, [ebp - 0x48]
push dword [ebp - 0x38]
cmovae eax, dword [ebp - 0x48]
mov ecx, esi
push eax
call fcn.004047e0
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x407e89
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407e7f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407ea5
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
int3
Function at 0x4089b0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4acbc5
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.00404010
mov dword [ebp - 4], 0
mov esi, 5
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call ebx
test eax, eax
je 0x408a36
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x408a36
test esi, esi
jle 0x408a36
push 0xc8
dec esi
call edi
jmp 0x408a00
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push eax
push eax
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
mov ecx, esp
lea esi, [ebp - 0x28]
push eax
call fcn.00404010
xor edx, edx
mov ecx, esi
call fcn.0041a900
add esp, 0x20
mov eax, esi
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
test eax, eax
je 0x408a96
cmp dword [ebp - 0x14], 8
mov eax, esi
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x408acc
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408ac2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b37
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x408b16
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408b0c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b37
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
int3
Function at 0x4091d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac3fd
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
test esi, esi
je 0x409244
mov eax, dword [esi + 0x10]
test eax, eax
je 0x409244
lea ecx, [ebp - 0x28]
cmp ecx, esi
je 0x40924c
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x409238
mov ecx, dword [esi]
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.00404350
jmp 0x40924c
lea ecx, [ebp - 0x28]
call fcn.00407a80
test edi, edi
je 0x409255
call fcn.00408b40
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
push 0x85
mov ecx, eax
call fcn.00425dd0
add esp, 8
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4092e6
test esi, esi
je 0x4092ac
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x4092ac
cmp dword [ebp - 0x14], 8
mov ecx, esi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00404350
test edi, edi
je 0x4092df
cmp dword [ebp - 0x18], 0
je 0x4092df
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
call fcn.00404b50
cmp dword [eax + 0x14], 8
jb 0x4092ce
mov eax, dword [eax]
push eax
push ecx
mov edx, esi
mov ecx, str.CMSPathSetup
call fcn.00427680
add esp, 8
mov esi, 1
jmp 0x4092e8
xor esi, esi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40931e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409314
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40933b
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
int3
Function at 0x4097c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac3fd
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
test edi, edi
je 0x409815
cmp word [edi], ax
jne 0x409827
lea ecx, [ebp - 0x28]
call fcn.00408340
mov edi, eax
cmp dword [edi + 0x14], 8
jb 0x409827
mov edi, dword [edi]
mov ecx, esi
call fcn.00408670
cmp esi, eax
je 0x409847
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x40983c
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
mov ecx, esi
call fcn.00404350
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x409851
mov edx, dword [esi]
mov ecx, edi
call fcn.00427e60
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x409862
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40987e
push eax
push 0x4c4d38
mov ecx, esi
call fcn.00404350
xor esi, esi
jmp 0x409883
mov esi, 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4098b9
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4098af
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4098d6
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
int3
Function at 0x4098e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4acd35
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
mov dword [ebp - 4], eax
test ecx, ecx
je 0x409930
cmp word [ecx], ax
jne 0x409986
lea ecx, [ebp - 0x48]
call fcn.004208e0
push eax
lea ecx, [ebp - 0x60]
call fcn.00403f10
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x40997b
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409971
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409afb
push edx
push ecx
call fcn.0044b3bd
add esp, 8
cmp dword [ebp - 0x4c], 8
lea ecx, [ebp - 0x60]
cmovae ecx, dword [ebp - 0x60]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
test esi, esi
je 0x409aa7
cmp word [esi], 0
je 0x409aa7
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0x680043
lea edx, [ecx + 2]
mov dword [ebp - 0x2c], 0x6f0072
mov dword [ebp - 0x28], 0x65006d
mov dword [ebp - 0x24], 0x650053
mov dword [ebp - 0x20], 0x750074
mov dword [ebp - 0x1c], 0x2e0070
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409a00
sub ecx, edx
lea eax, [ebp - 0x30]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.00404350
cmp dword [ebp - 0x34], 8
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edx, dword [ebp - 0x34]
test eax, eax
jne 0x409a74
cmp edx, 8
jb 0x409a6d
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409a63
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409b00
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov esi, 1
jmp 0x409aa9
cmp edx, 8
jb 0x409aa7
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409a9d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409b00
push edx
push ecx
call fcn.0044b3bd
add esp, 8
xor esi, esi
mov edx, dword [ebp - 0x4c]
cmp edx, 8
jb 0x409adf
mov ecx, dword [ebp - 0x60]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409ad5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409b05
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
call fcn.0047aa50
call fcn.0047aa50
int3