joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67d84c
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6c4018
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov edx, dword [esp + 0x4c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x54]
mov eax, dword [esi + 0x198]
test eax, eax
je 0x67d9cd
test cl, 2
je 0x67d9cd
test edx, edx
jl 0x67d9cd
push ebp
push edi
lea ecx, [esi + 0x270]
push edx
lea ebp, [eax + 2]
lea edx, [esp + 0x60]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
mov edx, dword [esi]
push 0
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
lea ecx, [esp + 0x68]
mov dword [esp + 0x58], 0
push ecx
push eax
mov ecx, esi
call dword [edx + 0x168]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x48], 0xffffffff
mov ecx, dword [edx - 0xc]
lea eax, [edx - 0xc]
cmp ecx, 0xffffffff
je 0x67d8d3
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x67d8d3
push eax
call dword [0x6c74ac]
add esp, 4
lea eax, [esp + 0x2c]
push 0xe
push eax
call fcn.00514d00
add esp, 8
mov esi, dword [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x4c], 1
mov edx, dword [esi]
call dword [edx + 0x88]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
call fcn.004dd920
lea eax, [esp + 0x18]
push 0xd
push eax
call fcn.00514d00
add esp, 8
push 0x64
lea ecx, [esp + 0x1c]
push 1
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x54], 2
call fcn.004fc0a0
mov edx, dword [esi]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov byte [esp + 0x4c], 3
call dword [edx + 0x30]
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 2
call fcn.004dd920
lea ecx, [esp + 0x18]
push 0x64
push ecx
lea ecx, [esp + 0x18]
call fcn.004f0f30
mov edx, dword [esi]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov byte [esp + 0x4c], 4
call dword [edx + 0x34]
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 2
call fcn.004dd920
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [edx + 0xc]
lea edi, [ecx + 4]
mov ecx, dword [edx + 4]
mov edx, dword [edx]
sub eax, 2
inc ecx
push eax
add edx, ebp
mov ebp, dword [esi]
push edi
push ecx
push edx
mov ecx, esi
call dword [ebp + 0xf0]
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], 0xffffffff
call fcn.004dd920
pop edi
pop ebp
pop esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret 0x10
mov eax, dword [esp + 0x48]
push ecx
push edx
mov edx, dword [esp + 0x54]
push edx
push eax
mov ecx, esi
call fcn.00675430
mov ecx, dword [esp + 0x38]
pop esi
mov dword fs:[0], ecx
add esp, 0x40
ret 0x10
Function at 0x691d80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x6c61b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
lea ebp, [esi + 0x18]
push ebp
call fcn.00695570
push 0xc
mov dword [esp + 0x30], 0
call fcn.00658ea0
mov edi, eax
add esp, 4
mov dword [esp + 0xc], edi
test edi, edi
mov byte [esp + 0x2c], 1
je 0x691dd4
mov ecx, edi
call fcn.00575430
jmp 0x691dd6
xor edi, edi
mov eax, dword [ebp]
mov dword [esi + 0x10], edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov eax, dword [eax - 8]
push ecx
push eax
push 0
push 0
mov ecx, esi
call fcn.00691e90
mov edx, dword [esp + 0x18]
mov dword [esi + 0x14], 0
push edx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x14], vtable.wxHtmlTagsCache.0
call dword [0x6c74ac]
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.wxObject.0
call fcn.0056f8d0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x90c889
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
rdtsc
mov eax, dword [ebp]
sbb dx, si
push dword [esp]
setno cl
movzx edx, al
mov edx, dword [ebp + 4]
ror cl, cl
dec cl
mov cl, byte [ebp + 8]
bt bx, bp
pushfd
add ebp, 2
call fcn.0090c708

Function at 0x4060b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004021ba
and dword [ebp - 4], 0
cmp dword [0x40b654], 0
mov ebx, eax
jne 0x406167
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406218
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406218
push eax
call fcn.00402148
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b654], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b658], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b65c], eax
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b664], eax
test eax, eax
je 0x406167
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b660], eax
mov eax, dword [0x40b660]
cmp eax, ebx
je 0x4061bf
cmp dword [0x40b664], ebx
je 0x4061bf
push eax
call fcn.004021c3
push dword [0x40b664]
mov esi, eax
call fcn.004021c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061bf
test edi, edi
je 0x4061bf
call esi
test eax, eax
je 0x4061b6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061b6
test byte [ebp - 0xc], 1
jne 0x4061bf
or dword [ebp + 0x10], 0x200000
jmp 0x4061f8
mov eax, dword [0x40b658]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4061f8
mov eax, dword [0x40b65c]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b654]
call fcn.004021c3
pop ecx
test eax, eax
je 0x406218
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40621a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x1e7a7500
Capabilities:
Compare security identifiers

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 4], 0x1e7ba2c0
je 0x1e7a751c
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
ret 8
mov eax, dword [eax + 8]
mov ecx, dword [ecx + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [esp + 8]
cmp ecx, 2
jne 0x1e7a7541
test eax, eax
je 0x1e7a754a
mov eax, dword [sym.imp.python27.dll__Py_TrueStruct]
inc dword [eax]
ret 8
cmp ecx, 3
jne 0x1e7a7554
test eax, eax
je 0x1e7a7537
mov eax, dword [sym.imp.python27.dll__Py_ZeroStruct]
inc dword [eax]
ret 8
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
ret 8

Function at 0x1e7a9c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.1e7a998d
adc cl, ch
xor dh, al
lea eax, [ebp - 0x58]
push eax
call fcn.1e7a999d
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a9952
add esp, 0x10
lea ecx, [ebp - 0xb0]
push eax
invalid
invalid
call dword [ecx - 1]
ror byte [ebx - 0x727407bb], 1
push esp
invalid
invalid
push dword [ebx]
sal bh, cl
int1
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1e7a9c7b
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1e7a998d
sbb byte [eax], dh
iretd

Function at 0x1e7a9d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5a], 0x41
call fcn.1e7a999d
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a9952
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax

Function at 0x1e7a9db0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x1e7a9e28
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1e7a999d
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a9952
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1e7a998d
add byte [edi], 0x6e
movsb byte es:[edi], byte [esi]
invalid
Function at 0x1e7a9dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x1e7a9e28
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1e7a999d
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a9952
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1e7a998d
add byte [edi], 0x6e
movsb byte es:[edi], byte [esi]
invalid

Function at 0x1e7a9e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.1e7a998d
jmp dword [ebx + 0x51]
pop esi
stc
lea eax, [ebp - 0x84]
push eax
call fcn.1e7a999d
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a9952
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x1e7aa186
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.1e7a98fe
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x1e7a9efd
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.1e7a98fe
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x1e7a9eca
call fcn.1e7a998d
scasd eax, dword es:[edi]
das
imul esi, dword [edi - 0x75], 0x7e
cmp al, 3
dec byte [ecx - 0x8743]
dec dword [ebx + 0x8087]
add byte [ebx], bh
ret
Function at 0x1e7aa080
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7aa064
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7aa082
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
js 0x1e7aa0a6
js 0x1e7aa0a6
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7aa0e0
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
or byte gs:[eax], al
add byte [eax], al
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7aa0c7
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7aa0d0
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7aa0da
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7aa0bc
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1e7aa046
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1e7aa12d
dec eax
je 0x1e7aa124
sub eax, 3
je 0x1e7aa11b
mov dword [ebp - 4], 0x40
jmp 0x1e7aa14a
mov dword [ebp - 4], 4
jmp 0x1e7aa130
mov dword [ebp - 4], 0x20
jmp 0x1e7aa130
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1e7aa17c
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1e7aa0fc
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1e7a998d
push edx
out 0x8d, eax
mov al, 0xff
jne 0x1e7aa187
push 1
push esi
call edi
mov eax, esi
jmp 0x1e7aa188
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1e7aa1d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ecx
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.1e7a999d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a9952
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
invalid
invalid
invalid

Function at 0x1e7aa430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
invalid
invalid

Function at 0x1e7aa5f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jecxz 0x1e7aa53a
movsd dword es:[edi], dword [esi]
out dx, eax
cli
invalid
jns 0x1e7aa5b8
test edi, esi
cli
invalid
Function at 0x40ae00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40ae1c
test al, 0x10
jne 0x40ae1c
mov eax, 1
ret
xor eax, eax
ret

Function at 0x40b090
Capabilities:
Copy file

Disassembly:
push ebx
mov bl, byte [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
xor edx, edx
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [esi]
test bl, bl
mov ecx, dword [edi]
sete dl
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40b0f9
mov esi, dword [esi]
mov edi, dword [edi]
call fcn.00406900
test eax, eax
je 0x40b0e3
mov edx, dword [eax]
push 0
push str.Failed_to_copy_the_file__s_to__s
mov ecx, eax
call dword [edx + 8]
push esi
push edi
push eax
call fcn.00442240
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
ret
mov eax, str.Failed_to_copy_the_file__s_to__s
push esi
push edi
push eax
call fcn.00442240
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
mov al, 1
pop ebx
ret

Function at 0x40b100
Capabilities:
Move file

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
test bl, bl
push edi
jne 0x40b162
push esi
call fcn.0040ae00
add esp, 4
test al, al
je 0x40b162
mov eax, dword [esp + 0x10]
mov esi, dword [esi]
mov edi, dword [eax]
call fcn.00406900
test eax, eax
je 0x40b14c
mov edx, dword [eax]
push 0
push str.Failed_to_rename_the_file__s_to__s_because_the_destination_file_already_exists.
mov ecx, eax
call dword [edx + 8]
push esi
push edi
push eax
call fcn.00442240
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
ret
mov eax, str.Failed_to_rename_the_file__s_to__s_because_the_destination_file_already_exists.
push esi
push edi
push eax
call fcn.00442240
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
ret
mov edi, dword [esp + 0x10]
mov eax, dword [esi]
push eax
mov ecx, dword [edi]
push ecx
call sub.MSVCRT.dll_rename
add esp, 8
test eax, eax
jne 0x40b17e
pop edi
pop esi
mov al, 1
pop ebx
ret
push ebx
push esi
push edi
call fcn.0040b090
add esp, 0xc
test al, al
je 0x40b15c
push edi
call fcn.0040b1a0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x40b1a0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call sub.MSVCRT.dll_remove
add esp, 4
neg eax
sbb eax, eax
inc eax
ret
Function at 0x40d090
Capabilities:
Get common file path
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x475d0f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [esp + 4], 0
mov eax, dword [0x49cadc]
mov dword [esp], eax
push str.TMPDIR
mov dword [esp + 0x14], 1
call sub.MSVCRT.dll_getenv
add esp, 4
lea ecx, [esp]
push eax
call fcn.00404840
mov eax, dword [esp]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40d168
push 0x49de58
call sub.MSVCRT.dll_getenv
add esp, 4
lea ecx, [esp]
push eax
call fcn.00404840
mov eax, dword [esp]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40d168
push str.TEMP
call sub.MSVCRT.dll_getenv
add esp, 4
lea ecx, [esp]
push eax
call fcn.00404840
mov eax, dword [esp]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40d168
push 0x105
lea ecx, [esp + 4]
call fcn.00404c40
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp]
call fcn.00404c70
mov eax, dword [esp]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40d168
push 0x2e
lea ecx, [esp + 4]
call fcn.00404820
mov eax, dword [esp]
mov ecx, dword [eax - 8]
push esi
mov esi, dword [esp + 0x1c]
test ecx, ecx
jne 0x40d17e
mov ecx, dword [0x49cadc]
mov dword [esi], ecx
jmp 0x40d190
mov dword [esi], eax
mov ecx, dword [eax - 0xc]
cmp ecx, 0xffffffff
je 0x40d190
inc ecx
mov dword [eax - 0xc], ecx
mov eax, dword [esp + 4]
mov dword [esp + 8], 1
lea ecx, [eax - 0xc]
mov byte [esp + 0x14], 0
mov eax, dword [ecx]
cmp eax, 0xffffffff
je 0x40d1b3
dec eax
test eax, eax
mov dword [ecx], eax
jne 0x40d1b3
call fcn.00403dc0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x415940
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4159a8
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4159a8
mov edx, dword [esp + 0xc]
push edx
push ecx
push eax
call sub.MSVCRT.dll__read
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4159aa
call fcn.00406900
test eax, eax
je 0x415990
mov edx, dword [eax]
push 0
push str.cant_read_from_file_descriptor__d
mov ecx, eax
call dword [edx + 8]
mov ecx, dword [esi]
push ecx
push eax
call fcn.00442240
add esp, 8
or eax, 0xffffffff
pop esi
ret 8
mov ecx, dword [esi]
mov eax, str.cant_read_from_file_descriptor__d
push ecx
push eax
call fcn.00442240
add esp, 8
or eax, 0xffffffff
pop esi
ret 8
xor eax, eax
pop esi
ret 8
Function at 0x415fa0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 8]
call fcn.004158e0
mov eax, dword [esi]
push eax
call fcn.00415750
add esp, 4
test al, al
je 0x416003
mov eax, dword [esi]
push eax
call sub.MSVCRT.dll_remove
add esp, 4
test eax, eax
je 0x416003
mov esi, dword [esi]
call fcn.00406900
test eax, eax
je 0x415ff0
mov edx, dword [eax]
push 0
push str.cant_remove_file__s
mov ecx, eax
call dword [edx + 8]
push esi
push eax
call fcn.00442240
add esp, 8
xor al, al
pop esi
ret
mov eax, str.cant_remove_file__s
push esi
push eax
call fcn.00442240
add esp, 8
xor al, al
pop esi
ret
push 1
lea eax, [esi + 4]
push esi
push eax
call fcn.0040b100
add esp, 0xc
test al, al
jne 0x416050
mov esi, dword [esi]
call fcn.00406900
test eax, eax
je 0x41603d
mov edx, dword [eax]
push 0
push str.cant_commit_changes_to_file__s
mov ecx, eax
call dword [edx + 8]
push esi
push eax
call fcn.00442240
add esp, 8
xor al, al
pop esi
ret
mov eax, str.cant_commit_changes_to_file__s
push esi
push eax
call fcn.00442240
add esp, 8
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x416060
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 8]
call fcn.004158e0
mov eax, dword [esi + 4]
push eax
call sub.MSVCRT.dll_remove
add esp, 4
test eax, eax
je 0x4160b0
mov esi, dword [esi + 4]
call fcn.00406900
test eax, eax
je 0x4160a1
mov edx, dword [eax]
push 0
push str.cant_remove_temporary_file__s
mov ecx, eax
call dword [edx + 8]
push esi
push eax
call fcn.00442240
add esp, 8
pop esi
ret
mov eax, str.cant_remove_temporary_file__s
push esi
push eax
call fcn.00442240
add esp, 8
pop esi
ret

Function at 0x4160f0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
mov cl, byte [edx]
test cl, cl
je 0x416116
movsx ecx, cl
add eax, ecx
inc edx
mov ecx, eax
shl ecx, 0xa
add eax, ecx
mov ecx, eax
shr ecx, 6
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4160fc
lea eax, [eax + eax*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
ret
Function at 0x416920
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x476b40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x4809e4]
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
push eax
push 0
mov ecx, ebx
call fcn.004041a0
push str.HOME
call sub.MSVCRT.dll_getenv
add esp, 4
test eax, eax
je 0x416967
push eax
mov ecx, ebx
call fcn.00404840
jmp 0x4169d7
push str.HOMEDRIVE
call sub.MSVCRT.dll_getenv
mov edx, eax
add esp, 4
test edx, edx
je 0x416990
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ecx
mov ecx, ebx
call fcn.004048f0
push str.HOMEPATH
call sub.MSVCRT.dll_getenv
mov esi, eax
add esp, 4
test esi, esi
je 0x4169d7
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
push ecx
mov ecx, ebx
call fcn.004048f0
mov edi, 0x49dcf4
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4169d7
mov eax, dword [0x4809e4]
mov ecx, ebx
push eax
push edx
call fcn.004041a0
mov ecx, dword [ebx]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4169f9
push str.USERPROFILE
call sub.MSVCRT.dll_getenv
add esp, 4
test eax, eax
je 0x4169f9
push eax
mov ecx, ebx
call fcn.00404840
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x416a29
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.004112d0
add esp, 8
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 0
call fcn.004047b0
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff4
jmp 0x416a52
lea edx, [esp + 0xc]
push edx
call fcn.00417260
mov eax, dword [eax]
push 0
push 0
push ebx
push eax
mov dword [esp + 0x2c], 1
call fcn.0040b810
mov eax, dword [esp + 0x20]
add esp, 0x14
lea ecx, [eax - 0xc]
mov eax, dword [ecx]
mov dword [esp + 0x18], 0xffffffff
cmp eax, 0xffffffff
je 0x416a6d
dec eax
test eax, eax
mov dword [ecx], eax
jne 0x416a6d
call fcn.00403dc0
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x416a90
Capabilities:
Query environment variable

Disassembly:
mov cl, byte [0x4adad0]
mov al, 1
test al, cl
jne 0x416abd
mov dl, cl
mov ecx, 0x4adacc
or dl, al
mov byte [0x4adad0], dl
call fcn.004063a0
push 0x416ad0
call fcn.0046f802
add esp, 4
mov dword [esp + 4], 0x4adacc
jmp fcn.00416920