joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ca3
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
call fcn.004054ba
test al, al
je 0x405cfd
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xffffffffffffffff
push 8
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop esi
leave
ret

Function at 0x405d0a
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x451bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], 0x67452301
mov dword [ebp - 0x54], 0xefcdab89
mov dword [ebp - 0x50], 0x98badcfe
mov dword [ebp - 0x4c], 0x10325476
cmp dword [ebp + 0xc], ecx
je 0x405d58
push dword [ebp + 0xc]
lea esi, [ebp - 0x60]
push eax
call fcn.004019e7
pop ecx
pop ecx
lea ecx, [ebp - 0x60]
call fcn.00401a6d
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042116f
leave
ret
Function at 0x406b94
Capabilities:
Delete file

Disassembly:
push 0x4cc
mov eax, 0x4413bb
call fcn.004264f2
mov esi, ecx
mov ecx, dword [esi]
lea eax, [ebp - 0x4d0]
xor ebx, ebx
push eax
lea edx, [ebp - 0x4d4]
mov dword [ebp - 0x4d4], ebx
mov dword [ebp - 0x4d0], ebx
call fcn.0040f5c5
pop ecx
test al, al
je 0x406cd8
push dword [esi]
mov esi, 0x104
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.004236ef
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str._amend.dat
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.00423757
mov esi, dword [edi + 0xac]
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0x118]
push eax
call esi
push str.ncstudio.fmt
call fcn.0043efd0
push eax
lea eax, [ebp - 0x220]
push eax
call esi
lea eax, [ebp - 0x4c8]
push eax
call fcn.0040a24d
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x4d4]
lea eax, [ebp - 0x118]
push dword [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x4c8]
push eax
call fcn.0040a759
lea esi, [ebp - 0x4c8]
mov byte [ebp - 0x4c9], al
call fcn.0040a37f
cmp byte [ebp - 0x4c9], bl
jne 0x406cb2
mov eax, dword [0x456b70]
mov eax, dword [eax*4 + 0x453998]
push ebx
push ebx
push eax
mov ecx, edi
call fcn.004138f8
push dword [ebp - 0x4d0]
call fcn.004117bd
pop ecx
call fcn.0040fee4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c8]
call fcn.0040a2e7
mov al, byte [ebp - 0x4c9]
call fcn.00426575
ret

Function at 0x406cde
Capabilities:
Create directory

Disassembly:
push 0xc
mov eax, 0x440978
call fcn.00426489
push dword [ebp + 8]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
call ebx
test eax, eax
jne 0x406da3
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00402853
and dword [ebp - 4], 0
call fcn.0041901a
push eax
lea ecx, [ebp - 0x14]
call fcn.00401eb1
mov byte [ebp - 4], 1
mov edi, 0x447990
xor ecx, ecx
jmp 0x406d6a
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040842c
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0040992c
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401ef4
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x406d67
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x406d8d
lea ecx, [esi + 1]
push edi
lea esi, [ebp - 0x10]
call fcn.00408268
mov esi, eax
cmp esi, 0xffffffff
jne 0x406d27
push dword [ebp - 0x10]
call ebx
test eax, eax
jne 0x406d8d
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401ef4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401ef4
call fcn.00426561
ret
Function at 0x406dfd
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x451bf0]
xor eax, ebp
mov dword [ebp + 0x84], eax
mov al, byte [0x456f00]
test al, al
jne 0x406e68
push ebx
push esi
push edi
mov esi, str.a:cfinfo.sys
lea edi, [ebp - 0x80]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0xf6
lea eax, [ebp - 0x72]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00425b80
add esp, 0xc
mov bl, 0x64
lea eax, [ebp - 0x80]
push eax
mov byte [ebp - 0x80], bl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x406e5e
inc bl
cmp bl, 0x7a
jle 0x406e46
pop edi
mov al, bl
pop esi
mov byte [0x456f00], al
pop ebx
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.0042116f
add ebp, 0x88
leave
ret
Function at 0x40ac8f
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x43ff49
call fcn.004264f2
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x3c], edi
cmp dword [edi + 0x3c], ebx
je 0x40ada8
cmp byte [edi + 0x41], bl
je 0x40ada8
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x40acc7
xor al, al
jmp 0x40adaa
lea esi, [ebp - 0x30]
call fcn.0040aa92
lea eax, [edi + 0x44]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
lea ebx, [ebp - 0x48]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.0040ab0e
mov esi, eax
call fcn.0040ae94
add eax, dword [ebp - 0x34]
lea ebx, [ebp - 0x60]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.0040ab0e
mov esi, eax
call fcn.0040ae94
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x38]
push esi
push dword [ebp - 0x34]
push eax
push dword [ebp - 0x40]
call dword [edx + 0x18]
xor ebx, ebx
sub eax, ebx
je 0x40ad2c
dec eax
je 0x40ad2f
dec eax
dec eax
jne 0x40ad98
mov bl, 1
jmp 0x40ad98
mov byte [edi + 0x41], bl
lea ebx, [ebp - 0x58]
lea esi, [ebp - 0x30]
call fcn.0040ab0e
mov esi, eax
call fcn.0040ae94
mov ecx, dword [ebp - 0x38]
sub ecx, eax
mov dword [ebp - 0x34], ecx
je 0x40ad74
push dword [edi + 0x4c]
lea ebx, [ebp - 0x50]
push ecx
push 1
lea esi, [ebp - 0x30]
call fcn.0040ab0e
mov esi, eax
call fcn.0040ae94
push eax
call fcn.00423c3f
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x40ad96
mov ecx, dword [ebp - 0x34]
cmp byte [edi + 0x41], 0
je 0x40ad28
test ecx, ecx
jne 0x40acd8
push ecx
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.0040aaca
mov edi, dword [ebp - 0x3c]
jmp 0x40acd8
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00408ad4
mov al, bl
jmp 0x40adaa
mov al, 1
call fcn.00426575
ret
Function at 0x40f325
Capabilities:
Copy file

Disassembly:
push 0x13c
mov eax, 0x440741
call fcn.00426528
mov edi, ecx
push 0x20
xor ebx, ebx
push edi
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x128], edi
mov dword [ebp - 4], ebx
call fcn.0041b807
push 8
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 1
call fcn.0041af16
cmp eax, 8
jne 0x40f3a0
cmp dword [ebp - 0x130], 0x434c4646
jne 0x40f3a0
lea ecx, [ebp - 0x140]
call fcn.0040f4ee
cmp dword [ebp - 0x12c], eax
jne 0x40f3a0
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], bl
call fcn.0041b2fd
mov al, 1
jmp 0x40f43d
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], bl
call fcn.0041b2fd
jmp 0x40f3c9
push edi
mov esi, 0x104
lea eax, [ebp - 0x124]
push esi
push eax
call fcn.004236ef
add esp, 0xc
push str..bak
lea eax, [ebp - 0x124]
push esi
push eax
call fcn.00423757
add esp, 0xc
push 0x20
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x140]
mov dword [ebp - 4], 3
call fcn.0041b807
push 8
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 4
call fcn.0041af16
lea ecx, [ebp - 0x140]
cmp eax, 8
je 0x40f443
mov byte [ebp - 4], 3
call fcn.0041b2fd
xor al, al
call fcn.00426584
ret
cmp dword [ebp - 0x130], 0x434c4646
jne 0x40f432
call fcn.0040f4ee
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x140]
cmp dword [ebp - 0x12c], eax
jne 0x40f436
call fcn.0041b2fd
or dword [ebp - 4], 0xffffffff
push ebx
push edi
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40f399
call fcn.0041901a
push eax
lea ecx, [ebp - 0x128]
call fcn.00401eb1
mov dword [ebp - 4], 6
mov eax, dword [0x456b70]
mov esi, dword [eax*4 + 0x453004]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea eax, [ebp - 0x128]
push esi
push eax
call fcn.0040f766
mov esi, dword [ebp - 0x128]
add esp, 0x10
push ebx
push ebx
push esi
call fcn.00418ce7
lea ecx, [esi - 0x10]
call fcn.00401ef4
jmp 0x40f43b

Function at 0x40f4ee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0042a220
mov eax, dword [0x451bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov esi, ecx
mov eax, dword [esi]
push 0
push 8
mov dword [ebp - 0x1018], esi
call dword [eax + 0x28]
mov eax, dword [esi]
or dword [ebp - 0x100c], 0xffffffff
push 0x1000
lea ecx, [ebp - 0x1008]
push ecx
mov ecx, esi
call dword [eax + 0x34]
mov dword [ebp - 0x1010], eax
test eax, eax
je 0x40f5ae
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x101c], eax
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x101c]
push eax
mov ecx, dword [eax]
lea edi, [0x453018]
mov esi, dword [ebp - 0x1014]
mov ebx, dword [ebp - 0x1010]
lea edx, [esi + ebx]
xor eax, eax
mov bl, byte [esi]
mov al, cl
inc esi
xor al, bl
shr ecx, 8
mov ebx, dword [edi + eax*4]
xor ecx, ebx
cmp edx, esi
jne 0x40f575
pop eax
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1018]
mov eax, dword [ecx]
push 0x1000
lea edx, [ebp - 0x1008]
push edx
call dword [eax + 0x34]
mov dword [ebp - 0x1010], eax
test eax, eax
jne 0x40f557
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x100c]
pop edi
pop esi
xor ecx, ebp
not eax
pop ebx
call fcn.0042116f
leave
ret
Function at 0x40fe5e
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
call fcn.0040fee4
and dword [0x456d94], 0
push 0x104
call fcn.0043f200
push eax
mov ebx, 0x456c80
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40fe8e
mov esi, str.Ncstudio.string
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
push 0
movsd dword es:[edi], dword [esi]
push str.MaxIndex
push str.Attribute
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
mov dword [0x456d94], eax
pop ebx
test eax, eax
je 0x40fee1
inc eax
push 4
push eax
call fcn.004251aa
push 0x448068
mov dword [0x456d90], eax
call fcn.00424392
mov ecx, dword [0x456d90]
add esp, 0xc
mov dword [ecx], eax
mov al, 1
ret
Function at 0x41218f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4121b3
cmp dword [edi + 0x54], 0
jne 0x4121b3
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00419a81
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00412150
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x417730
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x417777
call fcn.00419a81
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x417777
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x417793
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004172aa
mov esi, eax
test edi, edi
je 0x417791
test ebx, ebx
je 0x417791
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42116f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x451bf0]
jne 0x421179
repz ret
jmp fcn.0042a24b

Function at 0x425e18
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x425e49
call fcn.00426907
mov dword [eax], esi
call fcn.004268f4
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00422a49
add esp, 0x14
or eax, 0xffffffff
jmp 0x425e84
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x425e66
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042691a
pop ecx
jmp 0x425e44
test byte [ebp + 0xc], 0x80
je 0x425e71
and eax, 0xfffffffe
jmp 0x425e74
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x425e57
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4396be
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042c119
and dword [ebp - 4], 0
cmp dword [0x4569b4], 0
mov ebx, eax
jne 0x43976f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x439820
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4468e0
push edi
call esi
test eax, eax
je 0x439820
push eax
call fcn.0042c0a7
mov dword [esp], 0x4468d0
push edi
mov dword [0x4569b4], eax
call esi
push eax
call fcn.0042c0a7
mov dword [esp], 0x4468bc
push edi
mov dword [0x4569b8], eax
call esi
push eax
call fcn.0042c0a7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4569bc], eax
call esi
push eax
call fcn.0042c0a7
pop ecx
mov dword [0x4569c4], eax
test eax, eax
je 0x43976f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042c0a7
pop ecx
mov dword [0x4569c0], eax
mov eax, dword [0x4569c0]
cmp eax, ebx
je 0x4397c7
cmp dword [0x4569c4], ebx
je 0x4397c7
push eax
call fcn.0042c122
push dword [0x4569c4]
mov esi, eax
call fcn.0042c122
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4397c7
test edi, edi
je 0x4397c7
call esi
test eax, eax
je 0x4397be
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4397be
test byte [ebp - 0xc], 1
jne 0x4397c7
or dword [ebp + 0x10], 0x200000
jmp 0x439800
mov eax, dword [0x4569b8]
cmp eax, ebx
je 0x439800
push eax
call fcn.0042c122
pop ecx
test eax, eax
je 0x439800
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x439800
mov eax, dword [0x4569bc]
cmp eax, ebx
je 0x439800
push eax
call fcn.0042c122
pop ecx
test eax, eax
je 0x439800
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4569b4]
call fcn.0042c122
pop ecx
test eax, eax
je 0x439820
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x439822
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43e220
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x451bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x431], 0
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
je 0x43e26f
mov al, byte [ebp - 0x431]
jmp 0x43e399
mov dword [ebp - 0x218], 0x208
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push str.RegisteredOwner
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x324], eax
lea ecx, [ebp - 0x210]
cmp ecx, 0x4473ca
jne 0x43e2bc
mov al, byte [ebp - 0x431]
jmp 0x43e399
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [str.NK_300]
mov dword [ebp - 0x320], eax
mov cx, word [0x447698]
mov word [ebp - 0x31c], cx
mov dl, byte [0x44769a]
mov byte [ebp - 0x31a], dl
push 0xfd
push 0
lea eax, [ebp - 0x319]
push eax
call fcn.00425b80
add esp, 0xc
mov ecx, dword [str.NK300]
mov dword [ebp - 0x430], ecx
mov dx, word [0x4476a0]
mov word [ebp - 0x42c], dx
push 0xfe
push 0
lea eax, [ebp - 0x42a]
push eax
call fcn.00425b80
add esp, 0xc
lea ecx, [ebp - 0x320]
push ecx
call fcn.0042603e
add esp, 4
push eax
lea edx, [ebp - 0x210]
push edx
call fcn.0042603e
add esp, 4
push eax
call fcn.00425d90
add esp, 8
test eax, eax
je 0x43e38c
lea eax, [ebp - 0x430]
push eax
call fcn.0042603e
add esp, 4
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.0042603e
add esp, 4
push eax
call fcn.00425d90
add esp, 8
test eax, eax
jne 0x43e393
mov byte [ebp - 0x431], 1
mov al, byte [ebp - 0x431]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042116f
mov esp, ebp
pop ebp
ret

Function at 0x43e3b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x451bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push str.ELJB_LJMRQBO
lea eax, [ebp - 0x48]
push eax
call fcn.00411750
add esp, 8
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x50]
movsx eax, byte [edx]
test eax, eax
je 0x43e3fd
mov ecx, dword [ebp - 0x50]
movsx edx, byte [ecx]
add edx, 3
mov eax, dword [ebp - 0x50]
mov byte [eax], dl
mov ecx, dword [ebp - 0x50]
add ecx, 1
mov dword [ebp - 0x50], ecx
jmp 0x43e3da
mov byte [ebp - 0x90], 0
push 0x40
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jne 0x43e42a
xor eax, eax
jmp 0x43e449
lea ecx, [ebp - 0x90]
push ecx
call fcn.004245fa
add esp, 4
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jg 0x43e446
xor eax, eax
jmp 0x43e449
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042116f
mov esp, ebp
pop ebp
ret
Function at 0x43e4b0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
mov eax, dword [0x451bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x250]
push ecx
call fcn.00409526
add esp, 8
push 0x4474b8
lea edx, [ebp - 0x250]
push edx
call fcn.0040953c
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x360]
push ecx
call fcn.00409526
add esp, 8
push 0x4474bc
lea edx, [ebp - 0x360]
push edx
call fcn.0040953c
add esp, 8
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0xffffffff
jne 0x43e53b
xor eax, eax
jmp 0x43e69f
lea edx, [ebp - 0x360]
push edx
lea eax, [ebp - 0x250]
push eax
call fcn.00409526
add esp, 8
mov byte [ebp - 0x251], 1
movzx ecx, byte [ebp - 0x251]
test ecx, ecx
je 0x43e688
lea edx, [ebp - 0x148]
push edx
mov eax, dword [ebp - 0x364]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x43e65e
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0043e470
add esp, 4
test eax, eax
je 0x43e598
jmp 0x43e558
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x360]
push eax
call fcn.0040953c
add esp, 8
mov ecx, dword [ebp - 0x148]
and ecx, 0x10
je 0x43e605
lea edx, [ebp - 0x360]
push edx
call fcn.0043e4b0
add esp, 4
test eax, eax
jne 0x43e5e0
mov eax, dword [ebp - 0x364]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x43e69f
lea ecx, [ebp - 0x360]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x360]
push eax
call fcn.00409526
add esp, 8
jmp 0x43e65c
mov ecx, dword [ebp - 0x148]
and ecx, 1
je 0x43e624
push 0x80
lea edx, [ebp - 0x360]
push edx
call fcn.00425e18
add esp, 8
lea eax, [ebp - 0x360]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x43e646
mov ecx, dword [ebp - 0x364]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x43e69f
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x360]
push eax
call fcn.00409526
add esp, 8
jmp 0x43e683
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x43e672
mov byte [ebp - 0x251], 0
jmp 0x43e683
mov ecx, dword [ebp - 0x364]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x43e69f
jmp 0x43e558
mov edx, dword [ebp - 0x364]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042116f
mov esp, ebp
pop ebp
ret
Function at 0x43e6b0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x451bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x238]
push ecx
call fcn.00409526
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.00409526
add esp, 8
lea ecx, [ebp - 0x238]
push ecx
call fcn.00425c00
add esp, 4
mov byte [ebp + eax - 0x237], 0
lea edx, [ebp - 0x110]
push edx
call fcn.00425c00
add esp, 4
mov byte [ebp + eax - 0x10f], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 2
lea eax, [ebp - 0x238]
mov dword [ebp - 0x128], eax
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x124], ecx
mov dx, word [ebp + 0x10]
mov word [ebp - 0x120], dx
mov dword [ebp - 0x11e], 0
mov dword [ebp - 0x11a], 0
mov dword [ebp - 0x116], 0
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042116f
mov esp, ebp
pop ebp
ret

Function at 0x43e790
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4401e4
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x451bf0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0x18]
call fcn.004113d0
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x18]
call fcn.00402026
mov dword [ebp - 0x10], eax
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.00409979
push str.ewfmgr.exe
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.004114d0
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 0x40]
call fcn.004020d1
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x43e87e
push str.driversewf.sys
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.004114d0
add esp, 0xc
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x28]
or edx, 2
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 0x44]
call fcn.004020d1
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x43e87e
mov dword [ebp - 0x48], 1
jmp 0x43e885
mov dword [ebp - 0x48], 0
mov al, byte [ebp - 0x48]
mov byte [ebp - 0x11], al
mov ecx, dword [ebp - 0x28]
and ecx, 2
je 0x43e89f
and dword [ebp - 0x28], 0xfffffffd
lea ecx, [ebp - 0x20]
call fcn.00411470
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
and edx, 1
je 0x43e8ba
and dword [ebp - 0x28], 0xfffffffe
lea ecx, [ebp - 0x1c]
call fcn.00411470
mov al, byte [ebp - 0x11]
mov byte [ebp - 0x21], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00411470
mov al, byte [ebp - 0x21]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret