joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40da9e
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x46dff0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40dac8
xor eax, eax
jmp 0x40db28
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x40daec
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40dac4
lea eax, [ebp - 0x20c]
push str.WINWORD.EXE
push eax
call fcn.00438a64
pop ecx
pop ecx
test eax, eax
je 0x40db16
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40daec
jmp 0x40db19
xor edi, edi
inc edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp edi, 1
sete al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00437ed4
leave
ret
Function at 0x40db55
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
stosd dword es:[edi], eax
cmp byte [0x471934], bl
jne 0x40dc11
push ebx
call fcn.0043887b
push eax
call fcn.00438af7
pop ecx
pop ecx
xor edi, edi
push 4
push 0x1000
mov esi, 0x10000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [edi*4 + 0x471928], eax
cmp eax, ebx
je 0x40dcd0
mov ecx, edi
dec ecx
je 0x40dbf5
dec ecx
jne 0x40dc04
xor esi, esi
call fcn.00438b09
mov ecx, dword [0x471930]
mov byte [ecx + esi], al
inc esi
cmp esi, 0x10000
jb 0x40dbb9
mov eax, dword [0x471930]
mov byte [eax], 8
mov eax, dword [0x471930]
mov byte [eax + 1], 8
mov eax, dword [0x471930]
mov byte [eax + 2], 7
mov eax, dword [0x471930]
mov byte [eax + 3], 5
jmp 0x40dc04
push esi
push 0xff
push eax
call fcn.00437ff0
add esp, 0xc
inc edi
cmp edi, 3
jb 0x40db8c
mov byte [0x471934], 1
mov ecx, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor eax, eax
sub dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 8], ebx
sbb dword [ebp - 0x14], eax
cmp dword [ebp - 8], ebx
je 0x40dc3e
push 1
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], 0x471928
cmp dword [ebp - 4], ebx
je 0x40dc5e
push 1
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call edi
xor esi, esi
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x2c], ebx
jb 0x40dcae
ja 0x40dc6f
cmp dword [ebp + 0xc], ebx
jbe 0x40dcae
mov eax, dword [ebp + 0xc]
sub eax, esi
mov ecx, 0x10000
cmp eax, ecx
jbe 0x40dc7f
mov eax, ecx
push ebx
lea ecx, [ebp - 0x10]
push ecx
push eax
mov eax, dword [ebp - 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test al, al
je 0x40dcee
add esi, dword [ebp - 0x10]
adc dword [ebp - 0x24], ebx
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x24], eax
jb 0x40dc6f
ja 0x40dcae
cmp esi, dword [ebp + 0xc]
jb 0x40dc6f
inc dword [ebp - 4]
add dword [ebp - 0xc], 4
cmp dword [ebp - 4], 3
jb 0x40dc48
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jb 0x40dc28
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
xor esi, esi
cmp edi, ebx
jbe 0x40dcee
push 0x8000
push ebx
push dword [esi*4 + 0x471928]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
inc esi
cmp esi, edi
jb 0x40dcd6
xor eax, eax
jmp 0x40dccb
Function at 0x40dfc6
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x46dff0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00412651
test eax, eax
jne 0x40dff4
push str._SCWIPEOUTMGR__Unused_WipeOut_Function
call fcn.0040bf32
pop ecx
xor eax, eax
jmp 0x40e0e2
push ebx
call fcn.004383c0
cmp eax, 0xff
pop ecx
lea eax, [ebp - 0x20c]
jbe 0x40e020
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
jne 0x40e02f
push str._SCWIPEOUTMGR__Short_Path_Name_NOT_Found
jmp 0x40dfe7
push ebx
push 0x104
push eax
call fcn.00438df7
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x40e051
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
and dword [ebp - 0x45c], 0
push 0x24c
lea eax, [ebp - 0x458]
push 0
push eax
call fcn.00437ff0
add esp, 0xc
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x40e091
push str._SCWIPEOUTMGR__FindFirstFileW_::_Return_INVALID_HANDLE_VALUE
jmp 0x40dfe7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x43c]
mov eax, 0x186a0
cmp ecx, eax
ja 0x40e0b0
cmp dword [ebp - 0x440], 0
jbe 0x40e0b2
mov ecx, eax
push esi
push ecx
push dword [ebp - 0x440]
lea eax, [ebp - 0x20c]
push eax
call fcn.0040dcf2
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40e0df
push 0
push ebx
push 0x3005
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437ed4
leave
ret

Function at 0x40e0ee
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004385c0
mov eax, dword [0x46dff0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push 0xffe
push eax
mov word [ebp - 0x1004], ax
lea eax, [ebp - 0x1002]
push eax
mov ebx, ecx
call fcn.00437ff0
add esp, 0xc
push 0x800
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.SCWipeOut.dll
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x40e19f
push str._SCWIPEOUTMGR__GetModuleHandleW_NULL
call fcn.0040bf32
pop ecx
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x40e19f
push str._SCWIPEOUTMGR__LoadLibraryW_NULL
call fcn.0040bf32
pop ecx
call fcn.0040dfc6
test eax, eax
jne 0x40e1ce
push str._SCWIPEOUTMGR__Call_DELETEFILE1
call fcn.0040bf32
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40e1ce
push str.SCFileWipeOutW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40e1ca
push str._SCWIPEOUTMGR__GetProcAddress_NULL
call fcn.0040bf32
pop ecx
call fcn.0040dfc6
test eax, eax
jne 0x40e1ce
push str._SCWIPEOUTMGR__Call_DELETEFILE2
jmp 0x40e190
push ebx
call eax
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00437ed4
leave
ret
Function at 0x40e1db
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3004
call fcn.004385c0
mov eax, dword [0x46dff0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x5c], 0
push edi
mov edi, dword [ebp + 0x10]
jne 0x40e2d8
mov eax, dword [ebp + 0xc]
test dword [esi + 0x58], eax
je 0x40e2d8
xor eax, eax
push 0xffe
push eax
mov word [ebp - 0x1004], ax
lea eax, [ebp - 0x1002]
push eax
call fcn.00437ff0
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x1004]
push eax
call fcn.00438154
xor eax, eax
push 0x1ffe
push eax
mov word [ebp - 0x3004], ax
lea eax, [ebp - 0x3002]
push eax
call fcn.00437ff0
lea eax, [ebp - 0x1004]
push eax
call fcn.004383c0
add esp, 0x28
cmp word [ebp + eax*2 - 0x1006], 0xa
jne 0x40e291
cmp dword [esi + 0x34], 8
jb 0x40e27e
mov eax, dword [esi + 0x20]
jmp 0x40e281
lea eax, [esi + 0x20]
lea ecx, [ebp - 0x1004]
push ecx
push edi
push eax
push str.__s___s__s
jmp 0x40e2ad
cmp dword [esi + 0x34], 8
jb 0x40e29c
mov eax, dword [esi + 0x20]
jmp 0x40e29f
lea eax, [esi + 0x20]
lea ecx, [ebp - 0x1004]
push ecx
push edi
push eax
push 0x45716c
lea eax, [ebp - 0x3004]
push eax
call fcn.0040174f
add esp, 0x14
cmp byte [esi + 0x5d], 0
lea eax, [ebp - 0x3004]
push eax
je 0x40e2d2
mov ecx, esi
call fcn.0040190c
jmp 0x40e2d8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00437ed4
leave
ret
Function at 0x40e5a7
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x46dff0]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
push esi
push edi
xor eax, eax
push 0x7fe
mov word [ebp - 0x78], ax
xor esi, esi
lea eax, [ebp - 0x76]
push esi
push eax
call fcn.00437ff0
add esp, 0xc
mov edi, 0x46fab0
push 0x451f54
mov ecx, edi
call fcn.00403b3b
push eax
call fcn.0043938f
mov ebx, eax
push ebx
call fcn.0043924d
add esp, 0xc
cmp ebx, esi
jne 0x40e60c
xor eax, eax
jmp 0x40e757
push 0x400
lea eax, [ebp - 0x78]
push eax
mov ecx, edi
call fcn.00403b3b
push eax
call fcn.00414620
add esp, 0xc
mov ecx, edi
call fcn.00403b3b
mov ecx, eax
call fcn.0040e0ee
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.winword.exe
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
jne 0x40e666
push str.excel.exe
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
jne 0x40e666
push str.powerpnt.exe
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
je 0x40e605
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x7c], edi
cmp edi, 0xffffffff
je 0x40e605
push esi
push esi
push esi
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
cmp ebx, esi
jne 0x40e6ad
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40e605
push esi
push esi
push esi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
jne 0x40e6d2
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push dword [ebp - 0x7c]
call esi
jmp 0x40e605
mov eax, 0x5a4d
mov dword [ebp - 0x80], esi
cmp word [edi], ax
jne 0x40e724
mov esi, dword [edi + 0x3c]
push 4
add esi, edi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
jne 0x40e6fb
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x40e6bf
cmp dword [esi], 0x4550
jne 0x40e6f2
xor ecx, ecx
mov eax, 0x20b
cmp ax, word [esi + 0x18]
sete cl
mov dword [ebp - 0x80], ecx
cmp ecx, 1
jne 0x40e724
lea eax, [ebp - 0x78]
push eax
push str.Is64bitPEFile______64bit__File___s_
jmp 0x40e72d
lea eax, [ebp - 0x78]
push eax
push str.Is64bitPEFile______32bit__File___s_
push 0x45198c
push 0x471938
call fcn.00401ac3
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push dword [ebp - 0x7c]
call esi
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437ed4
add ebp, 0x78c
leave
ret
Function at 0x40e76f
Capabilities:
Create process on windows

Disassembly:
push 0x10
mov eax, 0x44ecd8
call fcn.00437ee3
mov edi, ecx
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
push str.DSOHMAN
xor ebx, ebx
push ebx
call esi
test eax, eax
je 0x40e7a1
push str.DSOHMAN64
push ebx
call esi
test eax, eax
jne 0x40e888
mov ecx, edi
call fcn.0040e5a7
cmp eax, 1
jne 0x40e7c2
cmp dword [0x4713b4], 8
mov eax, dword [0x4713a0]
jae 0x40e7d5
mov eax, 0x4713a0
jmp 0x40e7d5
cmp dword [0x471398], 8
mov eax, dword [0x471384]
jae 0x40e7d5
mov eax, 0x471384
push ebx
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x40e85b
push eax
push str.ERROR_Excute_DSOHMAN_code__d_
push 0x4526c4
push 0x471938
call fcn.004044b7
add esp, 0x10
push str.SOMWT001
lea eax, [ebp - 0x14]
mov esi, 0x471e60
push eax
mov ecx, esi
call fcn.00415e00
mov edi, eax
push str.SOMER011
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00415e00
mov edi, dword [edi]
mov eax, dword [eax]
push 0x10
push edi
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004026bb
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004026bb
push str.SOM_SYNC_EVENT
lea ecx, [ebp - 0x1c]
call fcn.00416f30
push 0x1f4
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 1
call fcn.00416ef0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00416ed0
call fcn.00437fbb
ret
Function at 0x40f71b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
stosd dword es:[edi], eax
cmp byte [0x471acc], bl
jne 0x40f7d7
push ebx
call fcn.0043887b
push eax
call fcn.00438af7
pop ecx
pop ecx
xor edi, edi
push 4
push 0x1000
mov esi, 0x10000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [edi*4 + 0x471ac0], eax
cmp eax, ebx
je 0x40f896
mov ecx, edi
dec ecx
je 0x40f7bb
dec ecx
jne 0x40f7ca
xor esi, esi
call fcn.00438b09
mov ecx, dword [0x471ac8]
mov byte [ecx + esi], al
inc esi
cmp esi, 0x10000
jb 0x40f77f
mov eax, dword [0x471ac8]
mov byte [eax], 8
mov eax, dword [0x471ac8]
mov byte [eax + 1], 8
mov eax, dword [0x471ac8]
mov byte [eax + 2], 7
mov eax, dword [0x471ac8]
mov byte [eax + 3], 5
jmp 0x40f7ca
push esi
push 0xff
push eax
call fcn.00437ff0
add esp, 0xc
inc edi
cmp edi, 3
jb 0x40f752
mov byte [0x471acc], 1
mov ecx, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor eax, eax
sub dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 8], ebx
sbb dword [ebp - 0x14], eax
cmp dword [ebp - 8], ebx
je 0x40f804
push 1
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], 0x471ac0
cmp dword [ebp - 4], ebx
je 0x40f824
push 1
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call edi
xor esi, esi
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x2c], ebx
jb 0x40f874
ja 0x40f835
cmp dword [ebp + 0xc], ebx
jbe 0x40f874
mov eax, dword [ebp + 0xc]
sub eax, esi
mov ecx, 0x10000
cmp eax, ecx
jbe 0x40f845
mov eax, ecx
push ebx
lea ecx, [ebp - 0x10]
push ecx
push eax
mov eax, dword [ebp - 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test al, al
je 0x40f8b4
add esi, dword [ebp - 0x10]
adc dword [ebp - 0x24], ebx
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x24], eax
jb 0x40f835
ja 0x40f874
cmp esi, dword [ebp + 0xc]
jb 0x40f835
inc dword [ebp - 4]
add dword [ebp - 0xc], 4
cmp dword [ebp - 4], 3
jb 0x40f80e
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jb 0x40f7ee
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
xor esi, esi
cmp edi, ebx
jbe 0x40f8b4
push 0x8000
push ebx
push dword [esi*4 + 0x471ac0]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
inc esi
cmp esi, edi
jb 0x40f89c
xor eax, eax
jmp 0x40f891
Function at 0x40f9c4
Capabilities:
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x46dff0]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push esi
push eax
mov esi, 0x104
push esi
push ebx
mov dword [ebp - 0x78], eax
call fcn.00438df7
push 0x5c
push ebx
call fcn.0043884f
add esp, 0x14
test eax, eax
je 0x40fa95
sub eax, ebx
push edi
push dword [ebp - 0x78]
sar eax, 1
shr eax, 1
mov edi, eax
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.00438df7
and dword [ebp - 0x74], 0
add esp, 0xc
inc edi
mov dword [ebp - 0x7c], edi
push dword [ebp - 0x78]
mov edi, dword [ebp - 0x7c]
call fcn.004383c0
pop ecx
cmp edi, eax
jae 0x40fa6e
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x70]
sub eax, ecx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
push 0x2e
lea eax, [eax + edi*2]
pop ecx
cmp cx, word [ebp + eax - 0x70]
je 0x40fa60
mov eax, dword [ebp - 0x74]
add eax, 0x41
mov word [ebp + edi*2 - 0x70], ax
push dword [ebp - 0x78]
inc edi
call fcn.004383c0
pop ecx
cmp edi, eax
jb 0x40fa45
lea eax, [ebp - 0x70]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x40fa94
lea eax, [ebp - 0x70]
push eax
push esi
push ebx
call fcn.00438df7
add esp, 0xc
inc dword [ebp - 0x74]
cmp dword [ebp - 0x74], 0x1a
jb 0x40fa2a
pop edi
mov ecx, dword [ebp + 0x198]
xor ecx, ebp
pop esi
call fcn.00437ed4
add ebp, 0x19c
leave
ret
Function at 0x40fd7f
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x46dff0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00412651
test eax, eax
jne 0x40fdad
push str._SCWIPEOUTMGR__Unused_WipeOut_Function
call fcn.0040bf32
pop ecx
xor eax, eax
jmp 0x40fe9b
push ebx
call fcn.004383c0
cmp eax, 0xff
pop ecx
lea eax, [ebp - 0x20c]
jbe 0x40fdd9
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
jne 0x40fde8
push str._SCWIPEOUTMGR__Short_Path_Name_NOT_Found
jmp 0x40fda0
push ebx
push 0x104
push eax
call fcn.00438df7
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x40fe0a
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
and dword [ebp - 0x45c], 0
push 0x24c
lea eax, [ebp - 0x458]
push 0
push eax
call fcn.00437ff0
add esp, 0xc
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x40fe4a
push str._SCWIPEOUTMGR__FindFirstFileW_::_Return_INVALID_HANDLE_VALUE
jmp 0x40fda0
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x43c]
mov eax, 0x186a0
cmp ecx, eax
ja 0x40fe69
cmp dword [ebp - 0x440], 0
jbe 0x40fe6b
mov ecx, eax
push esi
push ecx
push dword [ebp - 0x440]
lea eax, [ebp - 0x20c]
push eax
call fcn.0040faab
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40fe98
push 0
push ebx
push 0x3005
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437ed4
leave
ret

Function at 0x40fea7
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004385c0
mov eax, dword [0x46dff0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push 0xffe
push eax
mov word [ebp - 0x1004], ax
lea eax, [ebp - 0x1002]
push eax
mov ebx, ecx
call fcn.00437ff0
add esp, 0xc
push 0x800
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.SCWipeOut.dll
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x40ff58
push str._SCWIPEOUTMGR__GetModuleHandleW_NULL
call fcn.0040bf32
pop ecx
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x40ff58
push str._SCWIPEOUTMGR__LoadLibraryW_NULL
call fcn.0040bf32
pop ecx
call fcn.0040fd7f
test eax, eax
jne 0x40ff87
push str._SCWIPEOUTMGR__Call_DELETEFILE1
call fcn.0040bf32
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40ff87
push str.SCFileWipeOutW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40ff83
push str._SCWIPEOUTMGR__GetProcAddress_NULL
call fcn.0040bf32
pop ecx
call fcn.0040fd7f
test eax, eax
jne 0x40ff87
push str._SCWIPEOUTMGR__Call_DELETEFILE2
jmp 0x40ff49
push ebx
call eax
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00437ed4
leave
ret
Function at 0x410e6e
Capabilities:
Check if file exists

Disassembly:
push 0x2a4
mov eax, 0x44efb2
call fcn.00437f4c
xor esi, esi
push esi
mov ebx, ecx
call fcn.00423faa
push 1
mov ecx, ebx
call fcn.0041f6eb
push 0x43
push esi
push esi
push esi
push esi
push 0x4737f8
mov ecx, ebx
call fcn.00424235
mov ecx, ebx
call fcn.00410a7c
cmp eax, 0xffffffc3
je 0x411000
cmp eax, 0xffffffcc
je 0x410ff4
push 0x4706d0
lea ecx, [ebp - 0x2c]
call fcn.00408460
push str.DSSomOath.ini
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.00410d56
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x410ee4
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, 0x45198c
mov esi, 0x471ad8
test eax, eax
je 0x410f65
push 0
mov ecx, ebx
call fcn.00423faa
push str.SOMAuth::ExcuteSOM_DSSomOath.ini_exist
push edi
push esi
call fcn.00401ac3
add esp, 0xc
push 0
lea ecx, [ebp - 0x2b0]
call fcn.0041392f
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 1
jae 0x410f2e
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.0041390a
lea ecx, [ebp - 0x2b0]
call fcn.0041d275
cmp dword [ebp - 0x14], 8
mov ecx, dword [ebp - 0x28]
jae 0x410f51
lea ecx, [ebp - 0x28]
call fcn.0040fea7
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0
call fcn.0041cb32
call fcn.0042366f
mov ecx, dword [eax + 4]
call fcn.0040effb
push str.CSOMAuthorizeDlg::OnAuthOk_PreExcuteSOM
push edi
push esi
call fcn.00401ac3
mov ecx, dword [ebx + 0xc0]
mov eax, dword [ecx]
add esp, 0xc
call dword [eax + 0xc]
test eax, eax
je 0x410fdf
push str.CSOMAuthorizeDlg::OnAuthOk_ExcuteSOM
push edi
push esi
call fcn.00401ac3
mov ecx, dword [ebx + 0xc0]
mov eax, dword [ecx]
add esp, 0xc
call dword [eax + 0x10]
test eax, eax
jne 0x410fc6
mov ecx, ebx
call fcn.0041cc29
push str.SOMAuth::ExcuteSOM_Error____
push edi
push esi
call fcn.00401ac3
add esp, 0xc
jmp 0x410fe6
mov ecx, 0x4715b0
call fcn.0040b0af
push 0x457f20
push edi
push esi
call fcn.00401ac3
add esp, 0xc
mov ecx, ebx
call fcn.0041cc29
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401bd0
jmp 0x411000
call fcn.00413c72
mov ecx, ebx
call fcn.0041cc29
call fcn.00437fcf
ret
Function at 0x411358
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
stosd dword es:[edi], eax
cmp byte [0x471b44], bl
jne 0x411414
push ebx
call fcn.0043887b
push eax
call fcn.00438af7
pop ecx
pop ecx
xor edi, edi
push 4
push 0x1000
mov esi, 0x10000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [edi*4 + 0x471b38], eax
cmp eax, ebx
je 0x4114d3
mov ecx, edi
dec ecx
je 0x4113f8
dec ecx
jne 0x411407
xor esi, esi
call fcn.00438b09
mov ecx, dword [0x471b40]
mov byte [ecx + esi], al
inc esi
cmp esi, 0x10000
jb 0x4113bc
mov eax, dword [0x471b40]
mov byte [eax], 8
mov eax, dword [0x471b40]
mov byte [eax + 1], 8
mov eax, dword [0x471b40]
mov byte [eax + 2], 7
mov eax, dword [0x471b40]
mov byte [eax + 3], 5
jmp 0x411407
push esi
push 0xff
push eax
call fcn.00437ff0
add esp, 0xc
inc edi
cmp edi, 3
jb 0x41138f
mov byte [0x471b44], 1
mov ecx, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor eax, eax
sub dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 8], ebx
sbb dword [ebp - 0x14], eax
cmp dword [ebp - 8], ebx
je 0x411441
push 1
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], 0x471b38
cmp dword [ebp - 4], ebx
je 0x411461
push 1
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call edi
xor esi, esi
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x2c], ebx
jb 0x4114b1
ja 0x411472
cmp dword [ebp + 0xc], ebx
jbe 0x4114b1
mov eax, dword [ebp + 0xc]
sub eax, esi
mov ecx, 0x10000
cmp eax, ecx
jbe 0x411482
mov eax, ecx
push ebx
lea ecx, [ebp - 0x10]
push ecx
push eax
mov eax, dword [ebp - 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test al, al
je 0x4114f1
add esi, dword [ebp - 0x10]
adc dword [ebp - 0x24], ebx
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x24], eax
jb 0x411472
ja 0x4114b1
cmp esi, dword [ebp + 0xc]
jb 0x411472
inc dword [ebp - 4]
add dword [ebp - 0xc], 4
cmp dword [ebp - 4], 3
jb 0x41144b
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jb 0x41142b
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
xor esi, esi
cmp edi, ebx
jbe 0x4114f1
push 0x8000
push ebx
push dword [esi*4 + 0x471b38]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
inc esi
cmp esi, edi
jb 0x4114d9
xor eax, eax
jmp 0x4114ce