joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62ca60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00408f58
mov eax, dword [ebp - 8]
call fcn.00408f58
xor eax, eax
push ebp
push 0x62cb37
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x62cab3
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x62cab3
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040a100
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00409cdc
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x62cb1c
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00409cdc
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x62cb13
cmp dword [ebp - 0x14], 4
jne 0x62cb13
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62cb3e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ed4
ret

Function at 0x62cb48
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00408f58
xor eax, eax
push ebp
push 0x62cc2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00408e74
cmp dword [ebp - 4], 0
je 0x62cb99
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x62cb99
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040a100
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00409cdc
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x62cc18
mov eax, ebx
mov edx, 0x400
call fcn.00409e70
mov eax, dword [ebx]
test eax, eax
je 0x62cbce
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.00409cdc
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x62cc08
mov eax, dword [ebx]
call fcn.00409cdc
mov edx, eax
mov eax, ebx
call fcn.00409d44
jmp 0x62cc0f
mov eax, ebx
call fcn.00408e74
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62cc35
lea eax, [ebp - 4]
call fcn.00408e74
ret

Function at 0x62fd60
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
mov esi, edx
imul ebx, dword [eax], 0x8088405
inc ebx
mov dword [eax], ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, esi
xor edx, edx
call fcn.0040ad28
mov eax, edx
xor edx, edx
pop esi
pop ebx
ret
Function at 0x6303bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x63043d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00409e70
mov eax, dword [ebx]
mov esi, eax
test esi, esi
je 0x6303ee
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebx]
call fcn.00409cdc
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, dword [ebx]
call fcn.00409cdc
mov edx, eax
lea eax, [ebp - 8]
call fcn.00409d44
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00427dfc
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00409254
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x630444
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ed4
ret

Function at 0x63044c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x6304cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00409e70
mov eax, dword [ebx]
mov esi, eax
test esi, esi
je 0x63047e
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebx]
call fcn.00409cdc
push eax
push esi
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebx]
call fcn.00409cdc
mov edx, eax
lea eax, [ebp - 8]
call fcn.00409d44
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00427dfc
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00409254
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6304d4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ed4
ret

Function at 0x6304dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00408f58
mov eax, dword [ebp - 8]
call fcn.00408f58
xor eax, eax
push ebp
push 0x630561
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00409e70
mov eax, dword [ebx]
call fcn.00409cdc
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00409cdc
push eax
mov eax, dword [ebp - 4]
call fcn.00409cdc
push eax
call sub.kernel32.dll_GetTempFileNameW
mov eax, dword [ebx]
call fcn.00409cdc
mov edx, eax
mov eax, ebx
call fcn.00409d44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x630568
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ed4
ret
Function at 0x6315dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00408f68
xor eax, eax
push ebp
push 0x631666
push dword fs:[eax]
mov dword fs:[eax], esp
cmp esi, 1
jl 0x631650
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00631500
mov ebx, esi
dec ebx
test ebx, ebx
jl 0x631626
inc ebx
lea eax, [ebp - 0x18]
call fcn.0062c948
dec ebx
jne 0x63161b
mov ebx, esi
dec ebx
test ebx, ebx
jl 0x631650
inc ebx
xor esi, esi
mov eax, dword [ebp - 8]
movzx edi, byte [eax + esi]
lea eax, [ebp - 0x18]
call fcn.0062c948
movzx eax, al
xor edi, eax
mov eax, edi
mov edx, dword [ebp - 8]
mov byte [edx + esi], al
inc esi
dec ebx
jne 0x631630
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63166d
lea eax, [ebp - 4]
call fcn.00408e98
ret

Function at 0x631b54
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00408f58
xor eax, eax
push ebp
push 0x631c95
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x631cb0
call fcn.00409f48
mov eax, dword [ebp - 8]
call fcn.0063017c
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x631cc8
call fcn.0040a2c8
dec eax
jne 0x631bf9
movzx eax, byte [0x631cd8]
push eax
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x631ce8
mov edx, 0x631cfc
mov eax, dword [ebp - 4]
call fcn.00428084
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0040929c
movzx eax, byte [0x631d00]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x631d10
mov edx, 0x631d30
mov eax, dword [ebp - 4]
call fcn.00428084
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.0040929c
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00409cdc
mov ebx, eax
push ebx
push 0x631d44
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x1f
ja 0x631c7a
push 5
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x631d5c
call fcn.004212f0
mov eax, dword [ebp - 0x14]
call fcn.00409cdc
push eax
push 0x631d9c
push 0x631d44
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x1f
ja 0x631c7a
call fcn.00634724
test al, al
je 0x631c7a
push 5
push 0
push ebx
push 0x631db8
push 0x631d44
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x631c9c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00408ed4
ret
Function at 0x6322d4
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
xor esi, esi
cmp ebx, 0xffffffff
je 0x63236a
mov eax, esp
mov ecx, 3
xor edx, edx
call fcn.00406d90
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [esp + 8]
push eax
push 3
lea eax, [esp + 0xc]
push eax
push ebx
call sub.kernel32.dll_ReadFile
cmp byte [esp], 0xff
jne 0x632328
cmp byte [esp + 1], 0xfe
jne 0x632328
mov esi, 1
jmp 0x632355
cmp byte [esp], 0xfe
jne 0x63233c
cmp byte [esp + 1], 0xff
jne 0x63233c
mov esi, 2
jmp 0x632355
cmp byte [esp], 0xef
jne 0x632355
cmp byte [esp + 1], 0xbb
jne 0x632355
cmp byte [esp + 2], 0xbf
jne 0x632355
mov esi, 3
mov edx, esi
mov eax, ebx
call fcn.00632374
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov eax, esi
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x632610
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
push 0
push 0x8000080
push 2
push 0
push 0
push 0x40000000
mov eax, ebx
call fcn.00409cdc
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x63266e
mov esi, edi
test esi, esi
je 0x63264a
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [esp + 4]
push eax
push esi
mov eax, edi
call fcn.004098bc
push eax
push ebp
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
push ebp
call sub.kernel32.dll_CloseHandle_1
jmp 0x632670
xor ebx, ebx
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x632678
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov esi, eax
mov ebx, edi
mov eax, ebx
test eax, eax
je 0x63268e
sub eax, 4
mov eax, dword [eax]
dec eax
jge 0x632695
mov bl, 1
jmp 0x6326f8
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
mov eax, esi
call fcn.00409cdc
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x6326f6
push 2
push 0
push 0
push ebp
call sub.kernel32.dll_SetFilePointer
mov esi, ebx
test esi, esi
je 0x6326d2
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [esp + 4]
push eax
push esi
mov eax, edi
call fcn.004098bc
push eax
push ebp
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
push ebp
call sub.kernel32.dll_CloseHandle_1
jmp 0x6326f8
xor ebx, ebx
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x632700
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 9], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x63289e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
test eax, eax
je 0x632731
sub eax, 4
mov eax, dword [eax]
dec eax
jge 0x63273d
mov byte [ebp - 0xa], 1
jmp 0x632880
mov byte [ebp - 0xa], 0
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
mov eax, ebx
call fcn.00409cdc
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x632880
mov eax, ebx
call fcn.006322d4
mov esi, eax
push 2
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
push ebx
call sub.kernel32.dll_GetFileSize
test eax, eax
jne 0x632800
cmp byte [ebp - 9], 0
je 0x6327c8
lea eax, [ebp - 8]
mov edx, 0x6328bc
call fcn.00409338
mov esi, dword [ebp - 8]
test esi, esi
je 0x6327ab
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x10]
push eax
push esi
mov eax, dword [ebp - 8]
call fcn.004098bc
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
mov esi, 3
jmp 0x632800
lea eax, [ebp - 4]
mov edx, 0x6328cc
call fcn.0040929c
mov esi, dword [ebp - 4]
test esi, esi
je 0x6327e1
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 4]
call fcn.00409cdc
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
mov esi, 1
cmp esi, 1
je 0x63280a
cmp esi, 2
jne 0x63284e
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040929c
cmp esi, 2
jne 0x632826
mov eax, dword [ebp - 4]
call fcn.00409cdc
call fcn.0062fd3c
mov esi, dword [ebp - 4]
test esi, esi
je 0x632832
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 4]
call fcn.00409cdc
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
jmp 0x63287a
lea edx, [ebp - 8]
mov eax, edi
call fcn.0040cd68
mov esi, dword [ebp - 8]
test esi, esi
je 0x632864
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x10]
push eax
push esi
mov eax, dword [ebp - 8]
call fcn.004098bc
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6328a5
lea eax, [ebp - 8]
call fcn.00408e98
lea eax, [ebp - 4]
call fcn.00408e74
ret
Function at 0x6329e8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00408f58
mov eax, dword [ebp - 8]
call fcn.00408f58
xor eax, eax
push ebp
push 0x632b5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.00408e74
mov eax, dword [ebp - 8]
test eax, eax
je 0x632a3a
sub eax, 4
mov eax, dword [eax]
dec eax
jge 0x632a4a
lea eax, [ebp - 8]
mov edx, 0x632b78
call fcn.0040929c
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00409cdc
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jbe 0x632b35
mov eax, ebx
call fcn.00406738
mov esi, eax
mov eax, esi
xor ecx, ecx
mov edx, ebx
call fcn.00406d90
push esi
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x632b2c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x632b90
push esi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x632b2c
push 0x632bd0
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov edx, 4
call fcn.00420060
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.00420060
push dword [ebp - 0x24]
push 0x632c00
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.0041f5ac
push dword [ebp - 0x28]
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00409fd0
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00409cdc
push eax
push esi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x632b2c
cmp dword [ebp - 0x18], 1
jbe 0x632b2c
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00409d44
mov edx, ebx
mov eax, esi
call fcn.00406754
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x632b64
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00408ed4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00408ed4
ret
Function at 0x632c04
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x632c0d
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x632df8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00408e74
mov eax, edi
call fcn.00408e74
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
mov eax, ebx
call fcn.00409cdc
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x632dd0
mov eax, dword [ebp - 0xc]
call fcn.00406738
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00406d90
xor eax, eax
push ebp
push 0x632dc9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, ebx
call fcn.00409cdc
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x632db0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x632e08
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x632db0
push 0x632e48
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov edx, 4
call fcn.00420060
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.00420060
push dword [ebp - 0x24]
push 0x632e78
lea eax, [ebp - 4]
mov edx, 4
call fcn.00409fd0
push 0x632e48
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov edx, 4
call fcn.00420060
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.00420060
push dword [ebp - 0x2c]
push 0x632ea8
lea eax, [ebp - 8]
mov edx, 4
call fcn.00409fd0
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.00409cdc
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x632d7d
cmp dword [ebp - 0x14], 1
jbe 0x632d7d
mov eax, esi
mov edx, dword [ebp - 0x1c]
call fcn.00409d44
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
call fcn.00409cdc
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x632db0
cmp dword [ebp - 0x14], 1
jbe 0x632db0
mov eax, edi
mov edx, dword [ebp - 0x1c]
call fcn.00409d44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x632dd0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.00406754
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x632dff
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00408ed4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ed4
ret
Function at 0x632ec4
Capabilities:
Get memory capacity

Disassembly:
push ebx
push esi
add esp, 0xffffffc0
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x40
call fcn.00406d90
mov dword [esp], 0x40
push esp
call sub.kernel32.dll_GlobalMemoryStatusEx
mov eax, dword [esp + 8]
mov dword [ebx], eax
mov eax, dword [esp + 0xc]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
add esp, 0x40
pop esi
pop ebx
ret

Function at 0x633460
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x63348d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x633499
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6335e8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov byte [ebp - 9], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x63374e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4cb054]
call fcn.0049cdac
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x633704
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00427e44
lea eax, [ebp - 0x18]
mov ecx, 0x633768
mov edx, dword [ebp - 4]
call fcn.00409f48
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov edx, 0x1ff
call fcn.006334a4
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x6336e9
inc ebx
mov dword [ebp - 0x14], 0
push dword [ebp - 4]
push 0x633780
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00409fd0
mov eax, dword [ebp - 8]
call fcn.00409cdc
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x6336b6
test al, 0x10
je 0x6336b6
movzx edx, byte [ebp - 9]
mov eax, dword [ebp - 8]
call fcn.006335e8
jmp 0x6336e3
cmp byte [ebp - 9], 0
je 0x6336c8
mov eax, dword [ebp - 8]
call fcn.00633358
test al, al
je 0x6336e3
push 0x80
mov eax, dword [ebp - 8]
call fcn.00409cdc
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 8]
call fcn.00420980
inc dword [ebp - 0x14]
dec ebx
jne 0x63366b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63370b
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x10], edx
call fcn.00407288
ret
Function at 0x63378c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x633845
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00408e74
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
xor ebx, ebx
mov ecx, ebx
mov eax, esi
shr eax, cl
test eax, esi
jbe 0x63381b
lea edi, [ebx + 0x41]
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00409d04
lea eax, [ebp - 0x10]
mov edx, 0x633860
call fcn.00409ef0
mov eax, dword [ebp - 0x10]
call fcn.00409cdc
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, dword [ebp - 4]
jne 0x63381b
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00409d04
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00409ef0
mov eax, dword [ebp - 8]
inc ebx
cmp ebx, 0x1a
jne 0x6337cc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63384c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00408ed4
ret