joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011ae
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x459210]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
push 0xc35
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x401214
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00435430
add esp, 0xc
push 0x400
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x401214
add esi, 0x10
lea eax, [ebp - 0x804]
call fcn.00401248
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004351c0
leave
ret

Function at 0x401681
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x459210]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
cmp dword [eax + 0x18], 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
jb 0x4016b4
mov eax, dword [eax + 4]
jmp 0x4016b7
add eax, 4
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x74]
push ecx
xor ebx, ebx
push ebx
push 0xf003f
push ebx
push 0x449dac
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401743
cmp dword [ebp - 0x74], ebx
je 0x401743
mov eax, 0x208
push eax
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.00435430
add esp, 0xc
cmp dword [edi + 0x18], 8
jb 0x401704
mov edi, dword [edi + 4]
jmp 0x401707
add edi, 4
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push edi
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, ebx
jne 0x40172c
lea eax, [ebp - 0x70]
call fcn.00401248
cmp dword [ebp - 0x74], ebx
je 0x40173a
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, ebx
sete al
jmp 0x401745
xor al, al
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004351c0
add ebp, 0x19c
leave
ret 4

Function at 0x40175f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [eax + 0x18], 8
push ebx
push esi
mov esi, ecx
jb 0x401773
mov eax, dword [eax + 4]
jmp 0x401776
add eax, 4
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
xor ebx, ebx
push ebx
push 0xf003f
push ebx
push 0x449dac
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4017eb
cmp dword [ebp - 4], ebx
je 0x4017eb
mov eax, dword [esi + 0x14]
add eax, eax
cmp dword [esi + 0x18], 8
jb 0x4017b2
mov esi, dword [esi + 4]
jmp 0x4017b5
add esi, 4
cmp dword [edi + 0x18], 8
jb 0x4017c0
mov ecx, dword [edi + 4]
jmp 0x4017c3
lea ecx, [edi + 4]
push eax
push esi
push 1
push ebx
push ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 4], ebx
mov esi, eax
je 0x4017e2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp esi, ebx
sete al
jmp 0x4017ed
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x402cd4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push 0x44
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.00435430
push 0x10
lea eax, [ebp - 0x14]
push ebx
push eax
mov dword [ebp - 0x5c], 0x44
call fcn.00435430
add esp, 0x18
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x30], 1
mov word [ebp - 0x2c], 5
jb 0x402d1a
mov esi, dword [esi + 4]
jmp 0x402d1d
add esi, 4
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x402d2b
mov eax, dword [eax + 4]
jmp 0x402d2e
add eax, 4
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x5c]
push ecx
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402d5a
cmp dword [ebp - 0x14], ebx
je 0x402d56
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x402d5c
xor al, al
pop esi
pop ebx
leave
ret 4
Function at 0x403bd3
Capabilities:
Accept command line arguments

Disassembly:
push 0x28
mov eax, 0x4455eb
call fcn.004372c5
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [eax + 0x18], 8
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], esi
jb 0x403bf5
mov eax, dword [eax + 4]
jmp 0x403bf8
add eax, 4
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
cmp ebx, esi
jne 0x403c0d
xor al, al
jmp 0x403c60
xor edi, edi
cmp dword [ebp - 0x30], esi
jle 0x403c4c
jmp 0x403c18
xor esi, esi
mov eax, dword [ebx + edi*4]
lea ecx, [ebp - 0x2c]
call fcn.00401222
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], esi
je 0x403c37
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x34]
call fcn.00403cbd
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea esi, [ebp - 0x2c]
call fcn.004012b6
inc edi
cmp edi, dword [ebp - 0x30]
jl 0x403c16
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x34]
call fcn.00403ca7
test eax, eax
setne al
call fcn.00437348
ret 4
Function at 0x4060a5
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x459210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x4060c6
mov eax, dword [eax + 4]
jmp 0x4060c9
add eax, 4
push 0x100
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4060f0
mov eax, dword [ebp - 0x2b8]
mov dword [esi + 0x18], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004351c0
leave
ret 4

Function at 0x408b3f
Capabilities:
Get graphical window text

Disassembly:
push 0x274
mov eax, 0x44634b
call fcn.004372c5
lea eax, [ebp - 0x258]
mov edi, ecx
push 0x5087
push eax
mov dword [ebp - 0x264], edi
call fcn.00402c83
pop ecx
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x240], 8
mov eax, dword [ebp - 0x254]
jae 0x408b82
lea eax, [ebp - 0x254]
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
push dword [edi + 4]
call esi
push 0x20a
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.00435430
add esp, 0xc
push 0x3ec
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov dword [ebp - 0x25c], eax
je 0x408bfd
push eax
call ebx
test eax, eax
je 0x408bfd
push 0x104
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x408bfd
and word [ebp - 0x18], 0
lea esi, [edi + 0x298]
lea eax, [ebp - 0x220]
call fcn.00401248
jmp 0x408c26
push dword [ebp - 0x25c]
call ebx
test eax, eax
je 0x408c26
lea eax, [edi + 0x298]
cmp dword [eax + 0x18], 8
jb 0x408c1a
mov eax, dword [eax + 4]
jmp 0x408c1d
add eax, 4
push eax
push dword [ebp - 0x25c]
call esi
add edi, 0x298
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x25c], edi
call fcn.0042d3b4
push 0xffffffffffffffff
push edi
xor ebx, ebx
mov byte [ebp - 4], 1
call fcn.00401322
push ebx
push 1
lea esi, [ebp - 0x280]
mov byte [ebp - 4], bl
call fcn.004012b6
push 0x44a09c
mov eax, edi
call fcn.0040c1e0
mov edi, dword [ebp - 0x264]
cmp byte [edi + 0x90], bl
pop ecx
je 0x408d4d
cmp dword [edi + 0x88], ebx
je 0x408d4d
mov eax, dword [ebp - 0x25c]
lea esi, [edi + 0x74]
call fcn.0040bf90
test eax, eax
je 0x408d4d
lea eax, [edi + 0x324]
lea esi, [ebp - 0x23c]
call fcn.00403d1d
mov ebx, esi
mov byte [ebp - 4], 2
call fcn.0040c2e0
push 0x25
push 0x3a
mov edi, esi
call fcn.0040c110
push 0x25
push 0x5c
call fcn.0040c110
mov edi, str.SoftwareHaoZip_SFX
add esp, 0x10
mov eax, edi
lea ecx, [ebp - 0x280]
call fcn.00401222
lea eax, [ebp - 0x280]
call fcn.0040162e
xor ebx, ebx
push ebx
push 1
lea esi, [ebp - 0x280]
mov byte [ebp - 0x25d], al
call fcn.004012b6
cmp byte [ebp - 0x25d], bl
je 0x408d3d
mov eax, edi
lea ecx, [ebp - 0x280]
call fcn.00401222
mov ecx, dword [ebp - 0x25c]
lea edi, [ebp - 0x23c]
lea eax, [ebp - 0x280]
call fcn.0040175f
push ebx
push 1
lea esi, [ebp - 0x280]
call fcn.004012b6
push ebx
push 1
lea esi, [ebp - 0x23c]
call fcn.004012b6
xor ebx, ebx
push ebx
push 1
lea esi, [ebp - 0x258]
call fcn.004012b6
call fcn.00437348
ret
Function at 0x40b800
Capabilities:
Move file

Disassembly:
mov edx, 8
cmp dword [eax + 0x18], edx
jb 0x40b80f
mov eax, dword [eax + 4]
jmp 0x40b812
add eax, 4
cmp dword [ecx + 0x18], edx
jb 0x40b828
mov ecx, dword [ecx + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
ret
add ecx, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
ret

Function at 0x40b840
Capabilities:
Create directory

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x40b858
mov eax, dword [eax + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
ret
add eax, 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
ret

Function at 0x40b870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x446628
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x459210]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
mov eax, dword [0x459210]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 0x44a454
mov esi, ecx
call fcn.0043552d
add esp, 4
push eax
mov eax, esi
call fcn.0040be00
cmp eax, 0xffffffff
jne 0x40b8dd
cmp dword [esi + 0x18], 8
jb 0x40b8c7
mov esi, dword [esi + 4]
jmp 0x40b8ca
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x40b942
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], eax
mov word [esp + 0x38], ax
lea edx, [esp + 0xc]
push edx
push esi
mov dword [esp + 0x68], eax
call fcn.0040e7c0
add esp, 8
cmp dword [esp + 0x4c], 8
mov bl, al
jb 0x40b940
mov eax, dword [esp + 0x38]
push eax
call fcn.00435588
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.004351c0
add esp, 0x58
ret
Function at 0x40d510
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x445ae8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x459210]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov eax, dword [0x459210]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3c]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
xor esi, esi
push ecx
xor ebx, ebx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00401322
push 0x24
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], esi
call fcn.0040cf00
mov eax, dword [esp + 0x14]
mov esi, 8
add esp, 4
cmp dword [esp + 0x24], esi
jae 0x40d58a
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40d5ad
cmp dword [esp + 0x24], esi
jb 0x40d5a9
mov edx, dword [esp + 0x10]
push edx
call fcn.00435588
add esp, 4
mov al, 1
jmp 0x40d5c2
cmp dword [esp + 0x24], esi
jb 0x40d5c0
mov eax, dword [esp + 0x10]
push eax
call fcn.00435588
add esp, 4
xor al, al
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004351c0
add esp, 0x2c
ret

Function at 0x40d5e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x445ae8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x459210]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov eax, dword [0x459210]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3c]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
xor esi, esi
push ecx
xor ebx, ebx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00401322
push 0x24
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], esi
call fcn.0040cf00
mov eax, dword [esp + 0x14]
mov esi, 8
add esp, 4
cmp dword [esp + 0x24], esi
jae 0x40d65a
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40d681
test al, 0x10
jne 0x40d681
cmp dword [esp + 0x24], esi
jb 0x40d67d
mov edx, dword [esp + 0x10]
push edx
call fcn.00435588
add esp, 4
mov al, 1
jmp 0x40d696
cmp dword [esp + 0x24], esi
jb 0x40d694
mov eax, dword [esp + 0x10]
push eax
call fcn.00435588
add esp, 4
xor al, al
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004351c0
add esp, 0x2c
ret
Function at 0x40d6c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x445ae8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x459210]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov eax, dword [0x459210]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3c]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
xor esi, esi
push ecx
xor ebx, ebx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00401322
push 0x24
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], esi
call fcn.0040cf00
mov eax, dword [esp + 0x14]
mov esi, 8
add esp, 4
cmp dword [esp + 0x24], esi
jae 0x40d73a
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40d761
test al, 0x10
je 0x40d761
cmp dword [esp + 0x24], esi
jb 0x40d75d
mov edx, dword [esp + 0x10]
push edx
call fcn.00435588
add esp, 4
mov al, 1
jmp 0x40d776
cmp dword [esp + 0x24], esi
jb 0x40d774
mov eax, dword [esp + 0x10]
push eax
call fcn.00435588
add esp, 4
xor al, al
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004351c0
add esp, 0x2c
ret

Function at 0x40d7a0
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
cmp dword [edi + 0x18], 8
push esi
lea esi, [edi + 4]
jb 0x40d7ae
mov eax, dword [esi]
jmp 0x40d7b0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
cmp dword [edi + 0x18], 8
jb 0x40d7c4
mov ecx, dword [esi]
jmp 0x40d7c6
mov ecx, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [edi + 0x18], 8
jb 0x40d7d6
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
pop esi
ret
Function at 0x40dcf0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4461e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x459210]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x459210]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x48]
mov eax, dword [ebp + 0x14]
xor edi, edi
test eax, eax
mov dword [esp + 0x14], eax
jbe 0x40de21
cmp edi, dword [ebp + 0x14]
jbe 0x40dd41
call fcn.004358f5
mov ebx, 8
cmp dword [ebp + 0x18], ebx
lea esi, [ebp + 4]
jb 0x40dd52
mov eax, dword [esi]
jmp 0x40dd54
mov eax, esi
cmp word [eax + edi*2], 0x2f
je 0x40dd7b
cmp edi, dword [ebp + 0x14]
jbe 0x40dd65
call fcn.004358f5
cmp dword [ebp + 0x18], ebx
jb 0x40dd6e
mov eax, dword [esi]
jmp 0x40dd70
mov eax, esi
cmp word [eax + edi*2], 0x5c
jne 0x40de14
push edi
push ebp
xor ebx, ebx
lea esi, [esp + 0x20]
call fcn.00407dbd
xor esi, esi
mov dword [esp + 0x40], esi
cmp dword [esp + 0x2c], esi
jne 0x40dda3
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jmp 0x40ddf4
lea ecx, [esp + 0x18]
push ecx
call fcn.0040d510
add esp, 4
test al, al
mov ebx, 8
jne 0x40dde8
cmp dword [esp + 0x30], ebx
mov eax, dword [esp + 0x1c]
jae 0x40ddc7
lea eax, [esp + 0x1c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40dde8
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], ebx
jb 0x40de03
mov edx, dword [esp + 0x1c]
push edx
jmp 0x40ddfb
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], ebx
jb 0x40de03
mov eax, dword [esp + 0x1c]
push eax
call fcn.00435588
add esp, 4
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], esi
mov word [esp + 0x1c], si
add edi, 1
cmp edi, dword [esp + 0x14]
jb 0x40dd37
push ebp
call fcn.0040d510
add esp, 4
test al, al
jne 0x40de4d
cmp dword [ebp + 0x18], 8
jb 0x40de39
mov eax, dword [ebp + 4]
jmp 0x40de3c
lea eax, [ebp + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40de4d
xor al, al
jmp 0x40de56
push ebp
call fcn.0040d6c0
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004351c0
add esp, 0x30
ret
Function at 0x40e900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x447198
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x459210]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebx, ebx
mov eax, 0x44a4b4
lea esi, [esp + 0xc]
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], ebx
mov word [esp + 0x10], bx
call fcn.00401248
mov dword [esp + 0x30], ebx
cmp byte [edi], bl
je 0x40e975
lea esi, [edi + 4]
push esi
call fcn.0040d7f0
add esp, 4
push esi
call fcn.0040d510
add esp, 4
test al, al
setne al
cmp al, bl
mov byte [edi], al
jne 0x40e975
mov eax, esi
call fcn.00407d0e
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.0040baa0
add esp, 8
cmp dword [esp + 0x24], 8
mov bl, al
mov byte [edi], bl
jb 0x40e99e
mov edx, dword [esp + 0x10]
push edx
call fcn.00435588
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret

Function at 0x40ef60
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
push edi
mov edi, eax
lea ebp, [edi + 0xc]
test ebp, ebp
je 0x40ef79
mov eax, dword [ebp]
test eax, eax
je 0x40ef79
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 8]
test eax, eax
jne 0x40ef97
test ebp, ebp
je 0x40ef92
mov ebp, dword [ebp]
test ebp, ebp
je 0x40ef92
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor al, al
pop ebp
ret
cmp dword [eax + 4], 0
je 0x40ef80
push esi
add eax, 0xc
push eax
push 4
push edi
push 0x40ebe0
push 0
push 0
call fcn.0043659f
mov ecx, dword [edi + 8]
mov dword [ecx + 0x10], eax
mov edx, dword [edi + 8]
add esp, 0x18
cmp dword [edx + 0x10], 0
jne 0x40f004
mov eax, edx
or esi, 0xffffffff
mov dword [eax + 0x10], esi
mov edi, dword [edi + 8]
mov eax, dword [edi + 0x10]
cmp eax, esi
je 0x40efe1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], esi
test ebp, ebp
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
je 0x40effe
mov ebp, dword [ebp]
test ebp, ebp
je 0x40effe
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
xor al, al
pop ebp
ret
mov ecx, edx
mov byte [ecx + 8], 1
mov edx, dword [edi + 8]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x40f02b
mov esi, dword [edi + 8]
call fcn.0040ede0
mov ecx, dword [edi + 8]
mov byte [ecx + 8], 0
test ebp, ebp
je 0x40f03d
mov ebp, dword [ebp]
test ebp, ebp
je 0x40f03d
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
mov al, 1
pop ebp
ret
Function at 0x40fa10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x459210]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push 0x20a
lea eax, [esp + 0xa]
push 0
push eax
mov esi, ecx
mov word [esp + 0x10], 0
call fcn.00435430
add esp, 0xc
push 0x105
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
add eax, 0xffffffff
cmp eax, 0x103
ja 0x40fa87
lea eax, [esp + 4]
mov word [esp + 0x20e], 0
call fcn.00401248
mov al, 1
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004351c0
add esp, 0x210
ret
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
xor al, al
call fcn.004351c0
add esp, 0x210
ret

Function at 0x40fb00
Capabilities:
Set file attributes

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x40fb17
mov eax, dword [eax + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret
add eax, 4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x40fb30
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x1c
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, 8
cmp dword [ebp + 0x18], esi
push edi
lea edi, [ebp + 4]
jb 0x40fb4b
mov eax, dword [edi]
jmp 0x40fb4d
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40fb61
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x1c
ret
cmp dword [ebp + 0x18], esi
jb 0x40fb6a
mov eax, dword [edi]
jmp 0x40fb6c
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov dword [esp + 0x2c], eax
je 0x40fc41
cmp dword [ebp + 0x18], esi
jb 0x40fb89
mov eax, dword [edi]
jmp 0x40fb8b
mov eax, edi
push ebx
xor ebx, ebx
lea esi, [esp + 0x10]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], bx
call fcn.00401248
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
jae 0x40fbb7
lea eax, [esp + 0x14]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
mov esi, 8
sete bl
cmp dword [esp + 0x28], esi
jb 0x40fbdc
mov eax, dword [esp + 0x14]
push eax
call fcn.00435588
add esp, 4
test bl, bl
pop ebx
jne 0x40fc41
cmp dword [ebp + 0x18], esi
jb 0x40fbea
mov eax, dword [edi]
jmp 0x40fbec
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40fb58
cmp dword [ebp + 0x18], esi
jb 0x40fc04
mov eax, dword [edi]
jmp 0x40fc06
mov eax, edi
xor ecx, ecx
lea esi, [esp + 0xc]
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], ecx
mov word [esp + 0x10], cx
call fcn.00401248
mov ecx, dword [esp + 0x2c]
mov eax, esi
call fcn.0040fb00
cmp dword [esp + 0x24], 8
jb 0x40fc41
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00435588
add esp, 4
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x1c
ret