joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412eb0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4350b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
mov eax, dword [esp + 0x128]
push ebx
push esi
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 8]
push 1
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], 1
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
push 0x444300
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 8]
test eax, eax
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x413020
push 1
push 0x25
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find_2
cmp eax, 0xffffffff
jle 0x413020
inc eax
lea edx, [esp + 8]
push eax
push edx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Left
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.MSVCRT.dll__stricmp]
push eax
push str._WINDIR_
mov byte [esp + 0x12c], 2
call esi
add esp, 8
test eax, eax
jne 0x412f81
lea ecx, [esp + 0x14]
push 0x105
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x412ff8
mov edx, dword [esp + 8]
push edx
push str._SYSDIR_
call esi
add esp, 8
test eax, eax
jne 0x412fa6
lea eax, [esp + 0x14]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x412ff8
mov ecx, dword [esp + 8]
push ecx
push str._CURDIR_
call esi
add esp, 8
test eax, eax
jne 0x412fcb
lea edx, [esp + 0x14]
push edx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x412ff8
mov eax, dword [esp + 8]
push eax
push str._TMPDIR_
call esi
add esp, 8
test eax, eax
jne 0x41300f
lea ecx, [esp + 0x14]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 3
jle 0x412ff8
mov byte [esp + eax + 0x13], 0
test eax, eax
jle 0x41300f
mov eax, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Replace
lea ecx, [esp + 8]
mov byte [esp + 0x124], 1
call sub.MFC42.DLL_CString::CString
mov esi, dword [esp + 0x12c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x124], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x120
ret 8
Function at 0x413120
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4350d0
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x44]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x413160
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret
push 0
mov ecx, esi
call fcn.00413300
test eax, eax
je 0x413183
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret
push ebp
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esp + 0x10]
lea ebp, [esi + 0x28]
push 3
push ecx
mov ecx, ebp
mov dword [esp + 0x78], 0
call sub.MFC42.DLL_CString::Right
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x74], 1
call fcn.00432ada
lea ecx, [esp + 0x10]
mov byte [esp + 0x70], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::MakeLower
mov edx, dword [esp + 0xc]
push 0x444304
push edx
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x41321c
mov ebp, dword [ebp]
mov ecx, 0xf
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x3c
push eax
mov dword [esp + 0x2c], 0x400
mov dword [esp + 0x38], ebp
mov dword [esp + 0x44], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edi, eax
jmp 0x413286
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x24]
mov ebp, dword [ebp]
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x24]
mov dword [esp + 0x18], ecx
push edx
mov dword [esp + 0x20], ecx
push eax
push ecx
push ecx
push 0x20
push ecx
push ecx
push ecx
push ebp
push ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
test edi, edi
je 0x413286
mov ecx, dword [esp + 0x14]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call ebp
mov eax, dword [esp + 0x18]
push eax
call ebp
cmp edi, 1
pop ebp
je 0x4132cf
lea edi, [esi + 0x4c]
push 0x3eb
mov ecx, edi
call sub.MFC42.DLL_CString::LoadStringA
mov eax, dword [esi + 0x50]
mov edi, dword [edi]
push eax
push edi
push 0
mov ecx, esi
call fcn.004146b0
lea ecx, [esp + 8]
mov dword [esp + 0x6c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret
mov ecx, dword [esi + 0x34]
push ecx
mov ecx, esi
call fcn.00413300
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x6c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x64]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x68
ret
Function at 0x4139f0
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, ecx
push ebx
xor ebp, ebp
call fcn.004139b0
mov esi, eax
test esi, esi
je 0x413b51
push esi
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
cmp esi, ebx
jbe 0x413a2a
cmp byte [esi - 1], 0x23
jne 0x413a2a
push esi
mov ecx, edi
call fcn.00413970
jmp 0x413a32
push eax
mov ecx, edi
call fcn.004138c0
mov esi, eax
test esi, esi
je 0x413b51
mov ebp, dword [sym.imp.MSVCRT.dll__strnicmp]
push 4
push str.list
push ebx
mov edi, 1
call ebp
add esp, 0xc
test eax, eax
jne 0x413abe
mov ebx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
cmp ebx, edi
jge 0x413a74
push eax
push eax
push 0x188
push esi
call ebp
mov ebx, eax
jmp 0x413a75
dec ebx
test ebx, ebx
jl 0x413af2
cmp ebx, 0xffffffff
je 0x413af2
push 0
push ebx
push 0x18a
push esi
call ebp
inc eax
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov edi, eax
push edi
push ebx
push 0x189
push esi
call ebp
mov ecx, dword [esp + 0x14]
push edi
call sub.MFC42.DLL_CString::operator_2
push edi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
push 5
push str.check
push ebx
call ebp
add esp, 0xc
test eax, eax
push 0
push 0
jne 0x413b12
push 0xf0
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
jne 0x413afb
mov ecx, dword [esp + 0x14]
push str.checked
call sub.MFC42.DLL_CString::operator_2
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
push 0x445e70
call sub.MFC42.DLL_CString::operator_2
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0xe
push esi
call ebp
mov edi, eax
inc edi
push edi
call sub.MFC42.DLL_operatornew
add esp, 4
mov ebx, eax
push ebx
push edi
push 0xd
push esi
call ebp
mov ecx, dword [esp + 0x14]
push ebx
call sub.MFC42.DLL_CString::operator_2
push ebx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x414530
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
push 0
mov word [esp + 8], ax
and eax, 0xffff
push eax
mov dword [esp + 8], 1
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ecx, dword [esp + 0x24]
mov word [esp + 6], ax
xor eax, eax
push 0x1c
test ecx, ecx
lea ecx, [esp + 4]
setne al
push ecx
push 1
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_SendInput]
add esp, 0x1c
ret 8

Function at 0x414590
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
push 0
mov word [esp + 8], ax
and eax, 0xffff
push eax
mov dword [esp + 8], 1
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edx, dword [esp + 0x24]
mov word [esp + 6], ax
xor eax, eax
lea ecx, [esp]
test edx, edx
setne al
push 0x1c
add eax, 2
push ecx
push 1
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_SendInput]
add esp, 0x1c
ret 8
Function at 0x41f0c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x435c20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x20]
xor ebx, ebx
xor ebp, ebp
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], ebx
call sub.MFC42.DLL_CString::CString_4
mov eax, dword [esi + 0xc]
xor edi, edi
cmp eax, ebx
mov byte [esp + 0x30], 1
mov dword [esp + 0x1c], ebx
je 0x41f10d
mov ebp, dword [eax + 0x20]
lea eax, [esp + 0x20]
push ebx
push eax
mov ecx, esi
call fcn.0041c230
lea ecx, [esp + 0x18]
push ebx
push ecx
mov ecx, esi
call fcn.0041c230
test eax, eax
je 0x41f153
lea edx, [esp + 0x1c]
push ebx
push edx
mov ecx, esi
call fcn.0041ad70
test eax, eax
je 0x41f161
lea eax, [esp + 0x24]
push ebx
push eax
mov ecx, esi
call fcn.0041ae30
test eax, eax
je 0x41f161
mov ebp, dword [esp + 0x24]
jmp 0x41f161
push str.Message_Box
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [esp + 0x1c]
cmp eax, 0x1f4
jge 0x41f1a0
cmp eax, 0x190
jl 0x41f17a
mov edi, 0x40
jmp 0x41f1a0
cmp eax, 0x12c
jl 0x41f188
mov edi, 0x30
jmp 0x41f1a0
cmp eax, 0xc8
jl 0x41f196
mov edi, 0x20
jmp 0x41f1a0
cmp eax, 0x64
jl 0x41f1a0
mov edi, 0x10
cdq
mov ecx, 0x64
idiv ecx
mov eax, edx
cmp eax, 0xa
jl 0x41f1ba
cmp eax, 0x14
jge 0x41f1ba
or edi, 0x40000
cdq
mov ecx, 0xa
idiv ecx
cmp edx, ebx
mov dword [esp + 0x1c], edx
je 0x41f1f6
cmp edx, 1
jne 0x41f1d3
or edi, edx
jmp 0x41f1f6
cmp edx, 2
jne 0x41f1dd
or edi, 6
jmp 0x41f1f6
cmp edx, 3
jne 0x41f1e6
or edi, edx
jmp 0x41f1f6
cmp edx, 4
jne 0x41f1ef
or edi, edx
jmp 0x41f1f6
cmp edx, 5
jne 0x41f1f6
or edi, edx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
or edi, 0x10000
push edi
push edx
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
or esi, 0xffffffff
cmp eax, 1
mov dword [esp + 0x10], eax
je 0x41f24e
cmp eax, 6
je 0x41f24e
cmp eax, 4
je 0x41f24e
cmp eax, 0xa
je 0x41f24e
cmp eax, 7
jne 0x41f234
mov dword [esp + 0x10], ebx
jmp 0x41f256
cmp eax, 2
jne 0x41f23f
mov dword [esp + 0x10], esi
jmp 0x41f256
cmp eax, 0xb
jne 0x41f256
mov dword [esp + 0x10], 2
jmp 0x41f256
mov dword [esp + 0x10], 1
fild dword [esp + 0x10]
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
fstp qword [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], esi
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
pop edi
fld qword [esp + 0xc]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x41f480
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x435cdf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call sub.MFC42.DLL_CString::CString_4
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x10]
push 0xa
push 0x83
push eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x44], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x41f505
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, edi
mov esi, eax
mov eax, ecx
lea edi, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x24]
lea edx, [esp + 8]
mov ecx, eax
and ecx, 0xffff
shr eax, 0x10
push ecx
push eax
push str._i._i
push edx
call sub.MFC42.DLL_CString::Format
mov esi, dword [esp + 0x50]
add esp, 0x10
lea eax, [esp + 8]
mov ecx, esi
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 4

Function at 0x41f6f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x435d28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_4
lea eax, [esp + 0x10]
push 0
push eax
mov ecx, esi
mov dword [esp + 0x2c], 0
call fcn.0041c230
lea ecx, [esp + 0x14]
push 0
push ecx
mov ecx, esi
call fcn.0041acb0
fld qword [esp + 0x14]
fmul qword [0x439260]
call sub.MSVCRT.dll__ftol
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push edx
mov edi, eax
call ebx
cmp eax, 0xffffffff
jne 0x41f7af
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jae 0x41f784
sub eax, edi
dec eax
jmp 0x41f786
sub eax, edi
push 0x32
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, ebp
jge 0x41f7e0
mov eax, dword [esp + 0x10]
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push eax
call ebx
cmp eax, 0xffffffff
je 0x41f775
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
fld qword [0x439ed0]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop edi
fld qword [0x438b50]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x41fe00
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x435e75
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
lea ecx, [esp]
mov dword [esp + 4], 0
call sub.MFC42.DLL_CString::CString_4
lea eax, [esp + 8]
push 0x105
push eax
mov dword [esp + 0x120], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x41fe52
lea ecx, [esp + 8]
push ecx
jmp 0x41fe57
push 0x445e70
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::operator_2
push esi
mov esi, dword [esp + 0x124]
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x11c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x114]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret 4

Function at 0x41feb0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x435ea5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
lea ecx, [esp]
mov dword [esp + 4], 0
call sub.MFC42.DLL_CString::CString_4
lea eax, [esp + 8]
push 0x105
push eax
mov dword [esp + 0x120], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x41ff02
lea ecx, [esp + 8]
push ecx
jmp 0x41ff07
push 0x445e70
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::operator_2
push esi
mov esi, dword [esp + 0x124]
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x11c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x114]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret 4

Function at 0x41ff60
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x435ee0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
lea ecx, [esp]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_4
lea eax, [esp + 0xc]
mov dword [esp + 0x11c], 1
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x41fffa
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::operator_2
mov edx, dword [esp]
mov eax, dword [edx - 8]
cmp eax, 3
jle 0x420008
dec eax
lea ecx, [esp]
push eax
lea eax, [esp + 8]
push eax
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x120], 2
call fcn.00432ada
lea ecx, [esp + 4]
mov byte [esp + 0x11c], 1
call sub.MFC42.DLL_CString::CString
jmp 0x420008
push 0x445e70
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::operator_2
push esi
mov esi, dword [esp + 0x128]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], 1
lea ecx, [esp + 4]
mov byte [esp + 0x120], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x118]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x120
ret 4
Function at 0x4211a0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x436178
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push esi
mov esi, ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_4
push 0x445e70
lea ecx, [esp + 0xc]
mov dword [esp + 0x60], 0
call sub.MFC42.DLL_CString::CString_3
lea eax, [esp + 4]
push 0
push eax
mov ecx, esi
mov byte [esp + 0x64], 1
call fcn.0041c230
lea ecx, [esp + 8]
push 0
push ecx
mov ecx, esi
call fcn.0041c230
mov edx, dword [esp + 4]
pop esi
mov al, byte [edx]
cmp al, 0x22
je 0x421292
cmp al, 0x27
je 0x421292
push 0x20
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::Find_3
test eax, eax
jl 0x421292
push 0x444404
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp]
lea edx, [esp + 0xc]
push ecx
push eax
push edx
mov byte [esp + 0x64], 2
call sub.MFC42.DLL_operator_2
push 0x444404
push eax
lea eax, [esp + 0x10]
mov byte [esp + 0x60], 3
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x5c], 4
call fcn.00432ada
lea ecx, [esp + 8]
mov byte [esp + 0x58], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x58], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x58], 1
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 4]
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 4]
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x20], 0x500
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
pop edi
mov byte [esp + 0x58], 0
lea ecx, [esp + 4]
je 0x42130c
call sub.MFC42.DLL_CString::CString
lea ecx, [esp]
mov dword [esp + 0x58], 0xffffffff
call sub.MFC42.DLL_CString::CString
fld qword [0x439ed0]
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
add esp, 0x5c
ret
call sub.MFC42.DLL_CString::CString
lea ecx, [esp]
mov dword [esp + 0x58], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x50]
fld qword [0x438b50]
mov dword fs:[0], ecx
add esp, 0x5c
ret

Function at 0x4213f0
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x4361c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esp + 4]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString_4
lea eax, [esp + 8]
push 0
push eax
mov ecx, esi
mov byte [esp + 0x24], 1
call fcn.0041c230
lea ecx, [esp + 4]
push 0
push ecx
mov ecx, esi
call fcn.0041c230
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [esp + 0xc], eax
lea ecx, [esp + 4]
fild dword [esp + 0xc]
mov byte [esp + 0x1c], 0
fstp qword [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop esi
fld qword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4214a0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4361d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_4
lea eax, [esp + 4]
push 0
push eax
mov ecx, esi
mov dword [esp + 0x20], 0
call fcn.0041c230
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 8], eax
lea ecx, [esp + 4]
fild dword [esp + 8]
mov dword [esp + 0x18], 0xffffffff
fstp qword [esp + 8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop esi
fld qword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x421520
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x436200
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esp + 4]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString_4
lea eax, [esp + 8]
push 0
push eax
mov ecx, esi
mov byte [esp + 0x24], 1
call fcn.0041c230
lea ecx, [esp + 4]
push 0
push ecx
mov ecx, esi
call fcn.0041c230
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [esp + 0xc], eax
lea ecx, [esp + 4]
fild dword [esp + 0xc]
mov byte [esp + 0x1c], 0
fstp qword [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop esi
fld qword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x1c
ret