joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1062f57
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x111121c]
or dword [ebp - 0x210], 0xffffffff
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [ebp + 0xc], 0xa
mov dword [ebp - 4], eax
ja 0x1062fd4
cmp dword [ebp + 0xc], edi
jbe 0x1062fc8
cmp edi, 0xa
jae 0x1062fc8
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1062fbe
cmp eax, 0xffffffff
je 0x1062fbe
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x1062f87
jmp 0x1062fc8
mov dword [ebp - 0x210], 0x9cc0
xor eax, eax
cmp edi, dword [ebp + 0xc]
sete al
mov edi, eax
jmp 0x1062fde
mov dword [ebp - 0x210], 0x9cca
cmp dword [ebp + 0x14], 0
je 0x1063021
cmp dword [ebp - 0x210], 0xffffffff
je 0x1063021
mov eax, dword [ebp - 0x210]
sub eax, 0x9cca
neg eax
sbb eax, eax
push 0
not eax
lea ecx, [ebp - 0x214]
and eax, ecx
push eax
push 0x40
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0xa
push ebx
call fcn.01062c09
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.0105eca9
leave
ret 0x10

Function at 0x1063f5e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [esi + 8], edi
mov dword [ebp - 4], 3
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 4
je 0x1063f9d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esi + 4], eax
cmp dword [esi + 4], edi
jne 0x1063fbe
cmp dword [ebp - 4], 3
jne 0x1063fae
cmp dword [ebp - 8], 4
je 0x1063fbb
cmp dword [ebp - 4], 4
je 0x1063fbb
mov dword [esi + 4], 0x57
cmp dword [esi + 4], edi
mov eax, dword [ebp + 0xc]
pop edi
pop esi
jne 0x1063fc8
mov eax, dword [ebp - 0xc]
leave
ret 8

Function at 0x10640c5
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x10640f9
mov edx, dword [ebp + 8]
cmp dword [esi + 8], edx
ja 0x10640e3
mov eax, 0x103
jmp 0x10640f9
mov eax, dword [esi + 0x10]
mov ecx, dword [esi]
mov ecx, dword [ecx]
push eax
push dword [esi + 0xc]
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [esi + 0x14], eax
pop esi
pop ebp
ret 4
Function at 0x1064159
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp dword [esi + 8], ebx
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
je 0x10641de
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x106419e
cmp dword [esi + 0xc], ebx
je 0x10641a5
cmp eax, 0xea
jne 0x10641c5
push dword [ebp - 8]
mov ecx, esi
call fcn.01063fd1
lea eax, [ebp - 8]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
mov dword [esi + 4], eax
cmp dword [esi + 4], ebx
pop edi
jne 0x10641ed
cmp dword [ebp - 4], 1
je 0x10641de
cmp dword [ebp - 4], 2
je 0x10641de
mov dword [esi + 4], 0x57
cmp dword [esi + 4], ebx
jne 0x10641ed
cmp dword [ebp - 8], ebx
je 0x10641ed
mov eax, dword [esi + 0xc]
jmp 0x10641f0
lea eax, [esi + 0x1a]
pop esi
pop ebx
leave
ret 4

Function at 0x10641fb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp dword [esi + 8], ebx
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
je 0x1064280
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x1064240
cmp dword [esi + 0xc], ebx
je 0x1064247
cmp eax, 0xea
jne 0x1064267
push dword [ebp - 8]
mov ecx, esi
call fcn.01063fd1
lea eax, [ebp - 8]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
mov dword [esi + 4], eax
cmp dword [esi + 4], ebx
pop edi
jne 0x106428f
cmp dword [ebp - 4], 1
je 0x1064280
cmp dword [ebp - 4], 2
je 0x1064280
mov dword [esi + 4], 0x57
cmp dword [esi + 4], ebx
jne 0x106428f
cmp dword [ebp - 8], ebx
je 0x106428f
mov eax, dword [esi + 0xc]
jmp 0x1064292
lea eax, [esi + 0x18]
pop esi
pop ebx
leave
ret 4
Function at 0x106429d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp dword [esi + 8], ebx
mov dword [ebp - 8], 3
mov dword [ebp - 4], eax
je 0x106431c
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x10642e2
cmp dword [esi + 0xc], ebx
je 0x10642e9
cmp eax, 0xea
jne 0x1064309
push dword [ebp - 4]
mov ecx, esi
call fcn.01063fd1
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
mov dword [esi + 4], eax
cmp dword [esi + 4], ebx
pop edi
jne 0x1064332
cmp dword [ebp - 8], 3
je 0x106431c
mov dword [esi + 4], 0x57
cmp dword [esi + 4], ebx
jne 0x1064332
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1064332
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x1064339
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor eax, eax
pop esi
pop ebx
leave
ret 8

Function at 0x1064344
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp dword [esi + 8], ebx
mov dword [ebp - 8], 3
mov dword [ebp - 4], eax
je 0x10643c3
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x1064389
cmp dword [esi + 0xc], ebx
je 0x1064390
cmp eax, 0xea
jne 0x10643b0
push dword [ebp - 4]
mov ecx, esi
call fcn.01063fd1
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
mov dword [esi + 4], eax
cmp dword [esi + 4], ebx
pop edi
jne 0x10643d9
cmp dword [ebp - 8], 3
je 0x10643c3
mov dword [esi + 4], 0x57
cmp dword [esi + 4], ebx
jne 0x10643d9
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10643d9
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x10643e0
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor eax, eax
pop esi
pop ebx
leave
ret 8
Function at 0x106442a
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x110c71f
call fcn.01105c98
sub esp, 0x34
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
mov esi, ecx
jne 0x1064457
cmp dword [esi + 8], ebx
je 0x10644c1
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [esi + 4], eax
jmp 0x10644c1
push 0xf003f
push ebx
push dword [esi]
lea ecx, [ebp - 0x40]
push dword [ebp + 8]
call fcn.01064103
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.01064040
cmp dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 1
push ebx
jne 0x106449d
push dword [ebp + 8]
mov ecx, esi
call fcn.0106442a
jmp 0x10644a9
push 1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x40]
call fcn.0106442a
push ebx
lea ecx, [ebp - 0x24]
call fcn.01064406
test eax, eax
je 0x106448f
push dword [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.0105eff6
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x40]
call fcn.0106413d
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x10648cd
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
shl eax, 2
push 3
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 4], ebx
add eax, 5
cmp dword [ebp + 0x10], eax
jae 0x1064908
mov dword [ebp - 0xc], 0x80004005
jmp 0x10649d0
cmp ebx, esi
push edi
mov edi, dword [ebp + 0xc]
jbe 0x10649cb
lea eax, [ebx - 1]
push 3
xor edx, edx
pop ebx
div ebx
xor ecx, ecx
inc ecx
mov dword [ebp + 0xc], ecx
inc eax
mov dword [ebp - 8], eax
cmp ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dl, byte [eax + ecx - 1]
mov byte [ebp + 0x10], dl
jae 0x106493c
mov bl, byte [ecx + eax]
jmp 0x106493e
xor bl, bl
lea edx, [ecx + 1]
cmp edx, dword [ebp - 4]
jae 0x106494c
mov al, byte [ecx + eax + 1]
jmp 0x106494e
xor al, al
movzx ecx, byte [ebp + 0x10]
mov edx, ecx
shr edx, 2
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], dl
movzx edx, bl
shl ecx, 4
mov ebx, edx
shr ebx, 4
or ebx, ecx
and ebx, 0x3f
mov cl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
mov byte [esi + edi], cl
mov ecx, dword [ebp + 0xc]
inc esi
cmp ecx, dword [ebp - 4]
jae 0x106499c
movzx ebx, al
shl edx, 2
shr ebx, 6
or ebx, edx
and ebx, 0x3f
mov dl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], dl
jmp 0x10649a0
mov byte [esi + edi], 0x3d
lea edx, [ecx + 1]
inc esi
cmp edx, dword [ebp - 4]
jae 0x10649b7
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], al
jmp 0x10649bb
mov byte [esi + edi], 0x3d
add ecx, 3
inc esi
dec dword [ebp - 8]
mov dword [ebp + 0xc], ecx
jne 0x1064928
mov byte [esi + edi], 0
pop edi
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret 0xc
Function at 0x10649de
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, edi
shl eax, 2
push 3
xor edx, edx
pop esi
div esi
xor ecx, ecx
mov dword [ebp - 8], ecx
add eax, 5
cmp dword [ebp + 0x14], eax
jae 0x1064a0f
mov dword [ebp - 8], 0x80004005
jmp 0x1064ad9
cmp edi, ecx
mov esi, dword [ebp + 0xc]
jbe 0x1064ad5
push ebx
lea eax, [edi - 1]
push 3
xor edx, edx
pop edi
div edi
xor ebx, ebx
inc ebx
mov dword [ebp + 0xc], ebx
inc eax
mov dword [ebp - 4], eax
cmp ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dl, byte [edi + ebx - 1]
jae 0x1064a43
mov al, byte [ebx + edi]
mov byte [ebp + 0x15], al
jmp 0x1064a47
mov byte [ebp + 0x15], 0
lea eax, [ebx + 1]
cmp eax, dword [ebp + 0x10]
jae 0x1064a55
mov al, byte [ebx + edi + 1]
jmp 0x1064a57
xor al, al
movzx edx, dl
mov edi, edx
shr edi, 2
mov bl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx edi, byte [ebp + 0x15]
mov byte [ecx + esi], bl
shl edx, 4
mov ebx, edi
shr ebx, 4
or ebx, edx
and ebx, 0x3f
mov dl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebx, dword [ebp + 0xc]
inc ecx
mov byte [ecx + esi], dl
inc ecx
cmp ebx, dword [ebp + 0x10]
jae 0x1064aa5
movzx edx, al
shr edx, 6
shl edi, 2
or edx, edi
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
jmp 0x1064aa9
mov byte [ecx + esi], 0x3d
lea edx, [ebx + 1]
inc ecx
cmp edx, dword [ebp + 0x10]
jae 0x1064ac0
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
jmp 0x1064ac4
mov byte [ecx + esi], 0x3d
add ebx, 3
inc ecx
dec dword [ebp - 4]
mov dword [ebp + 0xc], ebx
jne 0x1064a2f
pop ebx
mov byte [ecx + esi], 0
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 0x10
Function at 0x10660f5
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
cmp dword [ebp + 8], eax
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
je 0x10661f0
mov edi, dword [ebp + 0xc]
cmp edi, eax
je 0x10661f0
mov esi, dword [ebp + 0x10]
cmp esi, eax
je 0x10661f0
mov dword [edi], eax
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x106616d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1066158
call esi
mov esi, eax
jmp 0x1066204
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1066204
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x1066184
mov esi, 0x8007000e
jmp 0x10661f5
push eax
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x10661b9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10661a7
call esi
mov esi, eax
jmp 0x10661f5
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10661f5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1002e78
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10661e9
cmp dword [ebp - 0xc], 0
jbe 0x10661e9
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
xor esi, esi
jmp 0x10661f5
mov esi, 0x80004005
jmp 0x10661f5
mov esi, 0x80070057
cmp dword [ebp - 4], 0
je 0x1066204
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10662fd
Capabilities:
Check os version

Disassembly:
mov eax, 0x110c75b
call fcn.01105c98
sub esp, 0x134
mov eax, dword [0x111121c]
mov dword [ebp - 0x10], eax
push edi
lea eax, [ebp - 0x124]
push eax
xor edi, edi
mov dword [ebp - 0x124], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10663c6
cmp dword [ebp - 0x114], 2
jne 0x10663c6
cmp dword [ebp - 0x120], 5
jbe 0x1066352
xor edi, edi
inc edi
jmp 0x10663c6
jne 0x10663c6
cmp dword [ebp - 0x11c], 1
ja 0x106634d
jne 0x10663c6
mov eax, 0xa28
cmp dword [ebp - 0x118], eax
ja 0x106634d
jne 0x10663c6
push 0x20019
push edi
push 0x80000002
push 0x100add8
lea ecx, [ebp - 0x140]
call fcn.01064103
cmp dword [ebp - 0x13c], edi
mov dword [ebp - 4], edi
jne 0x10663b7
push edi
push 0x100ae2c
lea ecx, [ebp - 0x140]
call fcn.01063f5e
cmp dword [ebp - 0x13c], edi
jne 0x10663b7
cmp eax, 0x100
jb 0x10663b7
xor edi, edi
inc edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call fcn.0106413d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, edi
pop edi
call fcn.0105eca9
leave
ret
Function at 0x1066519
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x111121c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor ebx, ebx
cmp eax, ebx
push edi
mov esi, ecx
jne 0x106655c
lea eax, [ebp - 0x208]
push eax
mov edi, 0x100
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
je 0x1066591
cmp eax, edi
jbe 0x1066576
mov eax, 0x80020013
jmp 0x10665d4
push 0x100
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
mov word [ebp - 8], bx
lea edi, [esi + 4]
push edi
push ebx
push 0x100ae98
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x1066598
call fcn.01066451
jmp 0x10665d4
mov eax, dword [ebp + 0xc]
push ebx
lea ecx, [ebp - 0x214]
push ecx
push 0x2100
push 2
push ebx
push eax
push edi
mov ecx, esi
mov dword [ebp - 0x214], 0xc
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], 1
mov dword [esi + 0x208], eax
call fcn.010664a6
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0105eca9
leave
ret 8

Function at 0x10665e8
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.0106648a
cmp dword [ebp + 8], 0
jne 0x106660c
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
pop esi
pop ebp
ret 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x106662c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x106662c
push eax
call fcn.0106646b
jmp 0x1066607
push dword [ebp + 8]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1066605
call fcn.01066451
jmp 0x1066607

Function at 0x1066757
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x110c789
call fcn.01105c98
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10667ee
push 0x5c
mov ecx, esi
call fcn.010510eb
cmp eax, 0xffffffff
je 0x10667b7
push eax
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.0106670f
and dword [ebp - 4], edi
lea eax, [ebp + 8]
push eax
call fcn.01066757
mov ecx, dword [ebp + 8]
mov edi, eax
add ecx, 0xfffffff0
test edi, edi
jge 0x10667ae
call fcn.0104a07f
jmp 0x10667f7
or dword [ebp - 4], 0xffffffff
call fcn.0104a07f
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10667ca
xor edi, edi
jmp 0x10667f7
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10667dc
call esi
mov edi, eax
jmp 0x10667f7
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x10667f7
test al, 0x10
jne 0x10667f7
mov edi, 0x800700b7
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x106777a
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
jne 0x106779d
mov esi, 0x80004003
jmp 0x1067833
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, esi
jne 0x10677d4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10677c2
call esi
mov esi, eax
jmp 0x1067832
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1067832
push ebx
push edi
call dword [sym.imp.msvcrt.dll_malloc]
mov ebx, eax
test ebx, ebx
pop ecx
jne 0x10677ea
mov esi, 0x8007000e
jmp 0x1067825
push ebx
push edi
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x1067802
mov esi, 0x80004005
jmp 0x1067825
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x100ae60
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10677fb
mov eax, dword [ebp - 8]
mov ax, word [eax]
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
test ebx, ebx
je 0x1067831
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x1067b2d
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0105f070
mov dword [ebp - 4], esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1067baf
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, eax
and esi, 0x8000
neg esi
sbb esi, esi
lea edi, [ebx - 1]
not edi
and edi, dword [ebp - 4]
and esi, 0xfffffefd
add esi, 0x104
sub edi, ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0x8000
neg eax
sbb eax, eax
and eax, 0xf
inc eax
inc eax
imul eax, ebx
add eax, dword [ebp - 8]
cmp edi, eax
jae 0x1067bb3
xor eax, eax
jmp 0x1067bc0
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10686b0
Capabilities:
Capture screenshot

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
je 0x1068771
push edi
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0xc], edi
je 0x1068765
push esi
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push edi
call esi
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1068764
push edi
call esi
mov edi, eax
cmp edi, ebx
mov ebx, dword [sym.imp.GDI32.dll_DeleteDC]
je 0x106875f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [ebp - 8], eax
je 0x106875f
push dword [ebp + 8]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 4]
call esi
push dword [ebp - 8]
mov dword [ebp - 0x10], eax
push edi
call esi
mov ecx, dword [ebp + 0xc]
imul ecx, dword [ebp + 0x10]
push 0xcc0020
mov dword [ebp + 8], eax
xor eax, eax
push eax
push ecx
push dword [ebp - 4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp + 8]
push edi
call esi
push edi
call ebx
push dword [ebp - 0x10]
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call ebx
pop esi
push dword [ebp - 0xc]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
mov eax, dword [ebp - 8]
pop ebx
leave
ret 0x10