joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003070
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100100a0]
test eax, eax
je 0x10003128
mov dword [esp], ebx
call eax
sub esp, 4
test eax, eax
mov dword [ebx + 8], eax
jns 0x100030b0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1000309c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1000315d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
mov dword [0x100100a0], eax
test eax, eax
jne 0x1000308d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1000309e
Function at 0x7cea30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x20b000]
mov dword [edi + 0x2cd47c], 0xadebfe5f
push edi
jmp 0x7cea5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7cea61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7cea50
mov eax, 1
add ebx, ebx
jne 0x7cea73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7cea84
jne 0x7ceaa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7ceaa3
dec eax
add ebx, ebx
jne 0x7cea90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7cea68
add ebx, ebx
jne 0x7cea9f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7ceaf5
xor ecx, ecx
sub eax, 3
jb 0x7ceabb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7ceb2a
sar eax, 1
mov ebp, eax
jmp 0x7ceac6
add ebx, ebx
jne 0x7ceac6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7cea94
inc ecx
add ebx, ebx
jne 0x7cead4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7cea94
add ebx, ebx
jne 0x7ceae1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7cead6
jne 0x7ceaf2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7cead6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7ceb14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7ceb06
jmp 0x7cea56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7ceb14
add edi, ecx
jmp 0x7cea56
pop esi
mov edi, esi
mov ecx, 0xef8c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7ceb32
cmp byte [edi], 0x26
jne 0x7ceb32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7ceb37
lea edi, [esi + 0x3bd000]
mov eax, dword [edi]
or eax, eax
je 0x7cebaf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3f77b4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3f7988]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7ceb64
mov ecx, edi
jns 0x7ceb93
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3f7990]
or eax, eax
je 0x7ceba9
mov dword [ebx], eax
add ebx, 4
jmp 0x7ceb81
call dword [esi + 0x3f798c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x7cebe0
cmp al, 0xef
ja 0x7cebd3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x7cebb5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x7cebc2
mov ebp, dword [esi + 0x3f7994]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x26f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7cec14
sub esp, 0xffffff80
jmp 0x5c9f5a
Function at 0x401a6d
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push dword [0x44fc48]
call fcn.00411ecf
mov esi, eax
or ebp, 0xffffffff
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, dword [esp + 0x28]
mov ecx, eax
movzx edx, word [ecx]
test dx, dx
je 0x401ba0
mov eax, dword [esi]
mov esi, edx
mov edx, dword [esp + 0x28]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0x20
push 0x22
pop edi
movzx eax, si
cmp si, word [esp + 0x18]
jne 0x401ad3
push 0x20
pop esi
add ecx, 2
movzx eax, word [ecx]
cmp ax, si
je 0x401ac8
mov dword [esp + 0x10], 1
cmp ax, di
jne 0x401b0d
add ecx, 2
mov edi, ecx
movzx eax, word [ecx]
mov esi, eax
test ax, ax
je 0x401b6b
push 0x22
mov edx, eax
pop ebx
movzx esi, dx
cmp dx, bx
je 0x401b67
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
mov esi, eax
test ax, ax
jne 0x401af4
jmp 0x401b67
test ax, ax
je 0x401b7b
push 0x22
pop ebx
push 0x20
mov edi, ecx
movzx eax, ax
pop ebp
movzx esi, ax
cmp ax, bp
je 0x401b63
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
cmp ax, bx
jne 0x401b58
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
je 0x401b58
mov esi, eax
movzx edx, si
cmp si, bx
je 0x401b58
add ecx, 2
movzx eax, word [ecx]
mov esi, eax
mov edx, eax
test ax, ax
jne 0x401b41
movzx eax, dx
movzx esi, dx
test dx, dx
jne 0x401b1d
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov edx, ecx
test si, si
je 0x401b75
add ecx, 2
mov eax, dword [esp + 0x10]
jmp 0x401b7f
xor eax, eax
xor edi, edi
cmp dword [esp + 0x1c], ebp
jne 0x401b89
test ebx, ebx
jne 0x401ba8
test eax, eax
je 0x401b92
inc ebp
mov dword [esp + 0x14], ebp
movzx eax, word [ecx]
mov esi, eax
test ax, ax
jne 0x401ab8
test ebx, ebx
jne 0x401bbc
mov eax, ebp
jmp 0x401bc1
test edi, edi
je 0x401bbc
mov eax, dword [esp + 0x20]
sub edx, edi
sar edx, 1
mov dword [ebx], edx
inc dword [eax]
mov eax, edi
jmp 0x401bc1
and dword [ebx], 0
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x402feb
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0x45021c]
call fcn.00411ecf
xor ebx, ebx
mov esi, eax
cmp dword [0x44fe74], ebx
jne 0x4030bd
xor ebp, ebp
inc ebp
mov dword [0x44fe74], ebp
call fcn.0041adbb
mov edi, 0xa8
push edi
push ebx
push 0x44fdc8
call fcn.004011e0
add esp, 0xc
mov dword [0x44fdc8], 0x13
lea eax, [esp + 0x10]
mov dword [0x44fdcc], edi
mov dword [0x44fdd8], 0x402e9a
mov dword [0x44fddc], 0x402e73
push eax
mov dword [0x44fe30], 0x4031c5
mov dword [0x44fe34], 0x4031ed
mov dword [0x44fdd4], 0x4031a0
mov dword [0x44fe58], 0x4032a8
mov dword [0x44fe78], ebp
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4030bd
cmp dword [esp + 0x20], ebp
je 0x4030b7
cmp dword [esp + 0x20], 2
jne 0x4030bd
cmp dword [esp + 0x14], 5
jb 0x4030b7
jne 0x4030bd
cmp dword [esp + 0x18], ebx
jne 0x4030bd
mov dword [0x44fe78], ebx
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.0041aaae
mov eax, dword [esp + 0x140]
push ebx
push dword [0x44f918]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebx
push str.BUTTON
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
test edi, edi
je 0x403191
mov ebp, dword [esp + 0x128]
push ebp
push dword [0x450218]
call fcn.00413d6f
mov esi, dword [esp + 0x13c]
mov ebx, eax
mov dword [ebx + 0x10], esi
test esi, esi
je 0x403162
push esi
call fcn.0040e0f6
test eax, eax
je 0x403162
push 0
push 0
push esi
call fcn.0040e1d5
jmp 0x403164
xor eax, eax
push 0x4035bd
push 0xfffffffffffffffc
mov dword [ebx + 0x18], eax
and dword [ebx + 0x14], 0
and dword [ebx + 0x1c], 0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x44fdc8
push edi
push ebx
push ebp
mov dword [0x44fe70], eax
call fcn.0041ab03
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 0x1c
Function at 0x4059ac
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x450218]
call fcn.00413dec
mov ebx, eax
test ebx, ebx
je 0x405a10
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x4059d5
push dword [esp + 0xc]
push ebx
call eax
jmp 0x405a10
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.00413c10
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call fcn.004137cd
pop ecx
sub edi, eax
push edi
call fcn.00413cb0
pop edi
pop esi
pop ebx
ret 8

Function at 0x405a53
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push dword [0x45021c]
call fcn.00411ecf
xor ebx, ebx
mov ebp, eax
cmp dword [0x450300], ebx
jne 0x405ae7
mov esi, 0xa8
push esi
push ebx
push 0x450258
call fcn.004011e0
add esp, 0xc
mov dword [0x45025c], esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [0x450258], 0xa
mov dword [0x450260], 0x405f59
push 0x7f89
push ebx
mov dword [0x4502d0], 0x41be3b
mov dword [0x4502d4], 0x409662
mov dword [0x450264], 0x405f39
mov dword [0x4502e8], 0x405f78
call esi
mov dword [0x450300], eax
test eax, eax
jne 0x405ae7
push 0x7f00
push ebx
call esi
mov dword [0x450300], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0041aaae
push ebx
push dword [0x44f918]
push 0xffffffffffffffff
push dword [ebp]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push 0x40010000
push dword [esp + 0x48]
push str.STATIC
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x405bb3
push edi
push dword [esp + 0x14]
push dword [0x450218]
call fcn.00413d6f
mov edi, eax
push 8
or dword [edi + 0x10], 0xffffffff
call dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
push 0
mov dword [edi + 0x14], eax
push dword [0x44f914]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov esi, eax
push 0x450258
push ebx
push edi
push dword [esp + 0x20]
mov dword [esi], ecx
mov ecx, dword [esp + 0x40]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xc], ecx
mov byte [esi + 0x10], 0
mov dword [edi + 0x1c], esi
call fcn.0041ab03
push 0x405bbb
push 0xfffffffffffffffc
push dword [edi]
mov ebx, eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 0x20
Function at 0x408869
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push 0
push 0
push 0x1304
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x4088dc
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, ebp
and ecx, dword [esp + 0x14]
push esi
push edi
cmp ecx, 0xffffffff
jne 0x408897
mov ebp, eax
push dword [ebx]
call fcn.00408d0b
push ebp
push dword [ebx]
mov edi, eax
call fcn.00408ce4
add esp, 0xc
mov esi, eax
push 0
push ebp
push 0x130c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push dword [ebx]
call fcn.00408d2b
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x40bc9c
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
push ebx
push ebp
push esi
push edi
push dword [0x45021c]
call fcn.00411ecf
xor ebx, ebx
mov edi, eax
cmp dword [0x450cd0], ebx
jne 0x40be09
mov esi, 0xa8
push esi
push ebx
push 0x450c28
call fcn.004011e0
add esp, 0xc
mov dword [0x450c28], 0x1b
mov dword [0x450c2c], esi
mov dword [0x450c30], 0x40cc86
mov dword [0x450c34], 0x40c3d1
mov dword [0x450c4c], 0x40c0af
mov dword [0x450c5c], 0x40507a
mov dword [0x450c54], 0x40c416
mov dword [0x450c50], 0x40c46b
mov dword [0x450c3c], 0x40c608
mov dword [0x450c38], 0x40c64f
mov dword [0x450c40], 0x40c698
mov dword [0x450c44], 0x40c718
mov dword [0x450c68], 0x40c75f
mov dword [0x450c6c], 0x40c7e8
mov dword [0x450c60], 0x40c82d
mov dword [0x450c64], 0x40c8c9
mov dword [0x450ca0], 0x40ca1b
mov dword [0x450ca4], 0x40ca74
mov dword [0x450ca8], 0x40cacf
mov dword [0x450cac], 0x40cb41
mov dword [0x450cb0], 0x40cb7b
mov dword [0x450cb4], 0x40cb9d
mov dword [0x450c98], 0x40cbbf
mov dword [0x450cc8], 0x40c305
mov dword [0x450ccc], 0x40c037
call fcn.0041adbb
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40bdff
cmp dword [esp + 0x24], 2
jne 0x40bdff
cmp dword [esp + 0x18], 6
jb 0x40bdff
mov eax, dword [0x450210]
mov dword [0x450cd4], eax
mov dword [0x450cd0], 1
mov esi, dword [esp + 0x140]
not esi
and esi, 2
or esi, 0x50010000
test byte [esp + 0x140], 1
jne 0x40be28
or esi, 5
test byte [esp + 0x140], 0x20
je 0x40be35
or esi, 0x20
push 0x1f4
push ebx
push dword [0x44f914]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x13c]
push eax
call fcn.0041aaae
test ebp, ebp
je 0x40bf75
push ebx
push dword [0x44f918]
push 0xffffffffffffffff
push dword [edi]
push dword [esp + 0x14c]
push dword [esp + 0x14c]
push dword [esp + 0x14c]
push dword [esp + 0x14c]
push esi
push ebx
push str.SysTreeView32
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x40bf79
push dword [esp + 0x12c]
push dword [0x450218]
call fcn.00413d6f
push 0x40cebe
push 0xfffffffffffffffc
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 4
push 4
push 0x112c
push ebx
mov dword [0x450cd8], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x450c28
push ebx
push edi
push dword [esp + 0x138]
mov dword [edi + 0x14], ebp
mov dword [edi + 0x18], 0x19
call fcn.0041ab03
mov ebx, eax
mov eax, 0x100
test dword [esp + 0x140], eax
je 0x40bf79
or esi, eax
push esi
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowLongW]
test dword [esp + 0x140], 0x10000
je 0x40bf79
call fcn.0040d08b
cmp eax, 0x3c
jg 0x40bf48
push edi
call fcn.0040c058
pop ecx
push 0
push 2
push 0x1108
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x40bf65
push eax
push dword [edi]
call fcn.0041c3b8
push edi
push str.PB_3State
push dword [edi]
call dword [sym.imp.USER32.dll_SetPropW]
jmp 0x40bf79
mov ebx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x118
ret 0x18
Function at 0x40d08b
Capabilities:
Check os version

Disassembly:
sub esp, 0x34c
push ebp
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x114
push eax
mov esi, 0xc8
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40d20f
mov eax, dword [esp + 0x1c]
sub eax, 1
je 0x40d1f2
sub eax, 1
jne 0x40d20f
lea eax, [esp + 0x120]
xor edi, edi
push eax
call fcn.0040d21b
pop ecx
test eax, eax
je 0x40d0ff
mov ecx, dword [esp + 0x124]
mov eax, dword [esp + 0x128]
mov ebp, dword [esp + 0x12c]
cmp byte [esp + 0x23a], 1
jmp 0x40d130
lea eax, [esp + 0x23c]
mov dword [esp + 0x23c], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40d20f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp byte [esp + 0x356], 1
jne 0x40d135
xor edi, edi
inc edi
sub ecx, 3
je 0x40d1ee
sub ecx, 1
je 0x40d1ea
sub ecx, 1
je 0x40d1c5
sub ecx, 1
je 0x40d175
sub ecx, 4
jne 0x40d20f
test eax, eax
jne 0x40d20f
cmp ebp, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x40d20f
sub eax, 0
je 0x40d1b7
sub eax, 1
je 0x40d1a9
sub eax, 1
je 0x40d19b
sub eax, 1
jne 0x40d20f
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x40d20f
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x40d20f
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x40d20f
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x40d20f
sub eax, 0
je 0x40d1e6
sub eax, 1
je 0x40d1e2
sub eax, 1
jne 0x40d20f
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x40d20f
push 0x3c
jmp 0x40d20e
push 0x32
jmp 0x40d20e
push 0x14
jmp 0x40d20e
push 5
jmp 0x40d20e
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d20c
cmp eax, 0xa
je 0x40d208
cmp eax, 0x5a
jne 0x40d20f
push 0x28
jmp 0x40d20e
push 0x1e
jmp 0x40d20e
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x34c
ret
Function at 0x40d4d6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x450f64]
call fcn.00413dec
mov esi, eax
test esi, esi
je 0x40d5b0
cmp dword [ebp + 0xc], 0
je 0x40d522
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x40d513
cmp dword [esi + 0x1c], 0
jne 0x40d513
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40d5b0
test byte [ebp + 0x10], 3
je 0x40d53d
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.0041cdcb
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x40d562
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x40d576
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x40d593
test ebx, ebx
je 0x40d587
push 8
jmp 0x40d599
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x40d5a6
test ebx, ebx
je 0x40d59c
push 3
pop ecx
jmp 0x40d5a6
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x410896
Capabilities:
Copy file

Disassembly:
cmp dword [esp + 4], 0
je 0x4108b6
cmp dword [esp + 8], 0
je 0x4108b6
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x4108b8
xor eax, eax
ret 8

Function at 0x4108bb
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x410933
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call fcn.00413bc7
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.004137cd
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x410914
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x410911
cmp ecx, 0x5c
je 0x410911
cmp ecx, 0x2f
jne 0x41091e
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x4108fe
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x410935
xor eax, eax
leave
ret 4
Function at 0x410c76
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x410c9f
test byte [esp + 8], 2
je 0x410c93
push 0x80
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x410ca1
xor eax, eax
ret 8

Function at 0x410d56
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0x450ed8]
push esi
test eax, eax
jne 0x410d7b
push fcn.00410d24
push 0x10
push 0x258
call fcn.00413e4e
mov dword [0x450ed8], eax
push dword [esp + 0xc]
push eax
call fcn.00413d6f
mov esi, eax
test esi, esi
je 0x410e7c
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x410d9d
mov edi, 0x443ad4
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x410dad
xor eax, eax
cmp word [ebx], ax
jne 0x410db2
mov ebx, 0x443a98
push edi
call fcn.004137cd
push ebx
mov dword [esp + 0x24], eax
call fcn.004137cd
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x44f914]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x410e63
push edi
push eax
call fcn.004137ab
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x410e13
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x410e17
push 0x442d08
push edi
call fcn.0041377a
pop ecx
pop ecx
jmp 0x410e17
mov edi, dword [esp + 0x18]
push ebx
push edi
call fcn.0041377a
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x410e3b
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x410e51
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x410e4f
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0x44f914]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x410e7a
cmp dword [esp + 0x14], 0xffffffff
je 0x410e6e
mov esi, dword [esp + 0x14]
push esi
push dword [0x450ed8]
call fcn.00413e14
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc
Function at 0x410ec7
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x41100f
xor ecx, ecx
cmp word [eax], cx
je 0x41100f
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00413bc7
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call fcn.004137cd
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x410f20
cmp eax, 3
jne 0x410f5a
cmp word [esp + 0xa], 0x3a
jne 0x410f5a
cmp eax, 2
jne 0x410f3e
lea eax, [esp + 8]
push 0x442d08
push eax
call fcn.0041377a
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x41100f
push 0xfffffffffffffffe
pop edi
jmp 0x41100f
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x410f6f
cmp ax, bx
jne 0x410f79
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x410f62
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x410fb8
test byte [esp + 0x21c], 0x10
je 0x410f9f
push 0xfffffffffffffffe
pop edi
jmp 0x410faf
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x41100d
cmp word [esp + 0x10], bp
jne 0x410fc6
cmp word [esp + 0x12], bp
je 0x410fe5
cmp word [esp + 0x10], bx
jne 0x410fd4
cmp word [esp + 0x12], bx
je 0x410fe5
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x41100d
cmp word [esp + 0x12], ax
jne 0x41100d
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x410ffa
test al, 0x10
je 0x41100d
jmp 0x41100a
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x41100d
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x411300
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x41133c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4