joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4058c4
Capabilities:
Encode data using xor

Disassembly:
mov edx, ebx
add esp, 0xfffffffc
mov dword [esp], edx
pop edi
mov eax, 0
xor eax, edi
mov edx, eax
push edx
push ecx
pop eax
push eax
pop edi
mov eax, 4
mov edx, 0
xor eax, edx
sub esp, eax
mov dword [esp], edi
xor ebx, ebx
mov bl, byte [esi]
add ecx, ebx
mov bl, byte [ecx]
pop edi
xor edx, edi
xor edx, ecx
or edx, 0
je 0x405834
pop ecx
mov byte [esi], bl
mov edi, 0x69bed6dd
mov edx, 0x96412922
xor edx, edi
add esi, edx
pop ebx
mov edx, 0x1f3463f3
xor edx, 0x50786a70
mov edi, 0xa1a7cb88
xor edx, edi
cli
xor edx, 0x11143df4
add ebx, edx
push ebx
pop eax
mov edi, eax
push edi
pop edx
and edx, edx
jne 0x405834
mov ecx, 0x4500602a
mov eax, 0x88604
xor ecx, eax
push ecx
push 0x70905322
mov esi, 0x3598bd8e
pop ecx
xor esi, ecx
pop ebx
xor esi, ebx
mov edi, 0x5b374406
mov edx, 0x33f2ccea
xor edx, edi
mov edi, 0x6885dced
xor edx, edi
xor esi, edx
call esi
pop edx
pop edx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404de0
add esp, 0x104
pop ebx
ret

Function at 0x406e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406f48
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406f32
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406e6d
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406f32
cmp dword [ebp - 0x10], 0
jne 0x406e82
mov eax, dword [ebp - 8]
call fcn.00403198
mov bl, 1
jmp 0x406f32
cmp dword [ebp - 0x10], 0x70000000
jb 0x406e90
call fcn.00405884
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
lea eax, [ebp - 0x14]
mov ecx, esi
xor edx, edx
call fcn.00403278
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.00403420
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x406e36
test eax, eax
jne 0x406f32
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406ee0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406f32
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
jmp 0x406eeb
dec esi
test esi, esi
je 0x406ef9
mov eax, dword [ebp - 0x14]
cmp byte [eax + esi - 1], 0
je 0x406eea
cmp dword [ebp - 0xc], 7
jne 0x406f04
test esi, esi
je 0x406f04
inc esi
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004034f0
cmp dword [ebp - 0xc], 7
jne 0x406f25
test esi, esi
je 0x406f25
lea eax, [ebp - 0x14]
call fcn.00403420
mov byte [eax + esi - 1], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004031e8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406f4f
lea eax, [ebp - 0x14]
call fcn.00403198
ret

Function at 0x407890
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x4078ac
shr eax, 1
xor eax, 0xedb88320
jmp 0x4078ae
shr eax, 1
dec edx
jne 0x40789f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407898
pop esi
ret

Function at 0x4078db
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4078e7
call fcn.00407890
push 1
push 0x40c558
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x407912
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4078ed
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x24fb058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x24fb1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x24fb07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x24fb06a
add dl, dl
jne 0x24fb089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x24fb0dc
xor eax, eax
add dl, dl
jne 0x24fb096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x24fb17d
add dl, dl
jne 0x24fb0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24fb0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24fb0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24fb0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x24fb0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x24fb075
mov eax, 1
add dl, dl
jne 0x24fb0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24fb0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x24fb0e1
sub eax, ebx
mov ebx, 1
jne 0x24fb128
mov ecx, 1
add dl, dl
jne 0x24fb10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x24fb119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x24fb105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x24fb075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x24fb13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x24fb14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x24fb136
cmp eax, 0x7d00
jae 0x24fb16d
cmp eax, 0x500
jb 0x24fb168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x24fb075
cmp eax, 0x7f
ja 0x24fb170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x24fb075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x24fb19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x24fb075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x421480
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce597
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x134]
call fcn.00418140
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.00418140
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x134]
call fcn.0041a2d0
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.0041a2d0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.0041ac00
push 0x5c
push 0x2f
lea ecx, [ebp - 0x1bc]
call fcn.0041ac00
mov byte [ebp - 0x1bd], 0
lea ecx, [ebp - 0xac]
call fcn.0044dc00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xac]
call fcn.0044dc80
movzx edx, al
test edx, edx
je 0x42155e
lea ecx, [ebp - 0x1bc]
call fcn.00419550
push eax
lea ecx, [ebp - 0x134]
call fcn.00419550
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
jmp 0x42163c
lea ecx, [ebp - 0x134]
call fcn.004182d0
test eax, eax
jg 0x421580
lea ecx, [ebp - 0x1bc]
call fcn.004182d0
test eax, eax
jle 0x421613
lea ecx, [ebp - 0x24c]
call fcn.00418140
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.00418140
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x134]
push edx
call fcn.004216b0
add esp, 8
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
call fcn.004216b0
add esp, 8
lea ecx, [ebp - 0x2d4]
call fcn.00418be0
push eax
lea ecx, [ebp - 0x24c]
call fcn.00418be0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dl
mov byte [ebp - 0x1bd], dl
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.00418250
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.00418250
jmp 0x42163c
lea ecx, [ebp - 0x1bc]
call fcn.00418be0
push eax
lea ecx, [ebp - 0x134]
call fcn.00418be0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
movzx ecx, byte [ebp - 0x1bd]
test ecx, ecx
jne 0x421655
cmp dword [ebp + 0x10], 0
je 0x421655
mov ecx, dword [ebp + 0x10]
call fcn.00435750
mov dl, byte [ebp - 0x1bd]
mov byte [ebp - 0x2d5], dl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xac]
call fcn.0044dc60
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.00418250
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x134]
call fcn.00418250
mov al, byte [ebp - 0x2d5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005af263
mov esp, ebp
pop ebp
ret
Function at 0x4217e0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce61c
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x94]
call fcn.00418140
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.0041a2d0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.0041ac00
lea ecx, [ebp - 0x134]
call fcn.0044dc00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x134]
call fcn.0044dc80
movzx ecx, al
test ecx, ecx
je 0x4218a8
lea ecx, [ebp - 0x94]
call fcn.00419550
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne dl
mov byte [ebp - 0x255], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0044dc60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00418250
mov al, byte [ebp - 0x255]
jmp 0x421a7b
lea ecx, [ebp - 0x94]
call fcn.004182d0
cmp eax, 0x104
jle 0x4219ae
lea ecx, [ebp - 0x1bc]
call fcn.00418140
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.00421110
add esp, 8
lea ecx, [ebp - 0x24c]
call fcn.00418140
mov byte [ebp - 4], 3
push 0x61b5bc
lea ecx, [ebp - 0x24c]
call fcn.00419d90
lea ecx, [ebp - 0x1bc]
call fcn.00419fb0
push eax
lea ecx, [ebp - 0x24c]
call fcn.00419d90
lea ecx, [ebp - 0x24c]
call fcn.00418be0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jne 0x42194f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x42194f
mov dword [ebp - 0x1c0], 1
cmp dword [ebp - 0x1c0], 0
setne dl
mov byte [ebp - 0x256], dl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.00418250
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1bc]
call fcn.00418250
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0044dc60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00418250
mov al, byte [ebp - 0x256]
jmp 0x421a7b
lea ecx, [ebp - 0x94]
call fcn.00418be0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jne 0x421a21
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x254], eax
cmp dword [ebp + 0xc], 0
je 0x421a0e
mov eax, dword [ebp - 0x254]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004357f0
lea ecx, [ebp - 0x94]
call fcn.00419fb0
push eax
push str.failedToDeleteFilepath
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
cmp dword [ebp - 0x254], 2
jne 0x421a21
mov dword [ebp - 0x250], 1
cmp dword [ebp - 0x250], 0
setne cl
mov byte [ebp - 0x257], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0044dc60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00418250
mov al, byte [ebp - 0x257]
jmp 0x421a7b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.005af263
mov esp, ebp
pop ebp
ret
Function at 0x422a50
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce721
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xffffffff
mov ecx, dword [ebp + 8]
call fcn.004182d0
test eax, eax
jne 0x422abb
cmp dword [ebp + 0x14], 0
je 0x422ab4
push str.GetAttributes:_filename_is_empty
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x14]
call edx
xor al, al
jmp 0x422c24
lea ecx, [ebp - 0x94]
call fcn.00418140
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.0041a2d0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.0041ac00
lea ecx, [ebp - 0x94]
call fcn.004182d0
mov dword [ebp - 0x138], eax
lea ecx, [ebp - 0x134]
call fcn.0044dc00
mov byte [ebp - 4], 1
cmp dword [ebp - 0x138], 0x104
jge 0x422b6c
lea ecx, [ebp - 0x94]
call fcn.00419230
movzx ecx, al
test ecx, ecx
jne 0x422b3b
lea ecx, [ebp - 0x134]
call fcn.0044dc80
movzx edx, al
test edx, edx
je 0x422b6c
lea ecx, [ebp - 0x94]
call fcn.00419550
push eax
call fcn.004248c0
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0xffffffff
jne 0x422b67
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x422bec
cmp dword [ebp - 0x138], 0
jle 0x422bc2
lea ecx, [ebp - 0x1c4]
call fcn.00418140
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x94]
push eax
call fcn.004216b0
add esp, 8
lea ecx, [ebp - 0x1c4]
call fcn.00418c00
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.00418250
jmp 0x422bd9
lea ecx, [ebp - 0x94]
call fcn.00418c00
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
jne 0x422bec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp dword [edx], 0xffffffff
setne al
mov byte [ebp - 0x1c5], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0044dc60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00418250
mov al, byte [ebp - 0x1c5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.005af263
mov esp, ebp
pop ebp
ret
Function at 0x422fe0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce7cc
mov eax, dword fs:[0]
push eax
sub esp, 0x1e4
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x13c]
call fcn.00418140
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x13c]
call fcn.0041a2d0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x13c]
call fcn.0041ac00
lea ecx, [ebp - 0xac]
call fcn.0044dc00
mov byte [ebp - 4], 1
mov dword [ebp - 0xb0], 0
lea ecx, [ebp - 0xac]
call fcn.0044dc80
movzx ecx, al
test ecx, ecx
je 0x423084
push 0
lea ecx, [ebp - 0x13c]
call fcn.00419550
push eax
call fcn.00424880
add esp, 8
mov dword [ebp - 0xb0], eax
jmp 0x4230fd
lea ecx, [ebp - 0x13c]
call fcn.004182d0
test eax, eax
jle 0x4230e3
lea ecx, [ebp - 0x1c4]
call fcn.00418140
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x13c]
push eax
call fcn.004216b0
add esp, 8
push 0
lea ecx, [ebp - 0x1c4]
call fcn.00418be0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.00418250
jmp 0x4230fd
push 0
lea ecx, [ebp - 0x13c]
call fcn.00418be0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jne 0x423153
cmp dword [ebp + 0xc], 0
je 0x423153
lea ecx, [ebp - 0x1ec]
call fcn.0041d8d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1ec]
call fcn.00420b80
lea ecx, [ebp - 0x1ec]
call fcn.004b5840
push eax
push str.errorMsg
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1ec]
call fcn.0041dca0
cmp dword [ebp - 0xb0], 0
setne cl
mov byte [ebp - 0x1ed], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xac]
call fcn.0044dc60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.00418250
mov al, byte [ebp - 0x1ed]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005af263
mov esp, ebp
pop ebp
ret
Function at 0x4231b0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce721
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x94]
call fcn.00418140
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.0041a2d0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.0041ac00
push 0
push 1
lea ecx, [ebp - 0x94]
push ecx
call fcn.00421aa0
add esp, 0xc
lea ecx, [ebp - 0x134]
call fcn.0044dc00
mov byte [ebp - 4], 1
mov dword [ebp - 0x138], 0
lea ecx, [ebp - 0x134]
call fcn.0044dc80
movzx edx, al
test edx, edx
je 0x42326f
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x94]
call fcn.00419550
push eax
call fcn.004248a0
add esp, 8
movzx ecx, al
mov dword [ebp - 0x138], ecx
jmp 0x4232ec
lea ecx, [ebp - 0x94]
call fcn.004182d0
test eax, eax
jle 0x4232d0
lea ecx, [ebp - 0x1c4]
call fcn.00418140
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x94]
push eax
call fcn.004216b0
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1c4]
call fcn.00418be0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x138], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.00418250
jmp 0x4232ec
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x94]
call fcn.00418be0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
setne al
mov byte [ebp - 0x1c5], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0044dc60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00418250
mov al, byte [ebp - 0x1c5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.005af263
mov esp, ebp
pop ebp
ret

Function at 0x4248a0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
pop ebp
ret
Function at 0x429a60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
call fcn.00434500
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push 0x429b30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x429ad4
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x140], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004328a0
push str.Failed_to_start_thread
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x18]
mov edx, dword [eax + 0x14]
call edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x18]
mov eax, dword [edx + 0x28]
call eax
xor al, al
jmp 0x429b27
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004328a0
push str.Task_started_in_background_thread.
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 4]
push ecx
push str.createThread
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.004352b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x18]
mov edx, dword [eax + 0x28]
call edx
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x431990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cfaf2
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x6a1da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.ClsBgTask.0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 8], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 9], 1
mov eax, dword [ebp - 0x10]
mov byte [eax + 0xa], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004388e0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x28], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00418140
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xb8
call fcn.004037f0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xd8], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xe0
call fcn.00434720
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x1a8
call fcn.00477e60
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret