joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411030
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403bb4
xor eax, eax
push ebp
push 0x41119a
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x411076
inc eax
jne 0x4110a4
push 0x4111b4
push dword [esi + 0xc]
push 0x4111d0
lea edx, [ebp - 0x18]
mov eax, edi
call fcn.00407f8c
push dword [ebp - 0x18]
lea eax, [esi + 4]
mov edx, 4
call fcn.00403a84
xor ebx, ebx
jmp 0x41117c
push 4
lea eax, [esi + 0x4c]
push eax
push 0x1005
push 0xffff
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_setsockopt
inc eax
je 0x4110dc
push 4
lea eax, [esi + 0x4c]
push eax
push 0x1006
push 0xffff
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_setsockopt
inc eax
jne 0x4110fd
lea eax, [esi + 4]
mov edx, 0x4111dc
call fcn.00403788
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_closesocket
mov dword [esi + 8], 0xffffffff
xor ebx, ebx
jmp 0x41117c
cmp dword [esi + 0x58], 0
je 0x41112a
mov eax, dword [esi + 0x58]
call fcn.00403bc4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
mov ax, word [esi + 0x5c]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], 2
jmp 0x41114b
mov eax, dword [ebp - 4]
call fcn.00403bc4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
push edi
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], 2
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_connect
inc eax
jne 0x41117c
lea eax, [esi + 4]
mov edx, 0x4111fc
call fcn.00403788
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_closesocket
mov dword [esi + 8], 0xffffffff
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4111a1
lea eax, [ebp - 0x18]
call fcn.00403734
lea eax, [ebp - 4]
call fcn.00403734
ret
Function at 0x413adc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov ebx, eax
lea esi, [esp + 4]
mov eax, ebx
call fcn.00403734
push esp
push 0x20019
push 0
push 0x413bc4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x413b56
xor eax, eax
mov dword [esi], eax
lea eax, [esp + 8]
mov byte [eax], 0
inc dword [esi]
inc eax
cmp dword [esi], 0x100
jne 0x413b14
mov dword [esi], 0xff
push esi
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0x413bec
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x413b56
mov eax, ebx
lea edx, [esp + 8]
mov ecx, pe_nt_image_headers32
call fcn.00403998
jmp 0x413bb9
push esp
push 0x20019
push 0
push 0x413bc4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x413bb9
xor eax, eax
mov dword [esi], eax
lea eax, [esp + 8]
mov byte [eax], 0
inc dword [esi]
inc eax
cmp dword [esi], 0x100
jne 0x413b79
mov dword [esi], 0xff
push esi
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0x413bec
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x413bb9
mov eax, ebx
lea edx, [esp + 8]
mov ecx, pe_nt_image_headers32
call fcn.00403998
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x401e6c
Capabilities:
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
je 0x401e8a
cmp dword [0x426054], 0
je 0x409c19
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x42606c], 0
jne 0x401e8a
jmp 0x414c61
mov ecx, 0x20c
call fcn.00401e20
mov edi, eax
test edi, edi
je 0x401e8a
push 0x104
push edi
call dword [sym.imp.api_ms_win_core_console_l2_1_0.dll_GetConsoleTitleW]
mov edx, eax
test edx, edx
je 0x401e8a
and dword [ebp - 8], 0
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x414c94
mov eax, dword [0x4260c4]
sub ecx, esi
sar ecx, 1
add edx, 0xa
add eax, ecx
mov ecx, edi
add eax, edx
mov dword [ebp - 4], eax
lea edx, [eax + eax]
call fcn.0040233f
mov esi, eax
test esi, esi
je 0x414d15
cmp byte [0x426005], 0
mov edi, esi
mov edx, dword [ebp - 4]
jne 0x41991f
push 0x414d24
mov ecx, esi
call fcn.00402c8a
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x414ce6
sub ecx, edx
mov edx, dword [ebp - 4]
sar ecx, 1
mov dword [0x4260c4], ecx
mov ecx, esi
push ebx
call fcn.00402c8a
mov byte [0x426005], 1
push esi
call dword [sym.imp.api_ms_win_core_console_l2_1_0.dll_SetConsoleTitleW]
mov ecx, edi
call fcn.0040128b
jmp 0x401e8a
mov eax, dword [0x4260c4]
sub edx, eax
push ebx
lea ecx, [esi + eax*2]
call fcn.00401da3
jmp 0x414d0e
Function at 0x401e96
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov ebx, 0x2000
mov edi, 0x431800
push ebx
mov esi, ecx
xor eax, eax
push edi
push esi
mov word [0x431800], ax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetEnvironmentVariableW]
test eax, eax
je 0x404f5a
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x426004], 0
je 0x4050a3
push 0x401280
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40f667
push 0x401240
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40674e
push 0x401264
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4106c2
push 0x405014
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41dd95
push 0x401258
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4106b1
push 0x401218
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x405077
push ebx
xor edx, edx
xor ecx, ecx
push edi
inc edx
call fcn.00407954
add eax, eax
cmp eax, 0x4000
jae 0x416a0a
xor ecx, ecx
mov word [eax + 0x431800], cx
jmp 0x401ec7
push 0x4050ac
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x416a0f
push 0x4050bc
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41dda0
xor eax, eax
jmp 0x401ec9
push dword [0x4260f8]
push 0x406748
push ebx
push edi
call fcn.004026f3
add esp, 0x10
jmp 0x401ec7
push 0
mov edx, ebx
mov ecx, edi
call fcn.00405193
jmp 0x401ec7
push ebx
xor edx, edx
xor ecx, ecx
push edi
inc edx
call fcn.0041044b
jmp 0x404ff7
push 2
jmp 0x406754
call fcn.0041c651
call dword [sym.imp.msvcrt.dll_rand]
push eax
jmp 0x406754
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetCommandLineW]
jmp 0x401ec9
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaHighestNodeNumber]
push dword [esp + 0xc]
jmp 0x406754

Function at 0x4025a3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
mov byte [0x426007], bl
push esi
test edx, edx
je 0x4025cf
mov esi, edx
push edi
lea edi, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x4025b9
sub esi, edi
sar esi, 1
neg esi
pop edi
sbb esi, esi
and edx, esi
push edx
push ecx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_SetEnvironmentVariableW]
push dword [0x42612c]
mov esi, eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
call fcn.00402606
mov dword [0x42612c], eax
xor eax, eax
test esi, esi
pop esi
sete al
pop ebx
ret
Function at 0x402606
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
je 0x416ae4
cmp word [ebx], 0
push esi
push edi
mov esi, ebx
je 0x402640
lea esp, [esp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x402630
cmp word [esi], ax
jne 0x402630
sub esi, ebx
add esi, 2
and esi, 0xfffffffe
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x402669
push esi
push ebx
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop esi
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x402bff
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x4261d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 2
push 0
xor eax, eax
mov dword [ebp - 8], ecx
push 0
push dword [ebp + 0x10]
xor bl, bl
cmp dword [ebp + 0xc], eax
sete al
push eax
push edx
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindFirstFileExW]
mov esi, dword [ebp + 0x14]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x402f31
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [0x4260a4], eax
mov al, bl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00401200
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp + 8]
mov eax, dword [ebp - 8]
push dword [ebp + 0x10]
cmp eax, fcn.00402fb0
jne 0x40bb26
call fcn.00402fb0
test eax, eax
je 0x40f5c7
and dword [0x4260a4], 0
mov bl, 1
cmp dword [esi], 0xffffffff
je 0x402f92
mov ecx, dword [0x4260a8]
test ecx, ecx
je 0x4099cf
mov edx, dword [0x4260ac]
cmp edx, dword [0x4260b0]
jge 0x4092f0
test ecx, ecx
je 0x402f90
mov eax, dword [esi]
mov dword [ecx + edx*4], eax
inc edx
mov dword [0x4260ac], edx
mov bl, 1
test bl, bl
jne 0x402c49
jmp 0x402c3e
lea eax, [edx*4 + 4]
push eax
push ecx
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapReAlloc]
mov ecx, eax
test ecx, ecx
je 0x418f3f
inc dword [0x4260b0]
jmp 0x4099be
mov edx, dword [0x4260ac]
mov dword [0x4260a8], ecx
jmp 0x402f80
push 0x14
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov ecx, eax
jmp 0x4099be
mov ecx, eax
call dword [0x442430]
mov ecx, dword [ebp - 8]
call ecx
jmp 0x402f4a
push dword [esi]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindClose]
or dword [esi], 0xffffffff
jmp 0x402f5b
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindNextFileW]
test eax, eax
je 0x40f593
cmp dword [esi], 0xffffffff
jne 0x402f31
jmp 0x402f5b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
push dword [esi]
mov dword [0x4260a4], eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindClose]
or dword [esi], 0xffffffff
xor al, al
jmp 0x402c4b

Function at 0x402df9
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4261d4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3a
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], cx
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.00401200
mov esp, ebp
pop ebp
ret
Function at 0x403831
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4261d4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3a
pop eax
mov word [ebp - 0xe], ax
push 0x5c
pop eax
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x10], cx
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x419d8e
cmp eax, 2
je 0x4038a6
cmp eax, 5
je 0x4038a6
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x220]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetVolumeInformationW]
test eax, eax
je 0x419d96
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401200
mov esp, ebp
pop ebp
ret
xor eax, eax
inc eax
jmp 0x4038a8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 5
jne 0x4038a6
jmp 0x419d8e
Function at 0x405193
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x4261d4]
xor eax, esp
mov dword [esp + 0xc], eax
cmp word [ebp + 8], 0
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x40f95a
push esi
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetCurrentDirectoryW]
xor eax, eax
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor ecx, esp
call fcn.00401200
mov esp, ebp
pop ebp
ret 4
push 0x3d
pop eax
push dword [ebp + 8]
mov word [esp + 0x10], ax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
mov word [esp + 0xe], ax
lea ecx, [esp + 0xc]
push 0x3a
pop eax
mov word [esp + 0x10], ax
xor eax, eax
mov word [esp + 0x12], ax
call fcn.00401e96
test eax, eax
je 0x418e32
push eax
mov edx, edi
mov ecx, esi
call fcn.00401da3
jmp 0x4051c2
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
mov word [esi], ax
push 0x3a
pop eax
mov word [esi + 2], ax
push 0x5c
pop eax
mov word [esi + 4], ax
xor eax, eax
mov word [esi + 6], ax
inc eax
jmp 0x4051c4
Function at 0x4059c9
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push ecx
mov dword [ebp - 0xc], esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
cmp byte [0x441812], 0
pop ecx
mov dword [ebp - 4], eax
jne 0x41e4a8
push edi
mov edi, dword [ebp + 0xc]
mov eax, 0x2000
cmp esi, eax
ja 0x41e4bb
test esi, esi
je 0x405a40
push 0
push 0
push eax
push 0x427800
push 0xffffffffffffffff
push ebx
push 0
push dword [0x426120]
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
push 0
push edi
lea esi, [eax - 1]
push esi
push 0x427800
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
test eax, eax
je 0x405a51
cmp dword [edi], esi
jne 0x405a51
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
jmp 0x405a48
push 0
push dword [ebp + 0xc]
push esi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
jmp 0x405a49
push 0
push 0
push eax
push 0x427800
push 0x1000
push ebx
push 0
push dword [0x426120]
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
push 0
push edi
push eax
push 0x427800
push dword [ebp - 4]
mov ecx, 0x2000
mov dword [ebp - 8], eax
add ebx, ecx
sub esi, ecx
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
test eax, eax
je 0x405a51
mov eax, dword [ebp - 8]
cmp dword [edi], eax
je 0x4059f7
jmp 0x405a51
Function at 0x405e36
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 1
push 0
mov edi, ecx
mov dword [ebp - 0x10], edx
push 0
push edi
mov dword [ebp - 8], edi
mov esi, 0x427800
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp ebx, 0x1fff
jb 0x405e6e
mov ebx, 0x1fff
push 0x4261a4
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_AcquireSRWLockShared]
mov ecx, dword [ebp + 0xc]
push 0
push ecx
push ebx
push 0x427800
push edi
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
push 0x4261a4
mov edi, eax
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockShared]
test edi, edi
je 0x406b89
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
test edi, edi
je 0x406b89
mov ecx, edi
mov dword [ebp - 4], ecx
jle 0x405ee6
nop
cmp ecx, 3
jl 0x405ecd
mov al, byte [esi]
cmp al, 0xa
je 0x41dbfb
cmp al, 0xd
je 0x405f62
movzx eax, byte [esi]
cmp byte [eax + 0x4267e0], 0
jne 0x41dc0a
dec ecx
inc esi
mov dword [ebp - 4], ecx
test ecx, ecx
jg 0x405eb6
mov ecx, dword [0x426120]
call fcn.00405f23
test eax, eax
je 0x406b94
mov eax, 1
push ebx
push dword [ebp - 0x10]
push edi
push 0x427800
push eax
push ecx
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret 8
cmp byte [esi + 1], 0xa
jne 0x405ecd
mov eax, dword [ebp - 0xc]
mov edi, esi
sub edi, 0x427800
mov byte [esi + 2], 0
push 0
add edi, 2
push 0
add eax, edi
push eax
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
jmp 0x405ee6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
jmp 0x405efe
cmp byte [esi + 1], 0xd
jne 0x405ec5
jmp 0x405f6c
cmp ecx, 1
je 0x41dc1a
sub ecx, 2
add esi, 2
jmp 0x405edf
push 0x4261a4
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_AcquireSRWLockShared]
push 0
lea eax, [ebp - 4]
inc esi
push eax
push 1
push esi
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
push 0x4261a4
mov esi, eax
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockShared]
test esi, esi
je 0x41dc55
cmp dword [ebp - 4], 0
je 0x41dc55
inc edi
jmp 0x405ee6
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
jmp 0x406b89
Function at 0x40a216
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40a278
call fcn.0040a294
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40a26b
cmp eax, 0xffffffff
je 0x40a26b
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40a264
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40a264
cmp edx, 0x10000000
jae 0x40a264
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.004026da
ret 4
Function at 0x40b09e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4261d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x24
mov esi, ecx
pop ecx
call fcn.0040592e
mov edi, eax
mov ecx, edi
mov dword [edi], esi
call fcn.0040ae97
mov eax, dword [edi + 0x18]
mov ecx, 0x208
mov ebx, dword [edi]
mov esi, dword [edi + 0xc]
mov dword [ebp - 0x214], eax
call fcn.0040592e
xor ecx, ecx
mov dword [0x4260a0], eax
push ecx
mov edx, 0x104
mov ecx, eax
call fcn.00405193
push ebx
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.00402d3f
test eax, eax
jne 0x40f1f0
push 0x5c
pop eax
mov edx, eax
lea ecx, [ebp - 0x210]
call fcn.00402580
xor ecx, ecx
mov edx, 0x104
mov word [eax + 2], cx
lea eax, [ebp - 0x210]
push eax
mov ecx, 0x4269e0
call fcn.00401da3
test esi, esi
je 0x40b1c4
movzx eax, word [esi]
push 0x3a
pop ecx
cmp ax, cx
je 0x40b1c4
push 0x5c
pop edx
cmp ax, dx
jne 0x40b189
cmp esi, ebx
je 0x40f1f8
mov eax, ebx
xor ecx, ecx
cmp word [eax], cx
je 0x40b171
mov ecx, eax
add eax, 2
cmp eax, esi
jne 0x40b161
movzx eax, word [ecx]
push 0x3a
pop ecx
cmp ax, cx
je 0x40f1f8
cmp ax, dx
je 0x40f1f8
movzx eax, word [esi]
mov dword [ebp - 0x218], eax
xor eax, eax
push ebx
mov word [esi], ax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f200
and dword [0x4260a4], 0
mov eax, dword [ebp - 0x218]
mov word [esi], ax
cmp dword [0x4260a4], 0
jne 0x40f1f0
mov ecx, edi
call fcn.0040ae97
mov eax, dword [ebp - 0x214]
mov dword [edi + 0x18], eax
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401200
mov esp, ebp
pop ebp
ret
xor eax, eax
inc eax
jmp 0x40b1d6
add esi, 2
jmp 0x40b189
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [0x4260a4], eax
jmp 0x40b1ae
Function at 0x40bf5e
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28c
mov eax, dword [0x4261d4]
xor eax, esp
mov dword [esp + 0x288], eax
xor eax, eax
lea edx, [esp + 4]
push ebx
xor ebx, ebx
mov dword [esp + 0x18], eax
push esi
push edi
mov dword [esp + 0x10], ebx
lea edi, [esp + 0x74]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov byte [esp + 0x64], bl
mov dword [esp + 0x68], ebx
mov dword [esp + 0x70], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [0x42607c]
mov dword [esp + 0x14], 6
mov dword [esp + 0x18], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x6c], ebx
call fcn.0040c188
cmp eax, 1
je 0x41eeb2
lea eax, [esp + 0x80]
push eax
push 0x106
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetCurrentDirectoryW]
cmp dword [esp + 0x58], ebx
je 0x41eea5
or dword [esp + 0x10], 0x10000
lea ecx, [esp + 0x10]
call fcn.0040c072
mov esi, eax
mov edx, 0x104
lea eax, [esp + 0x80]
mov ecx, 0x4269e0
push eax
call fcn.00401da3
mov ecx, edi
call fcn.004059a0
mov eax, esi
mov ecx, dword [esp + 0x294]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401200
mov esp, ebp
pop ebp
ret
push ebx
push 0x232a
call fcn.0040bd02
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x40c058
Function at 0x40c230
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
test edx, 0x400
jne 0x41eec5
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U_WithStatus]
test eax, eax
js 0x41eec5
cmp word [ebp - 0x24], di
ja 0x41eeba
mov eax, edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x1c], eax
push 0x5040
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x14]
push 4
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x18
push eax
push 0x10000
lea eax, [ebp - 4]
mov dword [ebp - 0x30], 0x40
push eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test esi, esi
js 0x41eec5
mov ecx, dword [ebp - 4]
call fcn.0040c301
test eax, eax
jne 0x416cf1
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test esi, esi
je 0x41eec5
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
call fcn.00423acd
mov esi, eax
jmp 0x40c2e2
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x24]
jmp 0x40c279
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_DeleteFileW]
test eax, eax
jne 0x40c2f3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edi, eax
jmp 0x40c2f3