joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004112
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x100414f
push eax
push 0x10
push eax
push eax
push 0x4f0
push eax
call fcn.010038cc
call fcn.01003547
mov dword [0x100aa5c], eax
xor eax, eax
leave
ret
push 2
push 2
lea eax, [ebp - 0x104]
push eax
call fcn.01003f0d
leave
ret
Function at 0x1004560
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
xor ebx, ebx
push esi
xor esi, esi
inc ebx
xor eax, eax
cmp dword [ebp + 8], esi
je 0x1004651
push edi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push esi
push esi
push 0x20
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1004609
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x100b888], esi
mov ecx, dword [ebp + 0xc]
jne 0x10045e3
mov al, byte [0x100b48c]
test bl, al
je 0x10045e3
test al, 2
jne 0x10045e3
mov eax, ecx
and eax, 0xff000000
cmp eax, 0xaa000000
jne 0x10045e3
mov dword [0x100b48c], ecx
push ecx
call fcn.010028fa
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x10]
call edi
test byte [0x100b495], 4
je 0x100464e
cmp dword [ebp + 0xc], esi
jge 0x100464e
jmp 0x100464c
call fcn.01003547
push esi
mov dword [0x100aa5c], eax
push 0x200
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push esi
push 0x10
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
push 0x4c4
push esi
call fcn.010038cc
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10046d4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push str.SHELL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x14], edi
je 0x10047ee
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SHBrowseForFolder
push edi
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x10047db
push 0xc3
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x10047db
push str.SHGetPathFromIDList
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x10047db
cmp byte [0x100aa80], bl
mov esi, 0x100aa80
jne 0x1004778
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.USER32.dll_CharPrevA]
add eax, esi
push eax
push esi
call edi
cmp byte [eax], 0x5c
mov dword [ebp - 4], eax
jne 0x1004778
push eax
push esi
call edi
cmp byte [eax], 0x3a
je 0x1004778
mov eax, dword [ebp - 4]
mov byte [eax], bl
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
mov byte [edi], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x1002948
mov dword [ebp - 0x1c], esi
call dword [ebp - 8]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x10047c9
push esi
push eax
call dword [ebp - 0xc]
cmp byte [0x100aa80], bl
je 0x10047c3
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
call dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
cmp byte [edi], bl
setne al
jmp 0x1004802
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push 0x10
push ebx
push ebx
push 0x4c1
jmp 0x10047f8
push ebx
push 0x10
push ebx
push ebx
push 0x4c2
push dword [ebp + 8]
call fcn.010038cc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1004809
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebx, ebx
inc ebx
push esi
mov edi, ebx
call fcn.01005bca
test eax, eax
jne 0x1004823
mov eax, ebx
jmp 0x100487e
cmp dword [0x100ac3c], 0
jne 0x1004870
test byte [0x100b898], bl
jne 0x1004870
push 6
push 0
push 0x100383d
push dword [0x100aa4c]
mov dword [0x100ae64], esi
push 0x7d3
push dword [0x100b4a4]
call fcn.01004161
sub eax, 6
je 0x100486e
dec eax
je 0x1004884
sub eax, 0x832
jne 0x1004870
mov dword [0x100ac3c], ebx
mov edi, ebx
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
xor edi, edi
jmp 0x100487c
Function at 0x1004b1a
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
je 0x1004ba7
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.01002f7a
test eax, eax
je 0x1004c10
lea eax, [ebp - 0x128]
push eax
mov esi, 0x100ac44
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100b494], 0x20
je 0x1004b9a
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x24]
sub eax, ebx
je 0x1004b8f
dec eax
je 0x1004b88
dec eax
je 0x1004b81
dec eax
jne 0x1004b9a
push 0x1001400
jmp 0x1004b94
push 0x10013f8
jmp 0x1004b94
push 0x10013f0
jmp 0x1004b94
push 0x10013e8
push esi
call fcn.01005b32
push 0x1001251
push esi
call fcn.01005b32
jmp 0x1004bb6
push dword [ebp + 8]
mov esi, 0x100ac44
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call fcn.01003e60
test eax, eax
jne 0x1004bd6
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1004bef
mov dword [0x100b880], 1
push ebx
push dword [ebp + 0x10]
push esi
call fcn.01003f0d
test eax, eax
je 0x1004bfb
xor eax, eax
mov dword [0x100aa5c], ebx
inc eax
jmp 0x1004c12
call fcn.01003547
mov dword [0x100aa5c], eax
jmp 0x1004c10
cmp dword [0x100b880], ebx
je 0x1004c10
push esi
mov dword [0x100b880], ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x1004c18
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x100b4a4], eax
xor eax, eax
mov ecx, 0x23f
mov edi, 0x100aba0
rep stosd dword es:[edi], eax
push 0x41
mov ecx, 0xcb
mov edi, 0x100b880
rep stosd dword es:[edi], eax
pop ecx
mov edi, 0x100aa80
rep stosd dword es:[edi], eax
push 0x7f
mov esi, 0x100abb4
xor edi, edi
push esi
xor ebx, ebx
inc edi
push 0x100142c
mov dword [ebp - 4], ebx
mov dword [0x100ae4c], edi
call fcn.01002a34
cmp eax, ebx
je 0x1004e3d
cmp eax, 0x80
ja 0x1004e3d
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [0x100aa50], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 4
push 0x100b494
push 0x1001420
call fcn.01002a34
test eax, eax
je 0x1004cd5
test byte [0x100b494], 0xc0
je 0x1004d65
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x1001410
call fcn.01002a34
test eax, eax
jne 0x1004cf4
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.010038cc
mov dword [0x100aa5c], 0x80070714
jmp 0x1004e4d
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x100aa54], eax
je 0x1004d65
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1004d65
test byte [0x100b494], 0x80
je 0x1004d34
push ebx
push 0x10
push ebx
push esi
push 0x54b
push ebx
call fcn.010038cc
jmp 0x1004d4a
push 4
push 0x20
push ebx
push esi
push 0x524
push ebx
call fcn.010038cc
cmp eax, 6
je 0x1004d65
push dword [0x100aa54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100aa5c], 0x800700b7
jmp 0x1004e4d
push dword [ebp + 0xc]
mov dword [0x100aa60], ebx
call fcn.010030a7
test eax, eax
jne 0x1004d86
push ebx
push 0x10
push ebx
push ebx
push 0x520
jmp 0x1004e47
cmp byte [0x100b89a], bl
je 0x1004d9d
push 0x100b89a
call fcn.01001c7f
jmp 0x1004e4d
push 0xa
push 0x1001404
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x1004dbe
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [0x100a2bc], ebx
je 0x1004dcc
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
cmp dword [0x100b884], ebx
jne 0x1004e39
push dword [ebp - 4]
call fcn.010041cd
test eax, eax
je 0x1004e4d
mov ax, word [0x100aa64]
cmp ax, di
je 0x1004df7
cmp ax, 2
je 0x1004df7
cmp ax, 3
jne 0x1004e39
test byte [0x100b495], 1
je 0x1004e39
test byte [0x100b898], 1
jne 0x1004e39
call fcn.0100168b
test eax, eax
jne 0x1004e39
push 0x83e
push 0x547
push 0x10017b1
push ebx
push 0x7d6
push dword [0x100b4a4]
call fcn.01004161
cmp eax, 0x83d
jne 0x1004e4d
mov eax, edi
jmp 0x1004e4f
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.010038cc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1005a5e
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x1005a85
inc esi
mov al, byte [esi]
test al, al
je 0x1005a7e
cmp al, 0x22
jne 0x1005a73
cmp byte [esi], 0x22
jne 0x1005a96
jmp 0x1005a95
cmp al, 0x20
jle 0x1005a96
inc esi
cmp byte [esi], 0x20
jg 0x1005a89
jmp 0x1005a96
cmp al, 0x20
jg 0x1005a9c
inc esi
mov al, byte [esi]
test al, al
jne 0x1005a91
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x1005ab6
movzx eax, word [ebp - 0x14]
jmp 0x1005ab9
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1005bca
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1005bdd
xor eax, eax
jmp 0x1005be5
shr eax, 4
not eax
and eax, 1
ret 4

Function at 0x1005d22
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xb0
and dword [ebp + 0x74], 0
cmp dword [0x100a2cc], 0xfffffffe
mov dword [ebp + 0x6c], 0xc
jne 0x1005e09
and dword [0x100a2cc], 0
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1005e09
cmp dword [ebp - 0x28], 1
jne 0x1005e09
cmp dword [ebp - 0x34], 4
jne 0x1005e09
cmp dword [ebp - 0x30], 0xa
jae 0x1005e09
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1005e09
lea eax, [ebp + 0x70]
push eax
push 0x20019
push 0
push 0x1001488
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1005e09
push edi
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x68]
push eax
push 0
push 0x1001251
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x70]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x1005e09
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.01005c1c
test eax, eax
je 0x1005e09
and dword [ebp + 0x74], 0x3ff
cmp dword [ebp + 0x74], 1
je 0x1005dff
cmp dword [ebp + 0x74], 0xd
jne 0x1005e09
mov dword [0x100a2cc], 1
mov eax, dword [0x100a2cc]
add ebp, 0x78
leave
ret
Function at 0x1005e13
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
je 0x1005e49
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x1005e4d
xor eax, eax
jmp 0x1005e63
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
push 0x400
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
leave
ret 4

Function at 0x1007083
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x10070be
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x100709b
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x10070da
dec esi
je 0x10070d3
dec esi
jne 0x10070df
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x402a36
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42ec50]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402aca
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402a87
cmp dword [ebp + 0x10], ebx
jne 0x402abe
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a36
test eax, eax
jne 0x402a99
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a6e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405eaa
cmp eax, ebx
je 0x402ad1
push ebx
push dword [0x42ec50]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402aca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42ec50], ebx
jne 0x402ac7
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ac7
jmp 0x402aca
Function at 0x402f3a
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402f67
mov ecx, dword [0x42ebf8]
push edi
add eax, ecx
push edi
push eax
mov dword [0x420bac], eax
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00403065
cmp eax, edi
jl 0x40305e
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x409018]
call ebx
test eax, eax
je 0x40305b
cmp dword [ebp - 4], esi
jne 0x40305b
push dword [ebp + 8]
add dword [0x420bac], esi
call fcn.00403065
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x40305e
cmp dword [ebp + 0x10], edi
jne 0x40302a
cmp dword [ebp + 8], edi
jle 0x403056
mov esi, 0x41cba8
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x402fda
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x409018]
call ebx
test eax, eax
je 0x40305b
cmp edi, dword [ebp - 4]
jne 0x40305b
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403026
cmp dword [ebp + 0x14], edi
jne 0x403026
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x420bac], eax
cmp dword [ebp + 8], 0
jg 0x402fcd
jmp 0x403056
push 0xfffffffffffffffe
jmp 0x40305d
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403035
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409018]
call ebx
test eax, eax
je 0x40305b
mov eax, dword [ebp - 4]
add dword [0x420bac], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x40305e
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x403065
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x420bac]
sub esi, dword [0x40afe0]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
add eax, 0x1f4
cmp esi, ebx
mov dword [0x42ebac], eax
jle 0x4031cf
push dword [0x428bbc]
call fcn.00403213
push ebx
push ebx
push dword [0x40afe0]
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x428bb8], esi
mov dword [0x420ba8], ebx
mov ebp, 0x414ba8
mov eax, dword [0x420bb0]
mov edi, 0x4000
sub eax, dword [0x428bbc]
cmp eax, edi
jg 0x4030da
mov edi, eax
mov esi, 0x41cba8
push edi
push esi
call fcn.004031e1
test eax, eax
je 0x4031c1
add dword [0x428bbc], edi
mov dword [0x40afe8], esi
mov dword [0x40afec], edi
cmp dword [0x42ebb0], ebx
je 0x403131
cmp dword [0x42ec40], ebx
jne 0x403131
mov eax, dword [0x428bb8]
push ebx
sub eax, dword [0x420bac]
sub eax, dword [esp + 0x1c]
add eax, dword [0x40afe0]
mov dword [0x420ba8], eax
call fcn.00402bd3
pop ecx
push 0x40afe8
mov dword [0x40aff0], ebp
mov dword [0x40aff4], 0x8000
call fcn.00405f84
test eax, eax
jl 0x4031ca
mov esi, dword [0x40aff0]
sub esi, ebp
je 0x40318b
lea eax, [esp + 0x10]
push ebx
push eax
push esi
push ebp
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4031c6
cmp esi, dword [esp + 0x10]
jne 0x4031c6
add dword [0x40afe0], esi
cmp dword [0x40afec], ebx
jne 0x403100
jmp 0x403197
cmp dword [0x40afec], ebx
jne 0x4031ca
cmp edi, ebx
je 0x4031ca
mov eax, dword [0x420bac]
mov ecx, eax
sub ecx, dword [0x40afe0]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x4030c4
push ebx
push ebx
push eax
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4031cf
or eax, 0xffffffff
jmp 0x4031d9
push 0xfffffffffffffffe
jmp 0x4031cc
push 0xfffffffffffffffd
pop eax
jmp 0x4031d9
push 1
call fcn.00402bd3
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x4053e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x42c010], 0x44
push eax
xor eax, eax
push 0x42c010
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405423
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4054ad
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0040575c
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x4054e1
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42ec28], eax
jmp 0x405675
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x4054ff
test eax, eax
je 0x405620
test byte [ebp + 0xc], 2
je 0x405620
mov esi, 0x42b010
push edi
push esi
call fcn.00405b88
test ebx, ebx
je 0x40551c
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405522
push edi
call fcn.004056c2
cmp byte [edi], 0
jne 0x405530
cmp byte [0x42b010], 0x5c
jne 0x40553b
push 0x409010
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x405616
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.004056a6
cmp byte [eax], 0
je 0x405581
cmp byte [ebp - 0x18], 0
je 0x405581
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405597
mov al, byte [esi + 1]
test al, al
je 0x4055f5
cmp al, 0x2e
jne 0x405597
cmp byte [esi + 2], 0
je 0x4055f5
push esi
push ebx
call fcn.00405b88
test byte [ebp - 0x148], 0x10
je 0x4055bc
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4055f5
push dword [ebp + 0xc]
push edi
call fcn.004054ad
jmp 0x4055f5
push edi
call fcn.00405840
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4055ed
test byte [ebp + 0xc], 4
je 0x4055e5
push edi
push 0xfffffffffffffff1
call fcn.00404f26
push 0
push edi
call fcn.004058d6
jmp 0x4055f5
inc dword [0x42ec28]
jmp 0x4055f5
push edi
push 0xfffffffffffffff2
call fcn.00404f26
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40555f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x405620
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x405675
cmp dword [ebp - 8], esi
jne 0x405635
inc dword [0x42ec28]
jmp 0x405675
push edi
call fcn.00405e83
test eax, eax
je 0x405675
push edi
call fcn.0040567b
push edi
call fcn.00405840
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40566d
test byte [ebp + 0xc], 4
je 0x40562d
push edi
push 0xfffffffffffffff1
call fcn.00404f26
push esi
push edi
call fcn.004058d6
jmp 0x405675
push edi
push 0xffffffffffffffe5
call fcn.00404f26
pop edi
pop esi
leave
ret 8
Function at 0x40575c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42b410
push esi
call fcn.00405b88
push esi
call fcn.0040570f
mov edi, eax
test edi, edi
jne 0x40577d
xor eax, eax
jmp 0x4057cf
push edi
call fcn.00405dea
test byte [0x42ebb8], 0x80
je 0x405796
mov al, byte [edi]
test al, al
je 0x405779
cmp al, 0x5c
je 0x405779
sub edi, esi
jmp 0x4057ae
call fcn.00405e83
test eax, eax
je 0x4057a8
test byte [eax], 0x10
je 0x405779
push esi
call fcn.004056c2
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x40579a
call fcn.0040567b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405840
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40585c
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x40585f
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x40588e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4058d2
test edi, edi
jne 0x405899
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4058cc