joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a83f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x57e840]
xor edx, edx
cmp eax, edx
jne 0x4a8416
xor eax, eax
mov byte [eax + 0x57e740], al
inc eax
cmp eax, 0x100
jl 0x4a83fe
mov dword [0x57e840], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x57e740
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4a84a7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4a847a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4a8448
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4a8520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4a8573
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4a855a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4aeef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e0cae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004af810
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x51f634
call fcn.004cf5ed
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4aef83
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004cf5ed
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4aef7c
push 0
mov ecx, eax
call fcn.004a6020
mov dword [esi + 0xc], eax
jmp 0x4aef85
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4aef85
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4d1c8f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4d1cc7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004cfd07
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004cfcdf
jmp 0x4d1cd3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4d348a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4d34cc
call fcn.004d96bc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4d34cc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4d34c3
xor eax, eax
jmp 0x4d34d4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004d34da
pop edi
pop esi
pop ebx
ret 4
Function at 0x4d4f86
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword [esp + 4]
mov ecx, 0x10b
cmp eax, ecx
ja 0x4d5154
je case.0x4d5035.52
cmp eax, 0x3e
ja 0x4d5044
je 0x4d5040
cmp eax, 0x19
ja 0x4d4fd8
je case.0x4d4fbc.24
cmp eax, 0x18
ja case.0x4d5035.56
jmp dword [eax*4 + 0x4d517c]
xor eax, eax
jmp 0x4d5088
push 4
jmp 0x4d5087
push 2
jmp 0x4d5087
cmp eax, 0x27
ja 0x4d5029
je 0x4d50c0
cmp eax, 0x20
ja 0x4d500d
je 0x4d5009
sub eax, 0x1a
je case.0x4d5035.60
dec eax
je case.0x4d4fbc.24
dec eax
dec eax
je case.0x4d5035.54
dec eax
jne case.0x4d5035.56
push 9
jmp 0x4d5087
push 0xb
jmp 0x4d5087
sub eax, 0x21
je 0x4d511c
dec eax
je case.0x4d5035.52
dec eax
dec eax
je case.0x4d4fbc.4
dec eax
dec eax
jne case.0x4d5035.56
push 0xe
jmp 0x4d5087
add eax, 0xffffffcc
cmp eax, 8
ja case.0x4d5035.56
jmp dword [eax*4 + 0x4d51e0]
push 3
jmp 0x4d5087
push 8
jmp 0x4d5087
cmp eax, 0x6b
ja 0x4d508f
je case.0x4d4fbc.2
cmp eax, 0x47
ja 0x4d506c
je case.0x4d5035.54
sub eax, 0x40
je case.0x4d5035.54
dec eax
je case.0x4d5035.54
dec eax
je case.0x4d5035.60
dec eax
je case.0x4d5035.52
dec eax
je case.0x4d4fbc.4
jmp 0x4d514b
sub eax, 0x50
je case.0x4d5035.54
dec eax
dec eax
je case.0x4d5035.54
sub eax, 3
je case.0x4d5035.52
dec eax
je case.0x4d5035.54
dec eax
dec eax
jne case.0x4d5035.56
push 0xa
pop eax
ret 4
push 5
jmp 0x4d5087
mov ecx, 0x90
cmp eax, ecx
ja 0x4d50e9
je case.0x4d5035.52
cmp eax, 0x75
ja 0x4d50c4
je case.0x4d5035.57
sub eax, 0x6c
je 0x4d511c
sub eax, 3
je case.0x4d5035.52
dec eax
je 0x4d50c0
dec eax
je case.0x4d4fbc.4
dec eax
jne case.0x4d5035.56
push 6
jmp 0x4d5087
push 0xd
jmp 0x4d5087
sub eax, 0x7b
je case.0x4d5035.52
dec eax
je case.0x4d5035.52
dec eax
je case.0x4d5035.52
sub eax, 6
je case.0x4d4fbc.24
jmp 0x4d4ffe
mov ecx, 0xb6
cmp eax, ecx
ja 0x4d512a
je case.0x4d5035.60
sub eax, 0x91
je case.0x4d4fbc.16
sub eax, 9
je case.0x4d5035.52
sub eax, 7
je case.0x4d5035.52
sub eax, 6
je 0x4d511c
sub eax, 3
jne case.0x4d5035.56
jmp case.0x4d5035.54
push 0xc
jmp 0x4d5087
push 7
jmp 0x4d5087
sub eax, 0xb7
je case.0x4d5035.54
sub eax, 8
je case.0x4d5035.60
dec eax
dec eax
je case.0x4d5035.60
sub eax, 0xd
je case.0x4d5035.52
dec eax
dec eax
jne case.0x4d5035.56
jmp case.0x4d5035.52
sub eax, 0x3e3
je case.0x4d5035.57
dec eax
je case.0x4d5035.57
dec eax
je case.0x4d5035.57
dec eax
dec eax
je case.0x4d5035.54
push 1
jmp 0x4d5087

Function at 0x4d9bec
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d9c1a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d9c38
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d9b52
jmp 0x4d9c38
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d9c38
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d9b52
test edi, edi
mov eax, edi
jne 0x4d9c22
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x415f73
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x415fb2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x415fb2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415fb2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x415fb2
cmp dword [ecx + 0x74], 0xe
jbe 0x415fb2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x428380
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4283ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4283ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x100145b
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10018e8
call fcn.010015f4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1002370
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1001270
cmp eax, esi
jne 0x1001263
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1001273
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100124a
xor esi, esi
inc esi
mov eax, dword [0x100236c]
cmp eax, esi
jne 0x1001286
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10012c1
mov eax, dword [0x100236c]
test eax, eax
jne 0x10012bb
mov dword [0x100236c], esi
push 0x1001098
push 0x100108c
call fcn.010011c7
pop ecx
pop ecx
test eax, eax
je 0x10012c1
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x100138b
mov dword [0x1002034], esi
mov eax, dword [0x100236c]
cmp eax, esi
jne 0x10012e5
push 0x1001088
push 0x1001080
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100236c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x10012f2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1002374], ebx
je 0x1001313
push 0x1002374
call fcn.01001569
pop ecx
test eax, eax
je 0x1001313
push ebx
push 2
push ebx
call dword [0x1002374]
push dword [0x100201c]
push dword [0x1002020]
push dword [0x1002018]
call fcn.01001195
add esp, 0xc
mov dword [0x1002030], eax
cmp dword [0x1002024], ebx
jne 0x1001371
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1002034], ebx
jne 0x100137f
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1002030]
call fcn.01001639
ret
call fcn.01001741
jmp 0x1001228
Function at 0x401000
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
cmp dword [0x424838], 0
push esi
push edi
jne 0x401117
push 1
xor eax, eax
pop esi
lea edi, [ebp - 0x118]
push 0x46
mov dword [0x424838], esi
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x401117
push 2
pop ecx
cmp dword [ebp - 0x10c], ecx
jne 0x401117
mov edx, dword [ebp - 0x118]
cmp edx, 4
jbe 0x401117
push 5
pop edi
cmp edx, edi
jne 0x4010cb
cmp dword [ebp - 0x114], 0
jne 0x401082
mov eax, ecx
jmp 0x401110
cmp dword [ebp - 0x114], esi
jne 0x4010bb
mov ax, word [ebp - 8]
test ax, ax
jne 0x401097
push 3
jmp 0x4010ec
cmp ax, si
jne 0x4010a0
push 4
jmp 0x4010ec
cmp ax, cx
jne 0x4010a9
push 6
jmp 0x4010ec
cmp ax, 3
jne 0x4010fe
mov dword [0x424834], 7
jmp 0x4010fe
cmp dword [ebp - 0x114], ecx
jne 0x4010fe
mov dword [0x424834], edi
jmp 0x4010fe
cmp edx, 6
jne 0x4010fe
mov eax, dword [ebp - 0x114]
test eax, eax
jne 0x4010de
push 8
jmp 0x4010ec
cmp eax, esi
jne 0x4010e6
push 9
jmp 0x4010ec
cmp eax, ecx
jne 0x4010ef
push 0xa
pop eax
jmp 0x401110
cmp eax, 3
jne 0x4010fe
mov dword [0x424834], 0xb
mov eax, dword [0x424834]
test eax, eax
jne 0x40111c
cmp edx, edi
sbb eax, eax
and al, 0xf5
add eax, 0xc
mov dword [0x424834], eax
jmp 0x40111c
mov eax, dword [0x424834]
pop edi
pop esi
leave
ret

Function at 0x401120
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4008
call fcn.0041b1d0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov dword [ebp - 4], edi
je 0x4011fb
cmp dword [ebp + 0xc], edi
je 0x4011fb
mov esi, dword [ebp + 0x10]
cmp esi, edi
je 0x4011fb
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4011fb
mov word [ebp - 0x4008], di
mov ecx, 0xfff
xor eax, eax
lea edi, [ebp - 0x4006]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0x10]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4011fb
cmp eax, 0x2000
ja 0x4011fb
lea ecx, [ebp - 0x4008]
push ecx
push eax
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4011f6
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x4008]
push 0x42209c
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4011f6
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0xc]
push ecx
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
push ecx
movzx ecx, word [eax + 8]
mov eax, dword [eax + 8]
push ecx
shr eax, 0x10
push eax
dec esi
push 0x422084
push esi
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x1c
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
jmp 0x4011fd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40135e
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
je 0x4013e6
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x4013e6
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], bx
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x208]
push 0x4220a8
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
pop edi
je 0x4013e2
lea eax, [ebp - 0x208]
dec esi
push eax
push 0x4220a0
push esi
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push 1
pop ebx
mov eax, ebx
jmp 0x4013e8
xor eax, eax
pop esi
pop ebx
leave
ret

Function at 0x4013ec
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
push esi
xor esi, esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40140d
push 1
pop eax
jmp 0x4014a0
push edi
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x7e]
mov word [ebp - 0x80], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x4220e8
lea eax, [ebp - 0x80]
push 0x3f
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x286]
mov word [ebp - 0x288], si
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x288]
push dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push esi
push 0x80
push 2
push esi
push esi
lea eax, [ebp - 0x288]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
pop edi
je 0x40149e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
pop esi
mov eax, esi
pop esi
leave
ret

Function at 0x4014a3
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x40153d
cmp word [esi], 0
je 0x40153d
mov ebx, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push esi
call ebx
test eax, eax
je 0x4014d1
push 1
pop eax
jmp 0x40153f
and word [ebp - 0x208], 0
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x4220a0
lea eax, [ebp - 0x208]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
pop edi
je 0x40153d
lea eax, [ebp - 0x208]
push eax
call ebx
test eax, eax
jne 0x401532
lea eax, [ebp - 0x208]
push eax
call fcn.004014a3
pop ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x40153f
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x401543
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x4016bd
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4016bd
and dword [ebp - 0x254], 0
mov ecx, 0x93
xor eax, eax
lea edi, [ebp - 0x250]
rep stosd dword es:[edi], eax
mov ax, word [0x42483c]
mov ebx, 0x81
mov word [ebp - 0x86c], ax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x86a]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x422114
push dword [ebp + 8]
stosw word es:[edi], ax
lea eax, [ebp - 0x86c]
push eax
call esi
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x86c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4016bd
mov edi, dword [sym.imp.MSVCRT.dll_wcscmp]
lea eax, [ebp - 0x228]
push 0x422110
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x401683
lea eax, [ebp - 0x228]
push 0x422108
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x401683
test byte [ebp - 0x254], 0x10
mov ax, word [0x42483c]
je 0x40164e
mov word [ebp - 0x45c], ax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x45a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x45c]
push dword [ebp + 8]
push eax
call esi
lea eax, [ebp - 0x45c]
push eax
call fcn.00401543
jmp 0x401682
mov word [ebp - 0x664], ax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x662]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x664]
push dword [ebp + 8]
push eax
call esi
lea eax, [ebp - 0x664]
push eax
call fcn.00401a3c
pop ecx
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4015d7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4016bf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401828
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebp
push edi
push 0x42213c
xor ebp, ebp
push dword [esp + 0x14]
mov dword [esp + 0x10], ebp
call dword [sym.imp.MSVCRT.dll__wfopen]
mov edi, eax
pop ecx
cmp edi, ebp
pop ecx
je 0x4018d2
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push ebp
push edi
call esi
push edi
call dword [sym.imp.MSVCRT.dll_ftell]
push ebp
push ebp
push edi
mov ebx, eax
call esi
lea ebp, [ebx + 1]
push ebp
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 0x20
test esi, esi
je 0x4018c8
push ebp
push 0
push esi
call sub.MSVCRT.dll_memset
push edi
push ebx
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fread]
push 0x422134
push dword [esp + 0x3c]
call dword [sym.imp.MSVCRT.dll__wfopen]
mov ebp, eax
add esp, 0x24
test ebp, ebp
je 0x4018c1
push ebp
push ebx
push 1
pop ebx
push ebx
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
mov dword [esp + 0x10], ebx
push esi
call fcn.0041b1b0
pop ecx
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
pop esi
pop ebx
mov eax, dword [esp + 8]
pop edi
pop ebp
pop ecx
ret
Function at 0x401a3c
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401a5b
push 1
pop eax
leave
ret
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push 0x80
push dword [ebp + 8]
call esi
push dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call ebx
test eax, eax
jne 0x401af4
and word [ebp - 0x20c], ax
push dword [ebp + 8]
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x422144
lea eax, [ebp - 0x20c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401ad8
lea eax, [ebp - 0x20c]
push 0x80
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call ebx
push 1
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
lea eax, [ebp - 0x20c]
push edi
push eax
push dword [ebp + 8]
call esi
test eax, eax
jne 0x401afd
jmp 0x401b0d
mov dword [ebp - 4], 1
jmp 0x401b0d
push 4
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 4], edi
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401c99
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov eax, 0x41b6bc
call fcn.0041b220
sub esp, 0x214
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
push 0x41dcf0
push 1
push ebx
push 0x41dd00
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x401d8c
mov eax, dword [ebp - 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x14], 0xffffffff
je 0x401cfd
mov eax, dword [ebp - 0x10]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x44]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
mov word [ebp - 0x220], bx
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_wcslen]
push eax
lea eax, [ebp - 0x220]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0x10
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x220]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
cmp dword [ebp + 0x10], ebx
pop edi
pop esi
je 0x401d5e
mov eax, dword [ebp - 0x10]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
push 0x41dd10
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x401d8c
mov eax, dword [ebp - 0x14]
push 2
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x401d8c
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x401d9c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
pop ebx
je 0x401dae
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], ecx
leave
ret