joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4757e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4a4683
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4d1968]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004710d0
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], ebx
call fcn.004710d0
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 1
call fcn.004710d0
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x47f690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x4bd2f0
mov dword [esp], eax
mov dword [esp + 4], 0x4b5394
mov dword [esp + 8], 0x4b5390
mov dword [esp + 0xc], 0x4b538c
mov dword [esp + 0x10], 0x4b1c48
mov dword [esp + 0x14], 0x4bd078
mov dword [esp + 0x18], 0x4b1c88
mov dword [esp + 0x1c], 0x4b1c78
mov dword [esp + 0x20], 0x4b5388
mov dword [esp + 0x24], 0x4b5384
mov dword [esp + 0x28], 0x4b5380
mov dword [esp + 0x2c], str._____
mov dword [esp + 0x30], 0x4b537c
mov dword [esp + 0x34], 0x4b5378
mov dword [esp + 0x38], 0x4b1c7c
mov dword [esp + 0x3c], 0x4b5374
mov dword [esp + 0x40], str.______
mov dword [esp + 0x44], str.0123456789
mov dword [esp + 0x48], 0x4b5068
mov dword [esp + 0x4c], 0x4b5128
mov dword [esp + 0x50], 0x4b1c64
mov dword [esp + 0x54], 0x4b1c5c
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x4b5360
mov dword [esp + 0x64], 0x4b535c
mov dword [esp + 0x68], 0x4b5358
mov dword [esp + 0x6c], 0x4b1c54
mov dword [esp + 0x70], 0x4b506c
mov dword [esp + 0x74], 0x4b505c
mov dword [esp + 0x78], 0x4b503c
mov dword [esp + 0x7c], 0x4b5030
mov dword [esp + 0x80], 0x4b502c
mov dword [esp + 0x84], 0x4b5024
mov dword [esp + 0x88], 0x4b501c
mov dword [esp + 0x8c], 0x4b5064
mov dword [esp + 0x90], 0x4bd108
mov dword [esp + 0x94], 0x4b15ac
mov dword [esp + 0x98], 0x4bd0b4
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x4bd0b0
mov dword [esp + 0xc0], 0x4b50f4
mov dword [esp + 0xc4], 0x4b50d8
mov dword [esp + 0xc8], 0x4b15b0
mov dword [esp + 0xcc], str.ZYXWVUTSRQPONMLKJIHGFDBA
mov dword [esp + 0xd0], 0x4b511c
mov dword [esp + 0xd4], 0x4b1ca8
mov dword [esp + 0xd8], 0x4ac548
mov dword [esp + 0xdc], 0x4b50f8
mov dword [esp + 0xe0], 0x4b5100
mov dword [esp + 0xe4], 0x4b5354
mov dword [esp + 0xe8], 0x4b510c
mov dword [esp + 0xec], 0x4b50f0
cmp cl, 0x3c
jae 0x47f8ad
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret
Function at 0x4802d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4a4fa8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d1968]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0041e010
mov dword [esi], vtable.boost::regex_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x18], 0
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x480335
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4803d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4a4fe3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d1968]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004802d0
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_base.0
lea eax, [esi + 0x30]
mov byte [esp + 0x18], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.1.0
mov dword [eax], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.0
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.2.0
cmp edi, ecx
je 0x480432
lea ecx, [edi + 0x30]
push ecx
push eax
call fcn.004010d0
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x495c40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov edx, dword [eax + 0x1c]
imul edx, dword [ecx + 0x18]
mov eax, dword [ebp - 0x24]
mov dword [eax + 8], edx
cmp dword [ebp + 0xc], 0
jne 0x495c68
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
push eax
call fcn.004937a0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x495d1b
cmp dword [ebp + 8], 0
jne 0x495cdc
xor ecx, ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x1c]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042312e
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x1c]
shl edx, 1
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00448fe0
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [ebp + 8], edx
mov eax, dword [ebp - 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00493750
add esp, 8
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov ecx, esp
push 0
call fcn.00401000
push ecx
mov ecx, esp
push 0x4b9b18
call fcn.00401000
mov ecx, dword [ebp - 0x24]
add ecx, 0x20
push ecx
call fcn.00499c20
add esp, 0x18
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
push eax
push 1
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00449a75
add esp, 0x10
sub eax, 1
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 5], al
cmp dword [ebp - 4], 0
je 0x495d5b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00423123
add esp, 4
movzx eax, byte [ebp - 5]
test eax, eax
je 0x495daf
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp - 0x24]
add edx, dword [eax + 8]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x14], edx
push 0xffffffffffffffff
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x1c]
push eax
push 0x18
mov ecx, dword [ebp - 0x24]
add ecx, 0x3c
push ecx
mov edx, esp
push ecx
mov ecx, edx
call fcn.00405290
push ecx
mov ecx, esp
push 0x4b9b30
call fcn.00401000
mov eax, dword [ebp - 0x24]
add eax, 0x20
push eax
call fcn.00499c20
add esp, 0x18
jmp 0x495db7
mov ecx, dword [ebp - 0x24]
call fcn.00495350
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret 8
Function at 0x4a07b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6518
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4d1968]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], 0
mov dword [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0041e760
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4a097f
push str.is_expired
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4a0893
call dword [ebp - 0x18]
movzx ecx, al
test ecx, ecx
je 0x4a0893
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x2c]
call fcn.00407db0
push 0
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x48]
call fcn.00420e20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x48]
push edx
call fcn.0041f320
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00406290
mov ecx, dword [ebp + 8]
call fcn.0040e680
mov eax, dword [ebp - 0x54]
or eax, 1
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0041eeb0
mov eax, dword [ebp + 8]
jmp 0x4a09c2
push str.update_thread
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x24]
call fcn.0040e680
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1c], 0
je 0x4a093c
push 4
call fcn.004230f4
add esp, 4
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x50], 0
je 0x4a08e5
push 0
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x50]
call fcn.00420f70
mov dword [ebp - 0x5c], eax
jmp 0x4a08ec
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x24]
call fcn.00420c80
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040df20
mov eax, dword [ebp - 0x54]
or eax, 1
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.0041f3c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0041eeb0
mov eax, dword [ebp + 8]
jmp 0x4a09c2
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040df20
mov edx, dword [ebp - 0x54]
or edx, 1
mov dword [ebp - 0x54], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.0041f3c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0041eeb0
mov eax, dword [ebp + 8]
jmp 0x4a09c2
lea ecx, [ebp + 0xc]
call fcn.0041e760
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp + 8]
call fcn.0040e680
mov eax, dword [ebp - 0x54]
or eax, 1
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0041eeb0
mov eax, dword [ebp + 8]
jmp 0x4a09c2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x401486
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 8]
call fcn.00408ba4
push dword [ebp + 0xc]
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.00401631
push 0x5c
mov ecx, edi
call fcn.00401718
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
push esi
push 0x401593
push edi
push edi
mov dword [0x419268], esi
mov dword [0x419270], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x4192d4], 2
mov dword [0x41926c], eax
je 0x4014e3
call fcn.00407695
push 0xffffffffffffffff
push dword [0x41926c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x419270]
mov dword [0x4192e0], edi
cmp eax, edi
je 0x401533
cmp eax, 1
je 0x401527
cmp eax, 2
je 0x401523
cmp eax, 3
je 0x40151f
cmp eax, 0x67
jle 0x401519
cmp eax, 0x6a
jle 0x401588
push eax
push 0x14
push edi
jmp 0x401580
push 0x12
jmp 0x401529
push 0x13
jmp 0x401529
push 0x11
push edi
call fcn.00407563
pop ecx
pop ecx
jmp 0x401588
cmp dword [0x4192e4], edi
jne 0x401588
lea eax, [ebp + 8]
push eax
push dword [0x41926c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, dword [ebp + 8]
test eax, eax
je 0x40155a
cmp ecx, edi
jne 0x40155a
xor eax, eax
jmp 0x40158d
mov edx, ecx
mov eax, 0x80070000
and edx, eax
cmp edx, eax
je 0x40156c
push ecx
push 0x20
jmp 0x40151c
and ecx, 0xffff
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
push 0x21
push 1
call fcn.00407563
add esp, 0xc
mov eax, 0x80004005
pop edi
pop esi
leave
ret 8

Function at 0x4019eb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401a08
xor eax, eax
jmp 0x401a68
test al, 0x10
je 0x401a19
push 0x10
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x401a68
mov eax, dword [0x4192d8]
test eax, eax
je 0x401a55
cmp eax, 2
jne 0x401a65
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x401a55
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 0xc]
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jge 0x401a65
push esi
call fcn.0040246e
neg eax
sbb eax, eax
pop ecx
neg eax
dec eax
jmp 0x401a68
push 1
pop eax
pop esi
leave
ret

Function at 0x401a6b
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401aac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xb7
cmp eax, esi
je 0x401a8e
push eax
jmp 0x401aa2
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401aac
test al, 0x10
jne 0x401aac
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
ret
push 1
pop eax
pop esi
ret
Function at 0x401ab1
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x412690
call fcn.00412250
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00401789
cmp dword [ebp - 0x10], 1
mov dword [ebp - 4], ebx
jg 0x401ae9
push 1
lea ecx, [ebp - 0x18]
call fcn.00401789
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 1
push dword [ebp - 0x18]
mov eax, dword [edi]
push eax
call esi
cmp eax, ebx
je 0x401b42
lea ebx, [eax + 1]
cmp ebx, dword [ebp - 0x10]
jl 0x401b11
push ebx
lea ecx, [ebp - 0x18]
call fcn.00401789
mov eax, dword [edi]
push ebx
push dword [ebp - 0x18]
push eax
call esi
mov ecx, dword [ebp - 0x18]
xor esi, esi
xor eax, eax
cmp word [ecx], si
je 0x401b30
mov edx, ecx
inc eax
inc edx
inc edx
cmp word [edx], si
jne 0x401b28
mov word [ecx + eax*2], si
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.004016da
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4021ee
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x41277c
call fcn.00412250
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push edi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], esi
call fcn.00402cc6
xor eax, eax
cmp dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
jg 0x402229
push eax
lea ecx, [ebp - 0x24]
call fcn.00401789
mov ax, word [edi + esi*2 - 2]
mov ebx, dword [ebp - 0x24]
cmp ax, 0x5c
je 0x40223d
cmp ax, 0x2f
jne 0x402247
and word [ebx + esi*2 - 2], 0
dec esi
mov dword [ebp - 0x10], esi
push ebx
call fcn.00401a6b
test eax, eax
pop ecx
jne 0x40229f
test esi, esi
jle 0x402271
lea eax, [ebx + esi*2]
mov cx, word [eax]
cmp cx, 0x2f
je 0x40226f
cmp cx, 0x5c
je 0x40226f
dec esi
dec eax
dec eax
test esi, esi
jg 0x402259
test esi, esi
je 0x40227a
and word [ebx + esi*2], 0
jmp 0x402247
cmp dword [ebp - 0x10], 2
jne 0x40229c
mov ax, word [edi]
or al, 0x20
cmp ax, 0x61
jb 0x40229c
cmp ax, 0x7a
ja 0x40229c
cmp word [edi + 2], 0x3a
je 0x402329
push edi
jmp 0x40231b
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x40230f
lea eax, [ebp - 0x18]
push eax
push ebx
call fcn.004019eb
pop ecx
test eax, eax
pop ecx
je 0x40230f
xor esi, esi
jmp 0x40232c
cmp esi, dword [ebp - 0x10]
jge 0x402329
mov eax, dword [ebp - 0x10]
lea edi, [ebx + esi*2]
sub eax, esi
inc eax
push eax
mov eax, dword [ebp + 8]
lea eax, [eax + esi*2]
push eax
push edi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
cmp word [edi], 0
je 0x4022ee
inc esi
lea ecx, [ebx + esi*2]
mov ax, word [ecx]
test ax, ax
je 0x40230a
cmp ax, 0x5c
je 0x40230a
cmp word [ecx], 0x2f
je 0x40230a
inc esi
inc ecx
inc ecx
jmp 0x4022f1
and word [ebx + esi*2], 0
push ebx
call fcn.00401a6b
test eax, eax
pop ecx
jne 0x4022c8
push ebx
push 0xc
push 1
call fcn.00407563
add esp, 0xc
jmp 0x4022c4
push 1
pop esi
push dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40234a
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov eax, 0x412790
call fcn.00412250
sub esp, 0x25c
push ebx
push esi
push edi
lea ecx, [ebp - 0x18]
push dword [ebp + 8]
call fcn.00402cc6
and dword [ebp - 4], 0
push 0x418080
lea ecx, [ebp - 0x18]
call fcn.00402d27
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
je 0x402431
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00401631
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.00401718
lea eax, [ebp - 0x23c]
lea ecx, [ebp - 0x18]
push eax
call fcn.00402d27
test byte [ebp - 0x268], 0x10
je 0x4023fc
lea eax, [ebp - 0x23c]
push 0x41807c
push eax
call ebx
test eax, eax
je 0x402414
lea eax, [ebp - 0x23c]
push 0x418074
push eax
call ebx
test eax, eax
je 0x402414
push dword [ebp - 0x18]
call fcn.0040234a
pop ecx
jmp 0x402410
push 0
push dword [ebp - 0x18]
call esi
test eax, eax
je 0x40244e
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40244e
lea eax, [ebp - 0x268]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4023a0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push dword [ebp + 8]
call esi
test eax, eax
je 0x40244e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40244e
push 1
pop esi
jmp 0x402450
xor esi, esi
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40246e
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
cmp dword [0x4192f8], 0
push esi
jne 0x402488
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40248d
push 1
pop eax
pop esi
ret
test al, 0x10
jne 0x4024ab
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4024a7
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret
xor eax, eax
pop esi
ret
push esi
call fcn.0040234a
pop ecx
pop esi
ret
Function at 0x403120
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4180f0]
push edi
xor edi, edi
test eax, eax
je 0x403144
mov ecx, 0x4180f0
cmp eax, dword [ebp + 8]
je 0x403144
mov eax, dword [ecx + 0x10]
add ecx, 0x10
inc edi
test eax, eax
jne 0x403134
shl edi, 4
mov eax, dword [edi + 0x4180fc]
test eax, eax
jne 0x403208
cmp dword [0x418314], 0xffffffff
jne 0x403169
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [0x418314], eax
cmp word [0x418310], 0xffff
jne 0x403180
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [0x418310], ax
mov ax, word [0x418318]
cmp ax, 0xffff
jne 0x403197
call fcn.00402c04
mov word [0x418318], ax
mov ecx, dword [edi + 0x4180f8]
and dword [ebp + 8], 0
push ebx
mov ebx, dword [edi + 0x4180f4]
test ecx, ecx
push esi
je 0x4031d3
mov edx, 0x804
cmp dword [0x418314], edx
je 0x4031c8
cmp word [0x418310], dx
je 0x4031c8
cmp ax, dx
jne 0x4031d3
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp + 8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi + 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [edi + 0x4180fc], eax
lea ecx, [esi + 1]
push ecx
push eax
push esi
push ebx
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [edi + 0x4180fc]
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x4032f6
Capabilities:
Get common file path

Disassembly:
mov eax, 0x412874
call fcn.00412250
sub esp, 0x2a4
push ebx
push esi
push edi
push 3
call fcn.00403120
push 2
mov dword [0x4192d0], eax
call fcn.00403120
push 5
mov dword [0x4192cc], eax
call fcn.00403120
push 0x15
mov dword [0x4192c8], eax
call fcn.00403120
push 0x16
mov dword [0x4192c4], eax
call fcn.00403120
push 0x17
mov dword [0x4192c0], eax
call fcn.00403120
xor edi, edi
add esp, 0x18
mov dword [0x4192bc], eax
mov dword [0x4192b4], edi
mov dword [0x4192b8], edi
xor ebx, ebx
mov esi, 0x419280
push edi
lea eax, [ebp - 0x2b0]
push ebx
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x403423
push ebx
lea eax, [ebp - 0xa4]
push str.7zSfxFolder_02d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x24]
call fcn.0040343c
lea eax, [ebp - 0xa4]
lea ecx, [ebp - 0x24]
push eax
mov dword [ebp - 4], edi
call fcn.00401631
lea eax, [ebp - 0x2b0]
lea ecx, [ebp - 0x18]
push eax
call fcn.00401631
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.00402e86
mov edi, 0x4189dc
cmp dword [edi - 4], ebx
jne 0x4033f9
push dword [edi]
lea ecx, [ebp - 0x24]
call fcn.00401631
lea eax, [ebp - 0x2b0]
lea ecx, [ebp - 0x18]
push eax
call fcn.00401631
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.00402e86
add edi, 8
cmp edi, str.MyDocs
jl 0x4033d0
push dword [ebp - 0x18]
mov dword [ebp - 4], 1
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
xor edi, edi
pop ecx
inc ebx
cmp ebx, 0x40
jl 0x403369
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret