joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bd25
Capabilities:
Get file version info

Disassembly:
mov eax, 0x430225
call fcn.00425470
sub esp, 0x21c
mov eax, dword [0x441ddc]
push esi
push edi
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x10], eax
call fcn.0040160e
and word [ebp - 0x218], 0
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
xor eax, eax
test esi, esi
mov ecx, 0x81
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
jne 0x41bd87
push 0x103
lea eax, [ebp - 0x218]
push eax
push esi
call dword [0x443c50]
lea esi, [ebp - 0x218]
lea eax, [ebp - 0x228]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov dword [ebp - 0x21c], eax
je 0x41be00
push eax
call fcn.004250aa
pop ecx
mov edi, eax
push edi
push dword [ebp - 0x21c]
push dword [ebp - 0x228]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41bdf9
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
push 0x435640
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41bdf9
push 0x34
push dword [ebp - 0x220]
push dword [ebp + 0xc]
call fcn.0042549c
push edi
call fcn.004252f2
xor esi, esi
add esp, 0x10
inc esi
jmp 0x41be02
push edi
call fcn.004252f2
pop ecx
xor esi, esi
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.0040103c
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
call fcn.0042527f
leave
ret

Function at 0x41e25c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x430559
call fcn.00425470
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, ecx
inc ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], ebx
xor edi, edi
lea ecx, [esi + 0x14]
mov dword [ebp - 4], edi
mov dword [esi], 0x4387a8
call dword [0x443e74]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], bl
call dword [0x443e74]
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 2
call dword [0x443e74]
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x80]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
push dword [ebp + 8]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
mov dword [esi + 8], ebx
call dword [0x443e5c]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x78], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x7c], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x41ed44
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4306be
call fcn.00425470
mov eax, 0x4010
call fcn.004254e0
mov eax, dword [0x441ddc]
push ebx
push esi
push edi
push 0x436128
push dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x4018], edi
mov byte [ebp - 0x4011], 1
call dword [0x443fd8]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
pop ecx
pop ecx
jne 0x41ed91
xor al, al
jmp 0x41ee3d
push ebx
add edi, 4
push ebx
mov ecx, edi
call fcn.0041ecee
test byte [esi + 0xc], 0x10
jne 0x41ede7
cmp byte [ebp - 0x4011], bl
je 0x41ee2f
push esi
push 0x4000
lea eax, [ebp - 0x4010]
push 1
push eax
call dword [0x443f10]
add esp, 0x10
push ebx
push eax
lea eax, [ebp - 0x4010]
push eax
mov ecx, edi
call fcn.0041cd0d
test byte [esi + 0xc], 0x10
mov byte [ebp - 0x4011], al
je 0x41eda3
cmp al, bl
je 0x41ee2f
push 0x48
call fcn.0042506c
pop ecx
mov ecx, eax
mov dword [ebp - 0x401c], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x41ee07
call fcn.0041c318
mov edi, eax
jmp 0x41ee09
xor edi, edi
push dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0x10]
call dword [0x443e5c]
mov eax, dword [ebp - 0x4018]
mov ecx, dword [eax + 0x18]
push edi
call fcn.0041e0d0
mov ecx, edi
call fcn.0041c2cb
push esi
call dword [0x443f14]
mov al, byte [ebp - 0x4011]
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0042527f
leave
ret 4
Function at 0x4218ff
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
je 0x42193f
mov esi, dword [esp + 0x10]
cmp dword [esi + 4], 0
je 0x42193f
mov ebx, dword [0x443b44]
push eax
call ebx
test eax, eax
je 0x42193f
push dword [esi + 4]
call ebx
test eax, eax
je 0x42193f
push dword [esi + 4]
push dword [edi + 4]
call dword [0x443b2c]
neg eax
sbb eax, eax
neg eax
jmp 0x421941
xor al, al
pop edi
pop esi
pop ebx
ret 4

Function at 0x423235
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3d94
call fcn.004254e0
mov eax, dword [0x441ddc]
push esi
push edi
mov dword [ebp - 4], eax
mov edx, ecx
xor esi, esi
xor eax, eax
mov dword [ebp - 0x3d94], esi
mov dword [ebp - 0x3d90], esi
mov ecx, 0xede
lea edi, [ebp - 0x3d8c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x3d94]
push eax
push 1
lea eax, [ebp + 8]
push eax
push esi
mov ecx, edx
call fcn.00421c77
test eax, eax
jge 0x42328d
mov eax, 0x80004005
jmp 0x4232fa
xor eax, eax
mov word [ebp - 0x210], si
mov ecx, 0x82
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x3d84]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [0x443f4c]
add esp, 0xc
lea eax, [ebp - 0x22e2]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [0x4440f0]
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call fcn.004019ce
push dword [esi]
call dword [0x444104]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0042527f
leave
ret 0xc
Function at 0x4235c1
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x430a80
call fcn.00425470
sub esp, 0x21c
mov eax, dword [0x441ddc]
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x10], eax
lea esi, [ebx + 8]
xor edx, edx
xor eax, eax
cmp dword [esi], edx
push edi
jne 0x423763
mov word [ebp - 0x21c], dx
mov ecx, 0x82
lea edi, [ebp - 0x21a]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x21c]
push eax
push edx
call dword [0x443c50]
lea eax, [ebp - 0x21c]
push eax
call dword [0x4440fc]
push str.DownloadWrapperEx.dll
lea eax, [ebp - 0x21c]
push eax
call dword [0x4440f0]
lea eax, [ebp - 0x21c]
push eax
call dword [0x444104]
test eax, eax
je 0x42375f
push esi
push 0x438988
push 0x4389b8
lea eax, [ebp - 0x21c]
push eax
mov ecx, ebx
call fcn.0042150f
xor edi, edi
cmp eax, edi
mov dword [ebx + 0x14], eax
je 0x42375f
cmp dword [esi], edi
je 0x42375f
mov dword [ebp - 0x220], edi
mov eax, dword [0x442d5c]
cmp eax, edi
mov dword [ebp - 4], edi
je 0x4236ad
mov ecx, dword [eax]
lea edx, [ebp - 0x220]
push edx
push eax
call dword [ecx + 0x18]
cmp eax, edi
jl 0x4236ad
cmp dword [ebp - 0x220], edi
je 0x4236ad
push dword [ebp - 0x220]
call dword [0x444060]
mov eax, dword [esi]
push dword [ebp - 0x220]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
cmp eax, edi
jge 0x4236c6
xor esi, esi
jmp 0x42374f
lea ecx, [ebp - 0x224]
call fcn.0040160e
lea eax, [ebp - 0x224]
push eax
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.004234d2
cmp eax, edi
mov edi, dword [ebp - 0x224]
je 0x423723
push edi
call dword [0x444104]
test eax, eax
je 0x423723
push edi
lea ecx, [ebp - 0x228]
call fcn.00401cc6
mov eax, dword [eax]
mov ecx, dword [esi]
mov edx, dword [ecx]
push eax
push ecx
mov byte [ebp - 4], 2
call dword [edx + 0x24]
push dword [ebp - 0x228]
mov byte [ebp - 4], 1
call dword [0x444078]
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [ebx + 0xc]
push edx
push 0x438998
push eax
call dword [ecx]
lea eax, [ebx + 0x10]
push eax
push 0x4389c8
push ebx
push dword [esi]
call fcn.00422112
lea ecx, [edi - 0x10]
call fcn.0040103c
xor esi, esi
inc esi
push dword [ebp - 0x220]
call dword [0x444078]
mov eax, esi
jmp 0x423764
xor eax, eax
jmp 0x423764
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0042527f
leave
ret

Function at 0x423c8f
Capabilities:
Check if file exists
Create thread

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, ecx
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
jle 0x423ced
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x423ced
push edi
lea edi, [esi + 4]
push eax
mov ecx, edi
call fcn.0041e75a
mov eax, dword [esp + 0x18]
push dword [edi]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
call dword [0x444104]
test eax, eax
pop edi
je 0x423ced
xor eax, eax
push eax
push eax
push esi
push 0x423a9b
push eax
push eax
call dword [0x443f04]
xor ecx, ecx
add esp, 0x18
cmp eax, 0xffffffff
setne cl
mov dword [esi], eax
mov eax, ecx
jmp 0x423cef
xor eax, eax
pop esi
pop ebx
ret 0xc
Function at 0x40d908
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x10001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10003004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 8]
je 0x10001084
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x70529c
call esi
mov eax, 0x70529c
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x70529c
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x705116
call esi
mov eax, 0x705116
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x705116
call esi
pop esi
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.10001099
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423098
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00403a10
test al, al
je 0x4087ad
xor al, al
jmp 0x4088e1
push esi
lea ecx, [ebp - 0x28]
call fcn.00403aa0
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.00408310
lea ecx, [ebp - 0x28]
call fcn.00404450
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4088ce
lea ecx, [ebp - 0x40]
call fcn.00403a80
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040b290
test al, al
je 0x40880e
lea ecx, [ebp - 0x40]
call fcn.00404450
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00403a20
cmp esi, 0xffffffff
jne 0x4088ce
lea ecx, [ebp - 0x28]
call fcn.00403b90
cmp eax, 2
jbe 0x4088ca
lea ecx, [ebp - 0x28]
call fcn.00403b90
lea ecx, [ebp - 0x28]
lea ebx, [eax - 1]
call fcn.00403b80
mov esi, eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x408853
mov ecx, dword [esi]
cmp word [ecx + ebx*2], 0x5c
je 0x408872
lea ecx, [ebp - 0x28]
call fcn.00403b90
cmp dword [esi + 0x14], 8
jb 0x40886a
mov esi, dword [esi]
cmp word [esi + eax*2 - 2], 0x2f
jne 0x4088ca
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.00408310
lea ecx, [ebp - 0x28]
call fcn.00404450
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4088ce
lea ecx, [ebp - 0x40]
call fcn.00403a80
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040b290
test al, al
je 0x4088b9
lea ecx, [ebp - 0x40]
call fcn.00404450
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00403a20
cmp esi, 0xffffffff
jne 0x4088ce
xor bl, bl
jmp 0x4088d0
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403a20
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f929
mov esp, ebp
pop ebp
ret
Function at 0x408900
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423098
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00403a10
test al, al
je 0x40893d
xor al, al
jmp 0x408a77
push esi
lea ecx, [ebp - 0x28]
call fcn.00403aa0
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.00408310
lea ecx, [ebp - 0x28]
call fcn.00404450
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4089ab
lea ecx, [ebp - 0x40]
call fcn.00403a80
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040b290
test al, al
je 0x40899a
lea ecx, [ebp - 0x40]
call fcn.00404450
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00403a20
cmp ebx, 0xffffffff
je 0x4089b4
test bl, 0x10
je 0x408a64
lea ecx, [ebp - 0x28]
call fcn.00403b90
cmp eax, 2
jbe 0x408a60
lea ecx, [ebp - 0x28]
call fcn.00403b90
lea ecx, [ebp - 0x28]
lea ebx, [eax - 1]
call fcn.00403b80
mov esi, eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x4089e4
mov ecx, dword [esi]
cmp word [ecx + ebx*2], 0x5c
je 0x408a03
lea ecx, [ebp - 0x28]
call fcn.00403b90
cmp dword [esi + 0x14], 8
jb 0x4089fb
mov esi, dword [esi]
cmp word [esi + eax*2 - 2], 0x2f
jne 0x408a60
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.00408310
lea ecx, [ebp - 0x28]
call fcn.00404450
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x408a5b
lea ecx, [ebp - 0x40]
call fcn.00403a80
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040b290
test al, al
je 0x408a4a
lea ecx, [ebp - 0x40]
call fcn.00404450
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00403a20
cmp ebx, 0xffffffff
je 0x408a60
test bl, 0x10
je 0x408a64
xor bl, bl
jmp 0x408a66
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403a20
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f929
mov esp, ebp
pop ebp
ret
Function at 0x408aa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4230d0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00403a10
test al, al
je 0x408adc
xor al, al
jmp 0x408b66
push esi
lea ecx, [ebp - 0x28]
call fcn.00403aa0
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.00408310
lea ecx, [ebp - 0x28]
call fcn.00404450
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x408b4a
lea ecx, [ebp - 0x40]
call fcn.00403a80
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040b290
test al, al
je 0x408b39
lea ecx, [ebp - 0x40]
call fcn.00404450
push eax
call esi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00403a20
cmp ebx, 0xffffffff
je 0x408b53
test bl, 0x10
je 0x408b53
mov bl, 1
jmp 0x408b55
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403a20
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f929
mov esp, ebp
pop ebp
ret
Function at 0x408cf0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423170
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00403a10
test al, al
je 0x408d2d
xor al, al
jmp 0x408ed9
mov ecx, edi
call fcn.00408aa0
test al, al
je 0x408d3f
mov al, 1
jmp 0x408ed9
push 0
mov ecx, edi
call fcn.00404450
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call ebx
test eax, eax
jne 0x408d8e
lea ecx, [ebp - 0x28]
call fcn.00403a80
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.0040b290
test al, al
je 0x408d7f
push 0
lea ecx, [ebp - 0x28]
call fcn.00404450
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403a20
mov ecx, edi
call fcn.00408aa0
test al, al
jne 0x408d38
mov ecx, edi
call fcn.00403b90
xor esi, esi
mov dword [ebp - 0x44], eax
test eax, eax
je 0x408e7e
mov ecx, edi
call fcn.00403b80
mov ebx, eax
mov ecx, dword [ebx + 0x14]
mov eax, ebx
cmp ecx, 8
jb 0x408dc2
mov eax, dword [ebx]
mov edx, 0x2f
cmp dx, word [eax + esi*2]
mov edx, 0x5c
je 0x408de5
mov eax, ebx
cmp ecx, 8
jb 0x408ddb
mov eax, dword [ebx]
cmp dx, word [eax + esi*2]
jne 0x408e6e
push esi
push 0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.00404c60
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00403a10
test al, al
jne 0x408e5f
lea ecx, [ebp - 0x28]
call fcn.00408770
test al, al
jne 0x408e5f
push 0
lea ecx, [ebp - 0x28]
call fcn.00404450
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x408e5f
lea ecx, [ebp - 0x40]
call fcn.00403a80
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040b290
test al, al
je 0x408e53
push 0
lea ecx, [ebp - 0x40]
call fcn.00404450
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00403a20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403a20
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x408db6
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, edi
call fcn.00408770
test al, al
jne 0x408ed2
push 0
mov ecx, edi
call fcn.00404450
push eax
call ebx
test eax, eax
jne 0x408ed2
lea ecx, [ebp - 0x40]
call fcn.00403a80
mov dword [ebp - 4], 3
lea edx, [ebp - 0x40]
mov ecx, edi
call fcn.0040b290
test al, al
je 0x408ec3
push 0
lea ecx, [ebp - 0x40]
call fcn.00404450
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00403a20
mov ecx, edi
call fcn.00408aa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f929
mov esp, ebp
pop ebp
ret
Function at 0x40ae30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x43800c]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x40aeb2
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x40aeb2
test ecx, ecx
je 0x40aeae
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x40ae70
xor eax, eax
jmp 0x40aeb7
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x40aec1
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040f929
add esp, 0xc
ret 0xc
Function at 0x40b4b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x435fa8
push 0x411080
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x43800c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x20], 0x100
mov eax, dword [ecx]
mov edi, dword [eax + 0x28]
mov dword [ebp - 0x40], edi
test edi, edi
jne 0x40b519
xor eax, eax
jmp 0x40b68f
mov dword [ebp - 4], ebx
push str.InitializeSecurityDescriptor
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b65a
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x40b65a
push str.AllocateAndInitializeSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b65a
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x24]
push ecx
call eax
test eax, eax
je 0x40b65a
push str.GetLengthSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b65a
push dword [ebp - 0x28]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x40b65a
push str.InitializeAcl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b65a
push 2
push dword [ebp - 0x30]
push esi
call eax
test eax, eax
je 0x40b65a
push str.AddAccessAllowedAce
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b65a
push dword [ebp - 0x28]
push 0x10000000
push 2
push esi
call eax
test eax, eax
je 0x40b65a
push str.SetSecurityDescriptorDacl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x40b65a
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x40b643
push 0
push ecx
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x40b630
mov ebx, 1
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x2c], 0
je 0x40b640
jmp 0x40b65a
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
push 0
push esi
push 1
push dword [ebp - 0x34]
call eax
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.0040b6b6
test ebx, ebx
jne 0x40b68d
test esi, esi
je 0x40b67f
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x40b68d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0040f929
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40b8a0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x43800c]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x40b905
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b8e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40b905
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0040f929
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.0040f929
add esp, 8
ret 4