joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406864
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x408ed0
mov edi, 0x7bb2b0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov ebx, 0x400
test esi, esi
je 0x4068b3
push 1
push 0
push esi
call fcn.00405d20
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
push esi
call ebp
test eax, eax
je 0x4069f0
cmp eax, ebx
jg 0x4069f0
push ebx
mov esi, 0x7bdbf8
push esi
push dword [esp + 0x20]
call ebp
test eax, eax
je 0x4069f0
cmp eax, ebx
jg 0x4069f0
push esi
push edi
push str._s_s_r_n
push 0x7bb7f0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x7c7094]
push dword [eax + 0x128]
push esi
call fcn.00406609
push 4
push 0xc0000000
push esi
call fcn.00405d20
mov ebp, eax
mov dword [esp + 0x1c], ebp
cmp ebp, 0xffffffff
je 0x4069f0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4069e9
push 0
lea eax, [esp + 0x14]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4069e9
cmp edi, dword [esp + 0x10]
jne 0x4069e9
push str._Rename__r_n
push esi
call fcn.00405c86
test eax, eax
jne 0x40697b
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x4069b4
push 0x408ec4
add eax, 0xa
push eax
call fcn.00405c86
mov ebp, eax
test ebp, ebp
je 0x4069b0
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
cmp ecx, ebp
jbe 0x4069a5
sub eax, ecx
mov dl, byte [ecx]
mov byte [eax + ecx], dl
dec ecx
cmp ecx, ebp
ja 0x40699b
sub ebp, esi
lea eax, [ebp + 1]
mov ebp, dword [esp + 0x1c]
jmp 0x4069b6
mov ebp, dword [esp + 0x1c]
mov eax, edi
push ebx
push 0x7bb7f0
add eax, esi
push eax
call fcn.00405cdc
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40700a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7bdffc], 0
jne 0x407048
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40701e
mov dword [ecx*4 + 0x7bdff8], eax
inc ecx
cmp ecx, 0x100
jl 0x407019
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407075
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x7bdff8]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x407056
not eax
pop ebp
ret 0xc
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x64ea28d0
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x2e144ed6
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4111d6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x4157f4
push ebx
push esi
mov esi, ecx
mov ecx, 0x42506a
push edi
call fcn.00411771
lea edi, [esi + 0x9c4]
mov ebx, 0xe3
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x415810
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x415855
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [esi], 0
and eax, 0x9908b0df
shr ecx, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
pop esi
pop ebx
ret

Function at 0x4113ac
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x4158fe
push esi
mov esi, ecx
mov ecx, 0x42506a
call fcn.00411771
add esi, 8
mov edx, 0x270
mov ecx, dword [esi - 4]
xor ecx, dword [esi]
lea esi, [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x62c]
xor eax, ecx
mov dword [esi + 0x9b8], eax
sub edx, 1
jne 0x415913
pop esi
ret
Function at 0x41aac0
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x18
mov eax, dword [0x4635a4]
mov ecx, dword [0x4635a8]
mov dx, word [esp + 0x1c]
mov dword [esp + 8], eax
push esi
lea eax, [esp + 0xc]
push edi
push eax
mov dword [esp + 0x18], ecx
mov word [esp + 0x14], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x41aafe
xor esi, esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
jmp 0x41ab40
xor ecx, ecx
lea edx, [esp + 8]
mov dword [esp + 8], ecx
push edx
push ecx
lea eax, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x41ab2a
xor esi, esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
jmp 0x41ab40
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 8]
test edx, edx
ja 0x41ab5b
jb 0x41ab40
cmp esi, 0x400
jae 0x41ab5b
mov ecx, dword [esp + 0x28]
push esi
push 0x46360c
push ecx
call fcn.00406f70
add esp, 0xc
pop edi
pop esi
add esp, 0x18
ret 8
test edx, edx
ja 0x41ac1d
jb 0x41ab6d
cmp esi, 0x100000
jae 0x41abbe
mov ecx, 0xa
mov eax, esi
call fcn.00443bc0
push 0
and esi, 0x3ff
push 0x64
push 0
push esi
mov edi, eax
mov dword [esp + 0x2c], edx
call fcn.00443b50
mov ecx, eax
or ecx, edx
jne 0x41abb2
mov edx, dword [esp + 0x28]
push edi
push 0x463600
push edx
call fcn.00406f70
add esp, 0xc
pop edi
pop esi
add esp, 0x18
ret 8
push eax
push edi
push 0x4635ec
jmp 0x41ac6c
test edx, edx
ja 0x41ac1d
jb 0x41abcc
cmp esi, 0x40000000
jae 0x41ac1d
mov ecx, 0x14
mov eax, esi
call fcn.00443bc0
push 0
and esi, 0xfffff
push 0x19000
push 0
push esi
mov edi, eax
mov dword [esp + 0x2c], edx
call fcn.00443b50
mov ecx, eax
or ecx, edx
jne 0x41ac14
mov edx, dword [esp + 0x28]
push edi
push 0x4635e0
push edx
call fcn.00406f70
add esp, 0xc
pop edi
pop esi
add esp, 0x18
ret 8
push eax
push edi
push 0x4635cc
jmp 0x41ac6c
mov ecx, 0x1e
mov eax, esi
call fcn.00443bc0
push 0
and esi, 0x3fffffff
push 0x6400000
push 0
push esi
mov edi, eax
mov dword [esp + 0x2c], edx
call fcn.00443b50
mov ecx, eax
or ecx, edx
jne 0x41ac65
mov edx, dword [esp + 0x28]
push edi
push 0x4635c0
push edx
call fcn.00406f70
add esp, 0xc
pop edi
pop esi
add esp, 0x18
ret 8
push eax
push edi
push 0x4635ac
mov eax, dword [esp + 0x34]
push eax
call fcn.00406f70
add esp, 0x10
pop edi
pop esi
add esp, 0x18
ret 8
Function at 0x41cb00
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x457878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
lea eax, [esp + 4]
push edi
push eax
mov ecx, 0x469c08
call fcn.004317e0
lea ecx, [esp + 8]
push 0x46354c
lea edx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x24], 0
call fcn.0040d130
push 0x469c58
push eax
lea eax, [esp + 0xc]
mov byte [esp + 0x20], 1
push eax
call fcn.0041f560
mov eax, dword [esp + 0xc]
mov edx, dword [0x46305c]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov byte [esp + 0x18], 3
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x41cb8f
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x41cb8f
mov edx, dword [esp + 0xc]
add edx, 0xfffffff4
push edx
call fcn.0043733c
add esp, 4
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41cc28
mov ecx, dword [esp + 4]
push ecx
call fcn.0041f460
add esp, 4
test eax, eax
jne 0x41cc12
push esi
mov esi, dword [esp + 8]
push 1
call fcn.00441f80
push eax
push esi
call fcn.00442210
mov eax, dword [esp + 0x14]
mov ecx, dword [0x46305c]
add esp, 0xc
lea edx, [eax - 0xc]
cmp edx, ecx
pop esi
je 0x41cbf5
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x41cbf5
mov eax, dword [esp + 4]
add eax, 0xfffffff4
push eax
call fcn.0043733c
add esp, 4
mov eax, dword [esp + 8]
mov edx, dword [0x46305c]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x41cc7e
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x41cc7e
jmp 0x41cc6e
mov eax, dword [esp + 4]
push 5
push 0x463830
push eax
push 0
call fcn.0041f700
add esp, 0x10
mov eax, dword [esp + 4]
mov edx, dword [0x46305c]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x41cc53
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x41cc53
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.0043733c
add esp, 4
mov eax, dword [esp + 8]
mov edx, dword [0x46305c]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x41cc7e
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x41cc7e
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.0043733c
add esp, 4
mov ecx, dword [esp + 0x10]
pop edi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x41e670
Capabilities:
Create process on windows

Disassembly:
push 1
push 0
push 0
push 0x463850
push 0x463234
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x41f910
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457bd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ebx, ebx
mov dword [ebp - 0x18], eax
push ebx
push ebx
push 3
push ebx
push 3
push 0x80
push 0x463868
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41f9a4
lea eax, [ebp - 0x1c]
push ebx
push eax
lea ecx, [ebp - 0x14]
push 4
push ecx
lea edx, [ebp - 0x18]
push 4
push edx
push 0x22204c
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x41f9a4
cmp dword [ebp - 0x14], ebx
je 0x41f9a4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp eax, ebx
je 0x41f9d1
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41f9d1
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebp + 0x10], ebx
je 0x41f9fb
push edi
call fcn.00442330
add esp, 4
test eax, eax
jne 0x41f9fb
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.004375d0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
xor esi, esi
call fcn.00437e50
cmp eax, ebx
je 0x41fa39
lea eax, [ebp - 0x48]
lea ecx, [ebp + 8]
push eax
push ecx
push edi
lea ecx, [ebp - 0x20]
call fcn.00437610
cmp eax, ebx
jne 0x41fa59
lea edx, [ebp + 0xc]
push edx
call fcn.00439810
add esp, 4
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.00437600
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
cmp eax, 3
je 0x41fa66
cmp eax, 2
jne 0x41fa6b
mov esi, 1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.00437600
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x421b90
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x457f38
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebp
push edi
mov edi, ecx
mov eax, dword [edi + 0x3f8]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
xor ebp, ebp
cmp eax, ebp
jne 0x421d27
mov eax, dword [0x4638f0]
push ebx
cmp eax, ebp
push esi
lea ebx, [edi + 0x3f4]
jne 0x421bda
mov dword [0x4638f0], ebp
lea ecx, [ebx + 0x1c]
push ecx
push 0x4638c0
push 0x469650
call fcn.00406550
push ebp
push eax
push ebp
push 0x80000
push SysReAllocString
push 0x463898
push 0x463788
push ebp
mov ecx, ebx
call fcn.00423140
mov eax, dword [edi + 0x70]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov esi, eax
lea eax, [esp + 0x40]
push eax
push esi
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], esi
call dword [sym.imp.USER32.dll_BeginPaint]
mov dword [esp + 0x38], eax
xor ecx, ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x2c], ecx
push edx
mov dword [esp + 0x34], ecx
push esi
mov dword [esp + 0x90], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x3c], ecx
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
push ecx
mov dword [esp + 0x24], eax
push esi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
sub edx, eax
push ebp
push edx
mov edx, dword [esp + 0x28]
sub edx, ecx
push edx
push eax
mov eax, dword [edi + 0x3f8]
push ecx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [edi + 4]
push ecx
mov ecx, ebx
call fcn.00417960
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x28]
push edx
push eax
call fcn.0042b460
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x421cf8
push 0x10
call fcn.004354c0
xor ecx, ecx
mov dword [esp + 0x14], eax
cmp eax, ecx
je 0x421cf0
lea edx, [esp + 0x10]
mov dword [eax], 0x45a5ec
push edx
push ecx
push ebp
mov dword [esp + 0x1c], ecx
call fcn.00435c70
mov ecx, dword [esp + 0x14]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x10]
mov dword [ecx + 4], eax
push ecx
mov ecx, ebx
call fcn.00417480
mov ecx, dword [edi + 0x3f8]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push ecx
call edi
mov ecx, ebx
call fcn.00417500
push 0
push esi
call edi
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x40]
push edx
push eax
call dword [sym.imp.USER32.dll_EndPaint]
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x7c
ret
Function at 0x426d00
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4584eb
push eax
mov eax, dword [0x469c64]
mov dword fs:[0], esp
sub esp, 0x204
test eax, eax
push ebx
push esi
mov esi, ecx
jne 0x426d48
mov eax, dword [esi + 0x7c4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x426d48
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.00427840
mov ecx, dword [0x463058]
mov dword [esp + 8], ecx
mov edx, dword [0x469708]
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
lea ecx, [esp + 0xc]
push pe_nt_image_headers32
mov eax, dword [edx + 8]
push ecx
push 0xa8
push eax
mov dword [esp + 0x224], 0
call ebx
test eax, eax
jne 0x426d87
mov word [esp + 0xc], ax
mov edx, pe_nt_image_headers32
sub edx, eax
cmp edx, 1
jle 0x426db7
lea eax, [esp + 0xc]
test eax, eax
je 0x426da6
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [esp + 0xc]
lea ecx, [esp + 8]
push edx
push eax
call fcn.00403e10
jmp 0x426e18
push edi
push 0x1ff
lea ecx, [esp + 0x10]
mov edi, 0x200
call fcn.00403bf0
mov esi, eax
test esi, esi
je 0x426e0c
mov eax, dword [0x469708]
push edi
push esi
push 0xa8
mov eax, dword [eax + 8]
push eax
call ebx
test eax, eax
jne 0x426dea
mov word [esi], ax
mov ecx, edi
sub ecx, eax
cmp ecx, 1
jg 0x426e0c
add edi, 0x100
lea ecx, [esp + 0xc]
lea edx, [edi - 1]
push edx
call fcn.00403bf0
mov esi, eax
test esi, esi
jne 0x426dd1
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call fcn.00403cb0
pop edi
mov eax, dword [esp + 8]
push 1
push 0
push 0
push eax
push 0x463234
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 8]
mov edx, dword [0x46305c]
pop esi
pop ebx
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x426e61
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x426e61
mov edx, dword [esp]
add edx, 0xfffffff4
push edx
call fcn.0043733c
add esp, 4
mov ecx, dword [esp + 0x204]
mov dword fs:[0], ecx
add esp, 0x210
ret

Function at 0x4271d0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xe0]
push 5
push eax
call edi
mov ecx, dword [esi + 0x7bc]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x427208
mov eax, dword [0x469c64]
test eax, eax
jne 0x427208
push 0
lea ecx, [esi + 0xa0]
call fcn.004158a0
mov edx, dword [esi + 0x1a8]
push 5
push edx
call edi
mov eax, dword [esi + 0x538]
push 5
push eax
call edi
mov eax, dword [0x469c64]
test eax, eax
jne 0x4272b3
mov ecx, dword [esi + 0x400]
push ebx
push 5
push ecx
call edi
mov edx, dword [esi + 0x400]
mov ebx, dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0x14
push 0x37
push 0xeb
push 0xb1
push edx
call ebx
mov eax, dword [esi + 0x338]
push 1
push 0x14
push 0x31
push 0xeb
push 0xe9
push eax
call ebx
mov ecx, dword [esi + 0x338]
push 0
push ecx
call edi
mov edx, dword [esi + 0x270]
push 5
push edx
call edi
mov eax, dword [esi + 0x270]
push 1
push 0x14
push 0x31
push 0xeb
push 0xe9
push eax
call ebx
mov eax, dword [0x469c64]
pop ebx
test eax, eax
jne 0x4272b3
mov ecx, dword [esi + 0x470]
push 5
push ecx
call edi
pop edi
pop esi
ret
Function at 0x42b540
Capabilities:
Get file version info

Disassembly:
mov eax, 0x200c
call fcn.00443b20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x201c]
test esi, esi
push edi
je 0x42b634
mov ebx, dword [esp + 0x2024]
test ebx, ebx
je 0x42b634
mov ebp, dword [esp + 0x2028]
cmp ebp, 0x80
jl 0x42b634
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x14], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x42b634
cmp eax, 0x1fff
ja 0x42b634
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42b634
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x24]
push 0x46354c
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42b634
mov ecx, ebp
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edx, dword [eax + 0xc]
mov cx, word [eax + 0xc]
shr edx, 0x10
push ecx
push edx
mov edx, dword [eax + 8]
xor ecx, ecx
mov cx, word [eax + 8]
shr edx, 0x10
push ecx
push edx
push 0x463acc
push ebp
push ebx
call fcn.0042a960
add esp, 0x1c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x200c
ret

Function at 0x42c9d0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x42ca1f
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x42c9ea
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x42c9f9
cmp eax, 1
jne 0x42c9f9
test ecx, ecx
je 0x42c9f9
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esi + 0x18]
mov dword [esi + 0xc], 0
push ecx
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0xffffffff
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret
Function at 0x42f690
Capabilities:
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x458966
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], 0x45abf0
mov eax, dword [esi + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push 0
push eax
mov dword [esp + 0x2c], 1
call ebx
lea edi, [esi + 8]
push 0x463ce0
lea ecx, [esp + 0x14]
push edi
push ecx
call fcn.0040d130
mov edx, dword [eax]
push 4
push 0
push edx
call ebx
mov eax, dword [esp + 0x10]
mov edx, dword [0x46305c]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x42f71d
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x42f71d
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0043733c
add esp, 4
push 0x463cc0
lea eax, [esp + 0x14]
push edi
push eax
call fcn.0040d130
mov ecx, dword [eax]
push 4
push 0
push ecx
call ebx
mov eax, dword [esp + 0x10]
mov ecx, dword [0x46305c]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x42f761
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x42f761
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0043733c
add esp, 4
mov ecx, dword [edi]
push 4
push 0
push ecx
call ebx
mov eax, dword [esi + 0xc]
mov ecx, dword [0x46305c]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x42f793
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x42f793
mov eax, dword [esi + 0xc]
sub eax, 0xc
push eax
call fcn.0043733c
add esp, 4
mov eax, dword [edi]
mov edx, dword [0x46305c]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x42f7ba
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x42f7ba
mov edx, dword [edi]
sub edx, 0xc
push edx
call fcn.0043733c
add esp, 4
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x430fa0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
test esi, esi
push edi
je 0x431092
mov ebx, dword [esp + 0x124]
test ebx, ebx
je 0x431092
mov ebp, dword [esp + 0x128]
cmp ebp, 0x80
jl 0x431092
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x14], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x431092
cmp eax, 0xff
ja 0x431092
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x431092
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x24]
push 0x46354c
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x431092
mov ecx, ebp
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edx, dword [eax + 0xc]
mov cx, word [eax + 0xc]
shr edx, 0x10
push ecx
push edx
mov edx, dword [eax + 8]
xor ecx, ecx
mov cx, word [eax + 8]
shr edx, 0x10
push ecx
push edx
push 0x463acc
push ebp
push ebx
call fcn.0042a960
add esp, 0x1c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret 0xc