joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10098ab6
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x38c]
sub esp, 0x40c
mov eax, dword [0x100fd640]
xor eax, ebp
mov dword [ebp + 0x388], eax
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc08]
push edi
call fcn.100a9f93
mov edi, eax
test edi, edi
je 0x10098c87
push ebx
push 0xc
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, dword [esi + 0xc08]
push edi
mov ebx, eax
call fcn.100a9f9d
cmp ebx, 8
jne 0x10098b53
mov ecx, dword [esi + 0xc08]
call fcn.100a9f93
mov ebx, eax
lea eax, [ebp - 0x78]
push eax
push ebx
call fcn.1009892f
pop ecx
pop ecx
mov ecx, dword [esi + 0xc08]
push ebx
mov edi, eax
call fcn.100a9f9d
cmp edi, dword [esi + 0xc00]
jne 0x10098b5a
mov eax, edi
shl eax, 2
push eax
lea eax, [esi + 0x800]
push eax
lea eax, [ebp - 0x78]
push eax
call sub.MSVCR100.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x10098b5a
xor eax, eax
jmp 0x10098c86
mov eax, 0x100
cmp edi, eax
jle 0x10098b65
mov edi, eax
mov eax, edi
shl eax, 2
push eax
lea eax, [ebp - 0x78]
push eax
lea ebx, [esi + 0x800]
push ebx
call sub.MSVCR100.dll_memcpy
and dword [ebp - 0x80], 0
add esp, 0xc
lea eax, [edi - 1]
push ebx
mov ecx, esi
mov dword [esi + 0xc00], edi
mov dword [ebp - 0x7c], eax
call fcn.10094315
cmp eax, 1
jne 0x10098b9f
push 2
jmp 0x10098be2
cmp eax, 2
jne 0x10098ba8
push 3
jmp 0x10098be2
push str.FORCEGRAY
call dword [sym.imp.MSVCR100.dll_getenv]
pop ecx
test eax, eax
je 0x10098be0
push 0xa
pop edx
lea eax, [esi + 0x7d8]
mov ecx, edx
and dword [eax - 0x3d8], 0
and dword [eax], 0
add eax, 4
dec ecx
jne 0x10098bc3
sub edi, 0x14
sub dword [ebp - 0x7c], edx
mov dword [ebp - 0x80], edx
push 1
jmp 0x10098be2
push 0
mov ecx, dword [esi + 0xc08]
call fcn.100aa544
mov ecx, dword [ebp - 0x80]
cmp ecx, dword [ebp - 0x7c]
jg 0x10098c26
lea eax, [esi + ecx*4 + 0x400]
movzx edx, byte [ebp + ecx*4 - 0x78]
movzx ebx, byte [ebp + ecx*4 - 0x77]
or edx, 0xffffff00
shl edx, 8
or edx, ebx
movzx ebx, byte [ebp + ecx*4 - 0x76]
shl edx, 8
or edx, ebx
mov dword [eax], edx
inc ecx
add eax, 4
cmp ecx, dword [ebp - 0x7c]
jle 0x10098bfc
push 0x20
lea ebx, [esi + 0x400]
push edi
push ebx
call fcn.10094315
mov dword [esi + 0xc0c], eax
mov eax, dword [esi + 0xc08]
mov edi, dword [eax + 8]
mov eax, dword [eax]
mov eax, dword [eax]
add esp, 0xc
cmp eax, 3
je 0x10098c55
cmp eax, 1
jne 0x10098c83
test edi, edi
je 0x10098c83
mov eax, dword [edi + 0x10]
test eax, eax
je 0x10098c6c
push eax
call dword [sym.imp.MSVCR100.dll_free]
and dword [edi + 0x10], 0
pop ecx
mov eax, dword [esi + 0xc08]
push dword [eax + 8]
push 0x100
push ebx
call fcn.10094315
add esp, 0xc
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp + 0x388]
pop edi
xor ecx, ebp
pop esi
call fcn.100b4c22
add ebp, 0x38c
leave
ret
Function at 0x100a5c50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b8cb0
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x100fd640]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
call fcn.100b022b
call fcn.10094315
mov esi, dword [sym.imp.kernel32.dll_GetVersion]
call esi
push eax
push eax
push str.0x_x___ld
lea eax, [ebp - 0x114]
push 0x80
push eax
call fcn.100a3e5f
add esp, 0x14
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.kernel32.dll_lstrlenW]
mov edi, eax
call esi
cmp al, 5
jb 0x100a5d17
call esi
cmp al, 5
jb 0x100a5cdc
call esi
shr eax, 8
cmp al, 1
jae 0x100a5ce2
call esi
cmp al, 5
jbe 0x100a5d03
call esi
cmp al, 6
jb 0x100a5cef
push str.__Windows_Vista_
jmp 0x100a5d1c
push str.__Windows_XP_
push 0x80
lea eax, [ebp + edi*2 - 0x114]
push eax
jmp 0x100a5d29
push str.__Windows_2000_
push 0x80
lea ecx, [ebp + edi*2 - 0x114]
push ecx
jmp 0x100a5d29
push str.__Unknown_
push 0x80
lea edx, [ebp + edi*2 - 0x114]
push edx
call fcn.100a3e5f
lea eax, [ebp - 0x114]
add esp, 0xc
push eax
call dword [sym.imp.MSVCR100.dll_wcslen]
mov ecx, dword [ebx]
add esp, 4
push eax
mov eax, dword [ecx + 0x28c]
lea edx, [ebp - 0x114]
push edx
push ebx
call eax
jmp 0x100a5d63
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100b4c22
mov esp, ebp
pop ebp
ret 8
Function at 0x100ab4e3
Capabilities:
Check os version

Disassembly:
push 0xc
mov eax, 0x100b92f3
call fcn.100b4d71
mov eax, dword [0x100fd620]
cmp eax, 0xfffffffe
jne 0x100ab568
call dword [sym.imp.kernel32.dll_GetVersion]
cmp al, 6
jae 0x100ab50e
and dword [0x100fd620], 0
xor eax, eax
jmp 0x100ab568
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
call fcn.10094315
pop ecx
cmp eax, ebx
jl 0x100ab532
mov ebx, dword [ebp - 0x14]
jmp 0x100ab532
push 0x10002
push dword [0x101004d4]
mov dword [0x100fd620], ebx
call sub.java.dll__JNU_GetEnv_8
movzx ecx, bl
push ecx
push str._Z_V
push str.dwmCompositionChanged
push str.sun_awt_Win32GraphicsEnvironment
push 0
push eax
call sub.java.dll_JNU_CallStaticMethodByName
add esp, 0x18
mov eax, ebx
call fcn.100b4e16
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0xb274272
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x19db6dec
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4056c0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x403161
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x403161
lcall 0x5de5, 0x8b10c483
jmp loc.00791034
Function at 0x406310
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4170ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4042e4
call fcn.00407031
push 4
mov dword [esp + 0x18], 0
call fcn.004080fd
mov edi, eax
add esp, 4
test edi, edi
je 0x406384
push ebx
call fcn.00406f09
mov dword [edi], eax
call fcn.00406cc8
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406ff2
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406378
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040701a
pop ebx
jmp 0x406386
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408b71
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41adbc]
jne 0x408b7b
repz ret
jmp fcn.0040fb0c
Function at 0x414431
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41adbc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040d9b7
and dword [ebp - 0x14], 0
cmp dword [0x47f994], 0
mov dword [ebp - 0x18], eax
jne 0x4144e4
push 0x4037cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41458c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4037c0
push ebx
call edi
test eax, eax
je 0x41458c
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4037b0
push ebx
mov dword [0x47f994], eax
call edi
push eax
call esi
push 0x40379c
push ebx
mov dword [0x47f998], eax
call edi
push eax
call esi
push 0x403780
push ebx
mov dword [0x47f99c], eax
call edi
push eax
call esi
mov dword [0x47f9a4], eax
test eax, eax
je 0x4144e4
push 0x403768
push ebx
call edi
push eax
call esi
mov dword [0x47f9a0], eax
mov eax, dword [0x47f9a0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41453d
cmp dword [0x47f9a4], ecx
je 0x41453d
push eax
call esi
push dword [0x47f9a4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41453d
test ebx, ebx
je 0x41453d
call edi
test eax, eax
je 0x414534
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x414534
test byte [ebp - 8], 1
jne 0x41453d
or dword [ebp + 0x10], 0x200000
jmp 0x414570
mov eax, dword [0x47f998]
cmp eax, dword [ebp - 0x18]
je 0x414570
push eax
call esi
test eax, eax
je 0x414570
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x414570
mov eax, dword [0x47f99c]
cmp eax, dword [ebp - 0x18]
je 0x414570
push eax
call esi
test eax, eax
je 0x414570
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x47f994]
call esi
test eax, eax
je 0x41458c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41458e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408b71
leave
ret
Function at 0x4160a0
Capabilities:
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1b08
call fcn.00414f70
cmp dword [0x929e24], 0x37
push esi
jne 0x41619a
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push 0
lea ecx, [esp + 0x30c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0
call esi
push 0x403fdc
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
lea eax, [esp + 0xb0c]
push eax
push 0x40401c
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
lea ecx, [esp + 0x130c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0xe8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
call esi
push 0x40403c
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea ecx, [esp + 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0x30
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x28], 0
call fcn.00411070
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
mov edx, dword [0x92c588]
mov dword [esp + 8], edx
mov eax, 0x5d1
add dword [esp + 8], eax
mov eax, dword [esp + 8]
mov cl, byte [eax + edi]
mov edx, dword [0x92861c]
mov byte [edx + edi], cl
pop esi
add esp, 0x1b08
ret
Function at 0x406250
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
cmp edi, 0x53
ja 0x4062ef
je 0x4062e0
cmp edi, 5
je 0x4062be
cmp edi, 0x46
je 0x406290
cmp edi, 0x4e
jne 0x40630e
mov ecx, dword [esp + 0x18]
mov eax, dword [esi]
mov edx, dword [esp + 0x14]
mov eax, dword [eax + 0x30]
push ecx
push edx
mov ecx, esi
call eax
pop edi
pop esi
pop ebx
ret 0xc
cmp byte [esi + 0x18], 0
je 0x4062b6
mov ecx, dword [esp + 0x18]
mov dword [ecx + 0x18], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
mov al, 1
pop ebx
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
mov ecx, eax
shr ecx, 0x10
push ecx
mov ecx, dword [esp + 0x18]
movzx eax, ax
push eax
push ecx
mov ecx, esi
call edx
pop edi
pop esi
pop ebx
ret 0xc
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
call edx
pop edi
pop esi
mov al, 1
pop ebx
ret 0xc
mov eax, edi
sub eax, 0x110
je 0x4063f0
sub eax, 1
je 0x4063d7
sub eax, 2
je 0x4063be
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
push ebp
mov ebp, dword [esp + 0x1c]
cmp edi, dword [esi + 8]
jne 0x40636c
mov eax, dword [esi + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ebx, [ebx]
mov eax, dword [esi + 4]
push 0
push 0
push 0
push eax
push 0
call ebx
test eax, eax
jne 0x406330
mov eax, dword [esi + 4]
movzx ecx, word [esp + 0x18]
mov edx, dword [0x439d44]
push ebp
push 0x406160
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp edi, dword [esi + 0x10]
jne 0x4063b5
mov ecx, dword [esi + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ecx]
mov eax, dword [esi + 4]
push 0
push 0
push 0
push eax
push 0
call ebx
test eax, eax
jne 0x406380
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 4]
mov eax, dword [esi + 4]
push edx
mov edx, dword [ebp]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
mov edx, dword [edx + 0x34]
push eax
push ecx
mov ecx, esi
call edx
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x18]
mov eax, dword [esi]
mov edx, dword [esp + 0x14]
mov eax, dword [eax + 0x18]
push ecx
push edx
mov ecx, esi
call eax
pop edi
pop esi
pop ebx
ret 0xc
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esi + 0x1c]
push ecx
mov bl, al
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
mov al, bl
pop ebx
ret 0xc
Function at 0x406630
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x40664f
cmp eax, 0x106
je 0x40664f
push 0x106
call fcn.00404e70
mov eax, dword [esi]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x406672
mov edx, edi
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x406668
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret

Function at 0x406780
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x42d0c8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push ebx
call ebp
test eax, eax
je 0x4067cb
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
xor eax, eax
push 4
lea esi, [esp + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call fcn.00404e70
mov eax, esi
push eax
push ebx
mov dword [esp + 0x2c], 0
call fcn.00407e60
test al, al
je 0x406838
cmp dword [esp + 0x14], 0
setne al
test al, al
je 0x406838
mov esi, dword [esp + 0x10]
push edi
push esi
call ebp
test eax, eax
push esi
setne bl
mov dword [esp + 0x28], 0xffffffff
call fcn.004210fe
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004210fe
add esp, 4
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x406870
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x42d3a8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ebp
call edi
test eax, eax
je 0x4068ac
mov al, 1
jmp 0x406919
xor ebx, ebx
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00404e70
mov eax, esi
push eax
push ebp
mov dword [esp + 0x30], ebx
call fcn.00407e60
test al, al
je 0x406902
cmp dword [esp + 0x18], ebx
setne al
cmp al, bl
je 0x406902
mov esi, dword [esp + 0x14]
push esi
call edi
cmp eax, ebx
push esi
setne bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.004210fe
add esp, 4
mov al, bl
jmp 0x406919
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004210fe
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x406930
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x42d3a8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
push ebx
push ebp
call edi
test eax, eax
je 0x40696f
mov al, 1
jmp 0x4069e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4069e6
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00404e70
mov eax, esi
push eax
push ebp
mov dword [esp + 0x30], ebx
call fcn.00407e60
test al, al
je 0x4069d1
cmp dword [esp + 0x18], ebx
setne al
cmp al, bl
je 0x4069d1
mov esi, dword [esp + 0x14]
push ebx
push esi
call edi
cmp eax, ebx
push esi
setne bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.004210fe
add esp, 4
mov al, bl
jmp 0x4069e8
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004210fe
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x406de0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x42d3a8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor edi, edi
mov ecx, ebp
call fcn.00406780
test al, al
je 0x406e94
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebp
call edi
test eax, eax
je 0x406e29
mov al, 1
jmp 0x406e96
xor ebx, ebx
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00404e70
mov eax, esi
push eax
push ebp
mov dword [esp + 0x30], ebx
call fcn.00407e60
test al, al
je 0x406e7f
cmp dword [esp + 0x18], ebx
setne al
cmp al, bl
je 0x406e7f
mov esi, dword [esp + 0x14]
push esi
call edi
cmp eax, ebx
push esi
setne bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.004210fe
add esp, 4
mov al, bl
jmp 0x406e96
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004210fe
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x407580
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x40759f
cmp eax, 0x106
je 0x40759f
push 0x106
call fcn.00404e70
mov eax, dword [esi]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x4075c2
mov edx, edi
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x4075b8
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret

Function at 0x4075e0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
jg 0x4075fe
cmp eax, 0x106
je 0x4075fe
push 0x106
call fcn.00404e70
mov eax, dword [esi]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, dword [esi]
xor eax, eax
cmp word [edx], ax
je 0x40762a
mov ecx, edx
lea ebx, [ebx]
add ecx, 2
inc eax
cmp word [ecx], 0
jne 0x407620
xor ecx, ecx
mov word [edx + eax*2], cx
mov dword [esi + 4], eax
mov al, 1
pop esi
ret

Function at 0x407640
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x40765f
cmp eax, 0x106
je 0x40765f
push 0x106
call fcn.00404e70
mov eax, dword [esi]
push eax
mov eax, dword [esp + 0x10]
push 0
push 0x43095c
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x40768a
mov edx, edi
nop
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x407680
xor edx, edx
mov word [edi + ecx*2], dx
pop edi
mov dword [esi + 4], ecx
pop esi
ret 4