joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c10
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x40fe41
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x414174]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x414174]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
push eax
push 0x20006
xor esi, esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
mov dword [esp + 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x401e07
push 0x206
lea edx, [esp + 0x2a]
xor ecx, ecx
push esi
push edx
mov word [esp + 0x30], cx
call fcn.004046b0
mov eax, dword [0x41532c]
mov edx, dword [eax + 0xc]
add esp, 0xc
mov ecx, 0x41532c
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x238], esi
mov eax, dword [0x41532c]
mov edx, dword [eax + 0xc]
mov ecx, 0x41532c
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
push 0x104
lea eax, [esp + 0x28]
push eax
push esi
mov byte [esp + 0x244], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x401ce1
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x24]
mov ebx, eax
push ecx
lea eax, [esp + 0x18]
call fcn.00402070
mov ebp, dword [esp + 0x14]
push ecx
lea esi, [ebp - 0x10]
mov eax, esi
mov dword [esp + 0x24], esp
mov edi, esp
call fcn.00402120
lea edx, [esp + 0x24]
add eax, 0x10
push edx
mov dword [edi], eax
call section..text
add esp, 8
lea edi, [esp + 0x1c]
mov byte [esp + 0x238], 2
call fcn.00401e60
mov ebx, 1
mov byte [esp + 0x238], bl
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401d64
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esi + 0xc], ebx
mov edi, dword [ebp - 0xc]
jle 0x401d7e
mov ecx, dword [esi + 4]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00401f90
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea eax, [edi + edi]
mov edi, dword [esp + 0x1c]
push eax
push ebp
push ebx
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 0x18]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x401db8
push 0
push 0
push 0x411eb4
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [ebp - 0x10]
mov byte [esp + 0x238], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401ddc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov dword [esp + 0x238], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401e03
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
jmp 0x401e09
xor eax, eax
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00402bc1
add esp, 0x228
ret
Function at 0x402310
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
push 0x411ef0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402347
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x415fc0
push 0x67
push esi
mov dword [0x4160c4], esi
call ebx
push 0x64
push 0x415ef8
push 0x6d
push esi
call ebx
mov eax, esi
call fcn.00402490
mov eax, dword [ebp + 0x14]
push eax
call fcn.00402520
add esp, 4
test eax, eax
je 0x40233c
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0x1e8
mov dword [esp + 0x10], eax
call fcn.00403161
add esp, 4
test eax, eax
je 0x4023ac
mov esi, eax
call fcn.00401100
jmp 0x4023ae
xor eax, eax
mov dword [0x416098], eax
call fcn.00401330
mov eax, dword [0x416098]
push 0x411f0c
add eax, 0xa0
mov ebx, 7
call fcn.00402070
mov ecx, dword [0x41608c]
push 0
push 0x32
push 0x401
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
call esi
test eax, eax
je 0x402448
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea ebx, [ebx]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x14]
push eax
push ecx
push edx
call ebx
test eax, eax
jne 0x402437
lea eax, [esp + 0x14]
push eax
call edi
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
call esi
test eax, eax
jne 0x402410
mov eax, dword [0x416098]
mov esi, eax
test eax, eax
je 0x402462
push eax
call fcn.004011e0
push esi
call fcn.00402bb6
add esp, 4
mov eax, dword [esp + 0x10]
push eax
mov dword [0x416098], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x402bc1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x414174]
jne 0x402bcb
repz ret
jmp fcn.004045a0
Function at 0x4069a0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403d2b
and dword [ebp - 4], 0
cmp dword [0x415d84], 0
mov ebx, eax
jne 0x406a51
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406b02
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406b02
push eax
call fcn.00403cb9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x415d84], eax
call esi
push eax
call fcn.00403cb9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x415d88], eax
call esi
push eax
call fcn.00403cb9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x415d8c], eax
call esi
push eax
call fcn.00403cb9
pop ecx
mov dword [0x415d94], eax
test eax, eax
je 0x406a51
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403cb9
pop ecx
mov dword [0x415d90], eax
mov eax, dword [0x415d90]
cmp eax, ebx
je 0x406aa9
cmp dword [0x415d94], ebx
je 0x406aa9
push eax
call fcn.00403d34
push dword [0x415d94]
mov esi, eax
call fcn.00403d34
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406aa9
test edi, edi
je 0x406aa9
call esi
test eax, eax
je 0x406aa0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406aa0
test byte [ebp - 0xc], 1
jne 0x406aa9
or dword [ebp + 0x10], 0x200000
jmp 0x406ae2
mov eax, dword [0x415d88]
cmp eax, ebx
je 0x406ae2
push eax
call fcn.00403d34
pop ecx
test eax, eax
je 0x406ae2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406ae2
mov eax, dword [0x415d8c]
cmp eax, ebx
je 0x406ae2
push eax
call fcn.00403d34
pop ecx
test eax, eax
je 0x406ae2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x415d84]
call fcn.00403d34
pop ecx
test eax, eax
je 0x406b02
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406b04
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401268
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.004012f0
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x4012a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push 7
push dword [ebp - 4]
call sub.kernel32.dll_SetConsoleMode
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
mov edx, dword [ebp + 8]
sub edx, 1
add edx, 1
cmp byte [edx], 0
je 0x4012e4
cmp byte [edx], 0xd
jne 0x4012d4
mov byte [edx], 0
mov eax, dword [ebp - 8]
sub eax, 2
leave
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40141e
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x214
lea eax, [esp]
push ebp
push esi
mov esi, dword [esp + 0x228]
push edi
mov edi, dword [esp + 0x22c]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or eax, 9
push eax
push dword [esp + 0x230]
push dword [esp + 0x230]
call fcn.00406360
test eax, eax
jne 0x401527
xor ebp, ebp
test byte [esp + 0x22c], 2
je 0x401493
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebp
push eax
lea eax, [esp + 0x28]
push eax
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x401503
push 0x105
lea eax, [esp + 0x18]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x4014ce
test edi, edi
jne 0x401503
push dword [esp + 0x22c]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call fcn.0040141e
test eax, eax
jne 0x4014d8
push 0x105
lea eax, [esp + 0x18]
push eax
push edi
push dword [esp + 0x18]
call ebp
test eax, eax
je 0x4014a6
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.0040696e
test eax, eax
jne 0x401514
push dword [esp + 0x228]
push dword [esp + 0x228]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x401527
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x401527
push 0
push esi
push dword [esp + 0x230]
push dword [esp + 0x230]
call eax
pop edi
pop esi
pop ebp
add esp, 0x214
ret 0xc
Function at 0x403188
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x9c
mov ecx, dword [esp + 0xa0]
mov eax, 0x4189e8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xb8]
mov ebx, 0x8000
test edi, edi
cmovne ebx, dword [esp + 0xbc]
xor esi, esi
test edi, edi
cmovne eax, edi
mov dword [esp + 0x1c], eax
test ecx, ecx
js 0x4031d0
mov eax, dword [0x429578]
add eax, ecx
push eax
call fcn.00403171
push 4
lea eax, [esp + 0x14]
push eax
push dword [0x40a010]
call fcn.004069d0
test eax, eax
je 0x403394
mov eax, dword [esp + 0x10]
test eax, eax
jns 0x403336
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40c960
mov dword [esp + 0x14], eax
call fcn.00407cfc
mov eax, dword [esp + 0x10]
and eax, 0x7fffffff
mov ecx, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], ecx
jbe 0x40332e
mov ebp, 0x4000
cmp ecx, ebp
cmovl ebp, ecx
push ebp
push 0x4149e8
call fcn.0040315b
test eax, eax
je 0x403394
sub dword [esp + 0x10], ebp
mov dword [0x40c97c], ebp
mov ebp, dword [esp + 0x1c]
mov dword [0x40c978], 0x4149e8
mov ecx, 0x40c960
mov dword [0x40c980], ebp
mov dword [0x40c984], ebx
call fcn.00406f30
mov dword [esp + 0x28], eax
test eax, eax
js 0x403332
mov eax, dword [0x40c980]
sub eax, ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x429614], 1
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
je 0x4032e7
sub eax, dword [esp + 0x14]
cmp eax, 0xc8
ja 0x4032ab
test ecx, ecx
jne 0x4032e7
mov eax, dword [esp + 0x20]
push eax
push 0x64
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [esp + 0x30]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
push 0
call fcn.00405dd1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x403326
test edi, edi
jne 0x40330b
push eax
push ebp
push dword [esp + 0xbc]
call fcn.00406a93
test eax, eax
je 0x403379
mov eax, dword [esp + 0x18]
jmp 0x403317
mov ebp, dword [0x40c980]
sub ebx, eax
mov dword [esp + 0x1c], ebp
add esi, eax
cmp dword [esp + 0x28], 1
jne 0x403258
jmp 0x40332e
test ecx, ecx
jg 0x403223
mov eax, esi
jmp 0x403397
push 0xfffffffffffffffc
jmp 0x403396
test edi, edi
jne 0x40337d
test eax, eax
jle 0x40332e
mov ebp, 0x4149e8
cmp eax, ebx
mov edi, ebx
cmovl edi, eax
push edi
push ebp
call fcn.0040315b
test eax, eax
je 0x403394
push edi
push ebp
push dword [esp + 0xbc]
call fcn.00406a93
test eax, eax
je 0x403379
mov eax, dword [esp + 0x10]
add esi, edi
sub eax, edi
mov dword [esp + 0x10], eax
test eax, eax
jg 0x403343
jmp 0x40332e
push 0xfffffffffffffffe
jmp 0x403396
mov esi, dword [esp + 0xbc]
cmp eax, esi
cmovl esi, eax
push esi
push edi
call fcn.0040315b
test eax, eax
jne 0x40332e
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret 0x10
Function at 0x4033a4
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0
je 0x4033c3
mov eax, dword [0x40c958]
test eax, eax
je 0x4033bb
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40c958], 0
ret
cmp dword [0x40c958], 0
je 0x4033d4
push 0
call fcn.00406297
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x429520]
jbe 0x403407
push 0
push 0x40366a
push 0
push 0x6f
push dword [0x428514]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x40c958], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x405eb5
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x405ecf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4
Function at 0x406226
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
lea eax, [ebp - 0x23c]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
ja 0x406260
test eax, eax
je 0x406260
add eax, eax
cmp word [ebp + eax - 0x23e], 0x5c
je 0x406262
mov ecx, 0x4082a8
jmp 0x406267
xor eax, eax
mov ecx, 0x4082aa
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x23c]
add eax, ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4062c5
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4062e8
push dword [esp + 8]
push dword [esp + 8]
call fcn.0040638e
pop ecx
pop ecx
inc dword [0x4295f0]
ret 8

Function at 0x40638e
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, 0x400
mov dword [0x426670], 0x55004e
mov ebp, 0x426670
mov dword [0x426674], 0x4c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
je 0x4063e4
push 1
push 0
push esi
call fcn.004069a3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x4064c4
cmp eax, ebx
jg 0x4064c4
push ebx
mov esi, 0x425e70
push esi
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x4064c4
cmp eax, ebx
jg 0x4064c4
push esi
push ebp
push str._ls_ls_r_n
push 0x425a70
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x429530]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.00405f30
push 4
push 0xc0000000
push esi
call fcn.004069a3
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4064c4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebp + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4064bd
push esi
push edi
push ebx
call fcn.004069d0
test eax, eax
je 0x4064bd
push str._Rename__r_n
push edi
call fcn.00406bbe
test eax, eax
jne 0x4064c9
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x425a70
lea eax, [ecx + edi]
push eax
call fcn.0040673c
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.00406a93
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x40899c
add eax, 0xa
push eax
call fcn.00406bbe
mov ecx, eax
test ecx, ecx
je 0x40648e
lea edx, [edi + esi]
jmp 0x4064e8
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x4064e2
sub ecx, edi
inc ecx
jmp 0x406490
Function at 0x40660d
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00406c25
mov edi, eax
cmp edi, 0xffffffff
je 0x406650
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x406631
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x406637
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x406640
xor eax, eax
inc eax
jmp 0x406652
test byte [ebp + 0xc], 4
jne 0x406650
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x4066c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x425270
push ebx
call fcn.00406ba2
push ebx
call fcn.00406c4d
mov esi, eax
test esi, esi
je 0x406735
push esi
call fcn.00406dc5
test byte [0x42952c], 0x80
je 0x4066f9
movzx eax, word [esi]
test ax, ax
je 0x406735
cmp eax, 0x5c
je 0x406735
sub esi, ebx
sar esi, 1
jmp 0x406713
call fcn.00406657
test eax, eax
je 0x40670d
test byte [eax], 0x10
je 0x406735
push ebx
call fcn.00406d98
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
cmp eax, esi
jg 0x4066ff
call fcn.004065de
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406735
xor eax, eax
inc eax
jmp 0x406737
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x40675e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x424a28], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x424a28
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40679d
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x4067a1
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x268]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.004066c0
mov dword [esp + 0x14], eax
test bl, 8
je 0x4067e3
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x4295e8], eax
jmp 0x406962
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x14], ebp
je 0x406800
test eax, eax
je 0x406951
test bl, 2
je 0x40691a
push esi
push 0x424a70
call fcn.00406ba2
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406823
push str..
push 0x424a70
call ebp
jmp 0x406829
push esi
call fcn.00406d98
xor eax, eax
cmp word [esi], ax
jne 0x40683a
cmp word [0x424a70], 0x5c
jne 0x406842
push 0x4082a8
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0x424a70
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x406903
push 0x2e
pop eax
cmp word [esp + 0x48], ax
jne 0x40688c
cmp word [esp + 0x4a], 0
je 0x4068e5
cmp word [esp + 0x4a], ax
jne 0x40688c
cmp word [esp + 0x4c], 0
je 0x4068e5
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x14]
call fcn.00406ba2
test byte [esp + 0x1c], 0x10
je 0x4068b3
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x4068e5
push ebx
push esi
call fcn.004067a1
jmp 0x4068e5
push edi
push esi
call fcn.0040660d
test eax, eax
jne 0x4068dd
test edi, edi
je 0x4068d5
push esi
push 0xfffffffffffffff1
call fcn.00405dd1
xor eax, eax
push eax
push esi
call fcn.004062c5
jmp 0x4068e5
inc dword [0x4295e8]
jmp 0x4068e5
push esi
push 0xfffffffffffffff2
call fcn.00405dd1
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x40686e
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
je 0x406961
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax - 2], cx
cmp dword [esp + 0x18], ecx
je 0x406951
push esi
call fcn.00406657
test eax, eax
je 0x406961
push esi
call fcn.004065de
mov eax, edi
or eax, 1
push eax
push esi
call fcn.0040660d
test eax, eax
jne 0x406959
test edi, edi
je 0x406951
push esi
push 0xfffffffffffffff1
call fcn.00405dd1
xor eax, eax
push eax
push esi
call fcn.004062c5
jmp 0x406961
inc dword [0x4295e8]
jmp 0x406961
push esi
push 0xffffffffffffffe5
call fcn.00405dd1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x25c
ret 8

Function at 0x4069a3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc