joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4217d4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x42185a
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
mov esi, dword [ebp + 0x14]
test eax, eax
je 0x421845
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
test esi, 0x100
ja 0x421837
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [ebp - 8]
push eax
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and esi, 0x27
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
pop edi
leave
ret 0x10

Function at 0x421f06
Capabilities:
Create directory

Disassembly:
push 8
mov eax, 0x4b43e6
call fcn.00485421
push dword [ebp + 8]
call fcn.0041deb6
pop ecx
test eax, eax
je 0x421f27
xor eax, eax
call fcn.004854f9
ret
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.00421e26
mov edi, dword [ebp - 0x14]
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.0041defc
push 0x5c
push edi
call fcn.00487808
add esp, 0xc
cmp eax, esi
jne 0x421f5d
push 0xf
pop esi
push edi
call fcn.00485811
pop ecx
mov eax, esi
jmp 0x421f21
xor ecx, ecx
push edi
mov word [eax], cx
call fcn.00421f06
pop ecx
cmp eax, esi
je 0x421f71
mov esi, eax
jmp 0x421f52
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x421f52
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x421f6d
jmp 0x421f52

Function at 0x422407
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, ecx
mov dword [esi], ebx
mov dword [ebp + 0x10], eax
cmp dword [edi + 0x1444], ebx
jne 0x42242a
push 6
pop eax
jmp 0x42249c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov dword [ebp + 8], ebx
cmp dword [edi + 0x1448], 0
jne 0x4224a3
mov eax, dword [ebp + 0xc]
sub eax, dword [esi]
mov ebx, 0x4e20
cmp eax, ebx
ja 0x42244f
mov ebx, eax
call fcn.0041e002
lea ecx, [ebp + 8]
push ecx
push ebx
push dword [ebp + 0x10]
push dword [edi + 0x1444]
call dword [eax + 0x10]
test eax, eax
je 0x4224aa
mov ecx, dword [ebp + 8]
add dword [esi], ecx
add dword [ebp + 0x10], ecx
lea eax, [edi + 0x1458]
add dword [eax], ecx
adc dword [eax + 4], 0
test ecx, ecx
jbe 0x422488
mov eax, dword [ebp + 0xc]
cmp dword [esi], eax
jb 0x422436
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [ebp - 4]
cmp eax, 1
jb 0x42249a
call esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, 0x4c7
jmp 0x42249c
mov ecx, edi
call fcn.0041e31f
jmp 0x42249c
Function at 0x42256a
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x4b4494
call fcn.00485421
mov esi, dword [ebp + 0x214]
xor ebx, ebx
mov edi, ecx
cmp word [esi], bx
jne 0x4225fb
call fcn.0041e0db
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4225e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00484647
add ebp, 0x20c
leave
ret 4
lea esi, [edi + 0x1460]
push esi
push ebx
push 0x4c0f44
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4225b5
lea ecx, [ebp - 0x14]
call fcn.00421e07
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.00421e26
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 1
call fcn.0041df1e
push dword [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.00485811
push dword [ebp - 0x14]
call fcn.00421f06
add esp, 0x14
cmp eax, ebx
je 0x42264d
mov ebx, eax
push dword [ebp - 0x14]
call fcn.00485811
pop ecx
mov eax, ebx
jmp 0x4225bb
mov ecx, edi
call fcn.0041e0c7
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x1668], eax
cmp eax, 0xffffffff
jne 0x42263d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42263b
Function at 0x422765
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0xc], 0
or dword [esi + 8], 0xffffffff
test ebx, ebx
jne 0x42278f
xor eax, eax
jmp 0x422854
push edi
call fcn.0041e676
and dword [ebp - 0x10], 0
mov ecx, dword [ebp + 8]
lea edi, [esi + 0x10]
mov dword [ebp - 0x14], 0x12
mov eax, dword [ebp - 0x10]
xor edx, edx
div ebx
inc dword [ebp - 0x10]
mov al, byte [edx + ecx]
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x10]
xor edx, edx
div ebx
inc dword [ebp - 0x10]
mov al, byte [edx + ecx]
mov byte [ebp - 6], al
mov eax, dword [ebp - 0x10]
xor edx, edx
div ebx
inc dword [ebp - 0x10]
mov al, byte [edx + ecx]
mov byte [ebp - 7], al
mov eax, dword [ebp - 0x10]
xor edx, edx
div ebx
inc dword [ebp - 0x10]
mov al, byte [edx + ecx]
mov byte [ebp - 8], al
mov eax, dword [ebp - 8]
xor dword [edi], eax
add edi, 4
dec dword [ebp - 0x14]
jne 0x4227a6
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push 9
lea edi, [esi + 0x14]
pop ebx
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00420f04
mov eax, dword [ebp - 0xc]
mov dword [edi - 4], eax
mov eax, dword [ebp - 8]
mov dword [edi], eax
add edi, 8
dec ebx
jne 0x422801
lea edi, [esi + 0x5c]
mov dword [ebp - 0x14], 4
mov ebx, 0x80
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00420f04
mov eax, dword [ebp - 0xc]
mov dword [edi - 4], eax
mov eax, dword [ebp - 8]
mov dword [edi], eax
add edi, 8
dec ebx
jne 0x42282c
dec dword [ebp - 0x14]
jne 0x422827
xor eax, eax
inc eax
mov dword [esi + 0xc], eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00484647
leave
ret 8
Function at 0x42390e
Capabilities:
Check http status code

Disassembly:
push 0xc
mov eax, 0x4b469b
call fcn.00485421
mov esi, ecx
mov ebx, dword [ebp + 0x18]
xor edi, edi
mov dword [ebx], edi
call fcn.0041e07e
cmp dword [esi + 0x1440], edi
jne 0x42393b
push 6
pop eax
call fcn.004854f9
ret 0x14
cmp dword [esi + 0x142c], 3
je 0x423948
push 0x57
jmp 0x423932
lea ecx, [ebp - 0x18]
call fcn.00421e07
push dword [ebp + 0x14]
lea eax, [esi + 0x224]
push eax
lea eax, [ebp - 0x18]
push str._s_s
push eax
mov dword [ebp - 4], edi
call fcn.0041dd06
or dword [esi + 0x1430], 0x400000
mov eax, dword [esi + 0x1430]
add esp, 0x10
cmp dword [esi + 0x1428], 4
jne 0x423992
or eax, 0x800000
mov dword [esi + 0x1430], eax
call fcn.0041e002
push edi
push dword [esi + 0x1430]
push edi
push edi
push 0x4cd6f8
push dword [ebp - 0x18]
push dword [ebp + 8]
push dword [esi + 0x1440]
call dword [eax + 0x28]
mov dword [esi + 0x1444], eax
cmp eax, edi
jne 0x4239d7
mov ecx, esi
call fcn.0041e31f
mov edi, eax
push dword [ebp - 0x18]
call fcn.00485811
pop ecx
mov eax, edi
jmp 0x423933
mov eax, dword [esi + 0x1c]
lea ecx, [ebp + 0x18]
push ecx
push eax
mov ecx, esi
call fcn.0041e334
test eax, eax
je 0x4239be
call fcn.0041e002
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push edi
push dword [esi + 0x1444]
call dword [eax + 0x2c]
test eax, eax
je 0x4239be
push ebx
push 0x13
mov ecx, esi
call fcn.004223b3
cmp eax, edi
jne 0x4239c5
cmp dword [ebp + 0x18], edi
je 0x423a26
cmp dword [ebx], 0xce
je 0x423a2e
mov edi, 0x2f78
jmp 0x4239c7
cmp dword [ebx], 0xc8
jmp 0x423a1d
lea eax, [ebp - 0x10]
push eax
push 5
mov ecx, esi
call fcn.004223b3
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x1450], eax
mov dword [esi + 0x1454], edi
jmp 0x4239c7

Function at 0x423e2f
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
test byte [ebp + 0x10], 0x80
je 0x423e3e
pop ebp
jmp method.Cabinet::CExtract.virtual_20
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0x18]

Function at 0x423eb1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
lea ecx, [esi + 0x48]
call fcn.00421c97
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
test eax, eax
jl 0x423edf
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
test eax, eax
jle 0x423ee7
add dword [edi + 4], eax
jmp 0x423ee7
call fcn.00488c13
add esp, 0xc
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x424584
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00488c13
mov esi, eax
add esp, 0xc
cmp esi, dword [ebp + 0x10]
je 0x4245ac
call fcn.004898d1
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, esi
pop esi
pop ebp
ret 0x10
Function at 0x424994
Capabilities:
Delete file

Disassembly:
push 0x24
mov eax, 0x4b48ee
call fcn.00485421
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x1108], eax
je 0x4249cd
and dword [esi + 0x10e8], 0
add esi, 0x10cc
and dword [esi + 0x20], 0
mov dword [esi + 0x18], 0x3f3
jmp 0x424baf
xor edi, edi
cmp dword [esi + 0x10f0], edi
je 0x424baf
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 8]
mov dword [esi + 0x1104], eax
mov dword [esi + 0x10f4], edi
call fcn.0042168a
lea ebx, [esi + 0x10cc]
mov ecx, ebx
mov dword [ebp - 0x10], ebx
call fcn.0041e3be
push dword [ebp + 0xc]
mov dword [esi + 0x4c], edi
lea edi, [esi + 0x58]
mov ecx, edi
call fcn.0041dc27
push edi
call fcn.0041ded3
mov dword [esp], 0x4c115c
push dword [edi]
call fcn.00484c33
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
lea ecx, [ebp - 0x30]
mov dword [esi + 0x10f8], eax
call fcn.00421e07
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00421e07
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0041df1e
add esp, 0xc
mov ecx, edi
call fcn.0041db3c
cmp eax, 3
jb 0x424b8e
lea ecx, [ebp - 0x30]
call fcn.0041db3c
cmp eax, 2
jb 0x424b8e
lea ecx, [ebp - 0x18]
call fcn.0041db3c
cmp eax, 2
jb 0x424b8e
lea edi, [esi + 0x60]
mov eax, dword [edi]
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x28]
call fcn.00421dea
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00421dea
mov ebx, 0x423da6
jmp 0x424afa
mov ecx, edi
call fcn.0041db3c
test eax, eax
je 0x424b31
push edi
lea ecx, [ebp - 0x18]
call fcn.0041dc27
push dword [ebp - 0x20]
call fcn.00485811
push dword [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00485811
mov eax, dword [edi]
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x28]
call fcn.00421dea
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00421dea
push dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
push 0
push ebx
push 0
push dword [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.0041dae4
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
call fcn.0041dae4
push eax
push dword [esi + 0x10f0]
call dword [esi + 0x1114]
add esp, 0x1c
test eax, eax
jne 0x424ab5
push dword [ebp - 0x20]
call fcn.00485811
push dword [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00485811
pop ecx
pop ecx
push dword [esi + 8]
mov ecx, esi
call fcn.00422bde
cmp dword [esi + 0x10f4], 0
je 0x424b69
cmp dword [esi + 8], 0
je 0x424b69
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x10]
call fcn.0041e3ee
push dword [ebp - 0x18]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call fcn.00485811
push dword [ebp - 0x30]
call fcn.00485811
pop ecx
pop ecx
mov eax, esi
jmp 0x424bb1
push dword [ebp - 0x18]
and dword [ebx + 0x1c], 0
and dword [ebx + 0x20], 0
mov dword [ebx + 0x18], 0x3ea
call fcn.00485811
push dword [ebp - 0x30]
call fcn.00485811
pop ecx
pop ecx
xor eax, eax
call fcn.004854f9
ret 0xc
Function at 0x424e4c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ebp, ebp
cmp dword [esi + 0x1108], eax
je 0x424e7a
lea eax, [esi + 0x10cc]
mov dword [eax + 0x18], 0x3f3
mov dword [eax + 0x1c], ebp
mov dword [eax + 0x20], ebp
xor eax, eax
jmp 0x424fb6
mov eax, dword [0x4ec054]
cmp eax, 0xffffffff
je 0x424e9e
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebp
je 0x424e9e
lea eax, [esi + 0x10cc]
mov dword [eax + 0x18], 0x3f4
jmp 0x424e6d
push esi
push 1
call fcn.004216a8
pop ecx
pop ecx
test eax, eax
jne 0x424ebe
lea eax, [esi + 0x10cc]
mov dword [eax + 0x18], ebp
mov dword [eax + 0x1c], 0xe
jmp 0x424e70
push ebx
lea ebx, [esi + 0x10cc]
mov ecx, ebx
call fcn.0041e3be
cmp dword [esi + 0x10f0], ebp
jne 0x424f73
cmp dword [esi + 0x110c], ebp
jne 0x424f77
push edi
push str.Cabinet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICreate
push eax
mov dword [esi + 0x110c], eax
call edi
push str.FDICopy
push dword [esi + 0x110c]
mov dword [esi + 0x1110], eax
call edi
push str.FDIIsCabinet
push dword [esi + 0x110c]
mov dword [esi + 0x1114], eax
call edi
push str.FDIDestroy
push dword [esi + 0x110c]
mov dword [esi + 0x1118], eax
call edi
mov dword [esi + 0x111c], eax
pop edi
cmp dword [esi + 0x1110], ebp
je 0x424f60
cmp dword [esi + 0x1114], ebp
je 0x424f60
cmp dword [esi + 0x1118], ebp
je 0x424f60
cmp eax, ebp
jne 0x424f77
mov dword [esi + 0x110c], ebp
mov dword [ebx + 0x18], 0x3e8
mov dword [ebx + 0x1c], ebp
mov dword [ebx + 0x20], ebp
xor eax, eax
jmp 0x424fb5
push ebx
push 1
push 0x423d7d
push fcn.00423d5c
push 0x4229d7
push 0x423d33
push 0x424c5a
push 0x4216dd
push 0x4216d8
call dword [esi + 0x1110]
xor ecx, ecx
add esp, 0x24
cmp eax, ebp
setne cl
mov dword [esi + 0x10f0], eax
mov eax, ecx
pop ebx
pop esi
pop ebp
ret
Function at 0x425706
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 4
mov eax, 0x4b4a9e
call fcn.00485421
mov esi, ecx
xor edi, edi
xor eax, eax
cmp dword [esi], edi
je 0x42573a
inc eax
jmp 0x4258ab
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push edi
push eax
call fcn.00484550
add esp, 0xc
push 0x104
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040b680
push str._system32wininet.dll
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.0041cbde
push dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call edi
mov ebx, eax
test ebx, ebx
jne 0x425795
push str.wininet.dll
call edi
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4c167c
push ebx
call edi
push 0x4c1668
push ebx
mov dword [esi + 4], eax
call edi
push 0x4c1654
push ebx
mov dword [esi + 8], eax
call edi
push 0x4c1640
push ebx
mov dword [esi + 0xc], eax
call edi
push 0x4c162c
push ebx
mov dword [esi + 0x10], eax
call edi
push str.InternetGetLastResponseInfoW
push ebx
mov dword [esi + 0x14], eax
call edi
push 0x4c15f0
push ebx
mov dword [esi + 0x18], eax
call edi
push 0x4c15dc
push ebx
mov dword [esi + 0x1c], eax
call edi
push str.HttpAddRequestHeadersW
push ebx
mov dword [esi + 0x20], eax
call edi
push 0x4c15b0
push ebx
mov dword [esi + 0x24], eax
call edi
push 0x4c159c
push ebx
mov dword [esi + 0x28], eax
call edi
push 0x4c158c
push ebx
mov dword [esi + 0x2c], eax
call edi
push str.FtpOpenFileW
push ebx
mov dword [esi + 0x30], eax
call edi
push str.FtpCommandW
push ebx
mov dword [esi + 0x34], eax
call edi
push str.FtpGetFileSize
push ebx
mov dword [esi + 0x38], eax
call edi
xor ecx, ecx
mov dword [esi + 0x3c], eax
cmp dword [esi + 4], ecx
je 0x42589e
cmp dword [esi + 8], ecx
je 0x42589e
cmp dword [esi + 0xc], ecx
je 0x42589e
cmp dword [esi + 0x10], ecx
je 0x42589e
cmp dword [esi + 0x14], ecx
je 0x42589e
cmp dword [esi + 0x18], ecx
je 0x42589e
cmp dword [esi + 0x1c], ecx
je 0x42589e
cmp dword [esi + 0x20], ecx
je 0x42589e
cmp dword [esi + 0x24], ecx
je 0x42589e
cmp dword [esi + 0x28], ecx
je 0x42589e
cmp dword [esi + 0x2c], ecx
je 0x42589e
cmp dword [esi + 0x30], ecx
je 0x42589e
cmp dword [esi + 0x34], ecx
je 0x42589e
cmp dword [esi + 0x38], ecx
je 0x42589e
cmp eax, ecx
je 0x42589e
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040dd20
xor eax, eax
jmp 0x425734
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040dd20
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00484647
add ebp, 0x20c
leave
ret
Function at 0x428860
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [ebp + 8]
push ebx
push esi
mov esi, dword [0x4ecd30]
push edi
push dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
xor edi, edi
cmp ebx, edi
jne 0x42888b
xor eax, eax
jmp 0x42892e
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x428884
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp ebx, edi
je 0x428884
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, edi
jne 0x4288c8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x428884
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
jne 0x4288dd
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
jmp 0x4288c0
push dword [ebp - 4]
push ebx
push eax
call fcn.0048a600
add esp, 0xc
push esi
mov dword [ebp + 8], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp + 8]
xor ebx, ebx
call fcn.0042846c
push eax
push edi
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x428918
push edi
push dword [ebp + 8]
call fcn.00428356
pop ecx
pop ecx
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x42892c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x428c29
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0xc]
xor esi, esi
push esi
call fcn.00428482
cmp dword [ebp + 8], esi
jne 0x428c47
xor eax, eax
jmp 0x428c66
push ebx
push esi
push esi
push 3
push esi
push esi
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x428c6b
xor eax, eax
pop ebx
pop esi
leave
ret 8
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp dword [ebp - 8], esi
jle 0x428c86
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x428c65
push edi
push dword [ebp - 0xc]
call fcn.00485674
mov edi, eax
pop ecx
cmp edi, esi
je 0x428cc1
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp - 0xc]
mov dword [ebp + 8], esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push dword [ebp - 0xc]
push edi
call fcn.00428b76
push edi
mov esi, eax
call fcn.004849fc
pop ecx
pop edi
jmp 0x428c7b
Function at 0x42d0ce
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4c2130]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4c2134]
mov dword [ebp - 8], eax
mov ax, word [ebp + 8]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x42d10b
xor eax, eax
xor edx, edx
jmp 0x42d137
push 8
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00484550
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x42d105
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484647
leave
ret 4

Function at 0x42ddd1
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x1fa4]
mov eax, 0x2024
call fcn.00484d50
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x1fa0], eax
push esi
mov esi, dword [ebp + 0x1fac]
test esi, esi
jne 0x42ddff
xor eax, eax
jmp 0x42de75
push 0x1e
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00484550
push 0x2000
lea eax, [ebp - 0x60]
push 0
push eax
mov dword [ebp - 0x7c], 3
call fcn.00484550
mov eax, 0x1000
push eax
push esi
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0048573e
lea eax, [ebp - 0x60]
push eax
call fcn.00484d27
xor ecx, ecx
mov word [ebp + eax*2 - 0x60], cx
lea eax, [ebp - 0x60]
push eax
call fcn.00484d27
xor ecx, ecx
mov word [ebp + eax*2 - 0x5e], cx
lea eax, [ebp - 0x60]
mov dword [ebp - 0x78], eax
mov eax, 0x614
mov word [ebp - 0x70], ax
add esp, 0x30
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp + 0x1fa0]
xor ecx, ebp
pop esi
call fcn.00484647
add ebp, 0x1fa4
leave
ret

Function at 0x42dfdb
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
test eax, eax
jne 0x42dfff
xor eax, eax
jmp 0x42e06d
cmp eax, 0x104
jg 0x42dffb
push 0x410
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00484550
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0x2710
push 0x4c21f0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp word [ebp - 0x414], 0
je 0x42dffb
lea eax, [ebp - 0x414]
push 0x4c21ec
push eax
call fcn.0048ad5e
pop ecx
pop ecx
test eax, eax
je 0x42dffb
push eax
call fcn.0048ac1c
pop ecx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00484647
leave
ret 4
Function at 0x42f326
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x4b5925
call fcn.00485421
mov dword [ebp - 0x14], ecx
xor ebx, ebx
push 0x5c
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.0042e7bc
push 0x4ce544
lea ecx, [ebp + 8]
call fcn.0041cbde
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
jle 0x42f3b6
push ebx
lea ecx, [ebp + 8]
call fcn.0042e237
cmp ax, 0x5c
jne 0x42f3ad
push ebx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.0041a88c
mov esi, dword [ebp - 0x10]
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42f3a1
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov edi, eax
test edi, edi
jne 0x42f3ba
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
call fcn.0042f2a7
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0
call fcn.0040dd20
mov eax, dword [ebp + 8]
inc ebx
cmp ebx, dword [eax - 0xc]
jl 0x42f359
xor edi, edi
jmp 0x42f3c2
lea ecx, [esi - 0x10]
call fcn.0040dd20
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040dd20
mov eax, edi
call fcn.004854f9
ret 4