joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100064e8
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
cmp eax, 1
jne 0x100065e9
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1000652d
xor eax, eax
jmp 0x10006684
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x88]
and eax, 0x7fff
cmp ecx, 2
je 0x10006548
or eax, 0x8000
mov edx, dword [ebp - 0x90]
mov dword [0x10018360], ecx
mov ecx, dword [ebp - 0x94]
mov esi, ecx
shl esi, 8
add esi, edx
push 1
mov dword [0x10018368], esi
mov dword [0x1001836c], ecx
mov dword [0x10018370], edx
mov dword [0x10018364], eax
call fcn.1000884c
pop ecx
test eax, eax
je 0x10006526
call fcn.10007e5b
test eax, eax
jne 0x10006594
call fcn.100088b1
jmp 0x10006526
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10019fd8], eax
call fcn.100086ae
mov dword [0x1001834c], eax
call fcn.10007fda
test eax, eax
jge 0x100065b9
call fcn.10007ae9
jmp 0x1000658d
call fcn.100085ba
test eax, eax
jl 0x100065e2
call fcn.1000826c
test eax, eax
jl 0x100065e2
push 0
call fcn.100077d8
pop ecx
test eax, eax
jne 0x100065e2
inc dword [0x10018344]
jmp 0x10006681
call fcn.10008219
jmp 0x100065b2
xor edi, edi
cmp eax, edi
jne 0x10006624
cmp dword [0x10018344], edi
jle 0x10006526
dec dword [0x10018344]
cmp dword [0x1001839c], edi
jne 0x1000660e
call fcn.10007953
cmp dword [ebp + 0x10], edi
jne 0x10006681
call fcn.10008219
call fcn.10007ae9
call fcn.100088b1
jmp 0x10006681
cmp eax, 2
jne 0x10006675
call fcn.10007aba
push 0x214
push 1
call fcn.10006cb1
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
je 0x10006526
push esi
push dword [0x100170a0]
push dword [0x100183ac]
call fcn.10007a34
pop ecx
call eax
test eax, eax
je 0x10006669
push edi
push esi
call fcn.10007b2b
pop ecx
jmp 0x10006680
push esi
call fcn.10006afb
pop ecx
jmp 0x10006526
cmp eax, 3
jne 0x10006681
push edi
call fcn.10007de8
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10006eb4
leave
ret 0xc
Function at 0x10007e5b
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x100018fc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x10007ead
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10001968
push edi
call esi
push 0x1000195c
push edi
mov dword [0x100183a4], eax
call esi
push 0x10001950
push edi
mov dword [0x100183a8], eax
call esi
push 0x10001948
push edi
mov dword [0x100183ac], eax
call esi
mov dword [0x100183b0], eax
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [0x100183a4], ebx
je 0x10007ed3
cmp dword [0x100183a8], ebx
je 0x10007ed3
cmp dword [0x100183ac], ebx
je 0x10007ed3
cmp dword [0x100183b0], ebx
jne 0x10007ef7
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x100183a8], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x100183a4], 0x10007aac
mov dword [0x100183ac], esi
mov dword [0x100183b0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1001709c], eax
cmp eax, 0xffffffff
je 0x10007f6a
push dword [0x100183a8]
push eax
call esi
test eax, eax
je 0x10007f6a
call fcn.10007967
push dword [0x100183a4]
call fcn.100079ae
push dword [0x100183a8]
mov dword [0x100183a4], eax
call fcn.100079ae
push dword [0x100183ac]
mov dword [0x100183a8], eax
call fcn.100079ae
push dword [0x100183b0]
mov dword [0x100183ac], eax
call fcn.100079ae
add esp, 0x10
mov dword [0x100183b0], eax
call fcn.1000abe8
test eax, eax
jne 0x10007f70
call fcn.10007ae9
xor eax, eax
pop edi
pop esi
pop ebx
ret
push fcn.10007c98
push dword [0x100183a4]
call fcn.10007a34
pop ecx
call eax
mov dword [0x100170a0], eax
cmp eax, 0xffffffff
je 0x10007f65
push 0x214
push 1
call fcn.1000d19f
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x10007f65
push esi
push dword [0x100170a0]
push dword [0x100183ac]
call fcn.10007a34
pop ecx
call eax
test eax, eax
jne 0x10007fc3
push esi
call fcn.10006afb
pop ecx
jmp 0x10007f65
push ebx
push esi
call fcn.10007b2b
or dword [esi + 4], 0xffffffff
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x10007f6c
Function at 0x1000c0d7
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp edi, dword [esi*8 + 0x10017370]
je 0x1000c0fd
inc esi
mov dword [ebp - 4], esi
cmp esi, 0x17
jb 0x1000c0eb
cmp esi, 0x17
jae 0x1000c257
push 3
call fcn.1000f889
pop ecx
cmp eax, 1
je 0x1000c221
push 3
call fcn.1000f889
pop ecx
test eax, eax
jne 0x1000c130
cmp dword [0x10018358], 1
je 0x1000c221
cmp edi, 0xfc
je 0x1000c257
push 0x10001f6c
mov edi, 0x314
push edi
mov esi, 0x10018948
push esi
call fcn.1000d1f0
add esp, 0xc
test eax, eax
je 0x1000c166
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10008bc1
add esp, 0x14
mov byte [0x10018a65], bl
push 0x104
mov ebx, 0x10018961
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1000c1a9
push 0x10001f54
push 0x2fb
push ebx
call fcn.1000d1f0
add esp, 0xc
test eax, eax
je 0x1000c1a9
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10008bc1
add esp, 0x14
push ebx
push edi
push esi
call fcn.1000f810
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x1000c1c7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10008bc1
add esp, 0x14
push 0x10001f50
push edi
push esi
call fcn.1000f810
add esp, 0xc
test eax, eax
je 0x1000c1e7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10008bc1
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x10017374]
push edi
push esi
call fcn.1000f810
add esp, 0xc
test eax, eax
je 0x1000c20c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10008bc1
add esp, 0x14
push 0x12010
push 0x10001f28
push esi
call fcn.1000f669
add esp, 0xc
jmp 0x1000c257
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, ebx
je 0x1000c257
cmp edi, 0xffffffff
je 0x1000c257
mov edx, dword [esi*8 + 0x10017374]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000c240
push ebx
lea eax, [ebp - 8]
push eax
sub ecx, esi
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000f669
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10007a26
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
cmp dword [0x10018cc8], ebx
jne 0x1000f742
push ebx
push ebx
push 0x100021d0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
jne 0x1000f6ad
xor eax, eax
jmp 0x1000f806
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100021c4
push edi
call esi
cmp eax, ebx
je 0x1000f6a6
push eax
call fcn.100079ae
mov dword [esp], 0x100021b4
push edi
mov dword [0x10018cc8], eax
call esi
push eax
call fcn.100079ae
mov dword [esp], 0x100021a0
push edi
mov dword [0x10018ccc], eax
call esi
push eax
call fcn.100079ae
mov dword [0x10018cd0], eax
lea eax, [ebp - 8]
push eax
call fcn.10007751
pop ecx
pop ecx
test eax, eax
je 0x1000f710
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10008bc1
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x1000f742
push 0x10002184
push edi
call esi
push eax
call fcn.100079ae
pop ecx
mov dword [0x10018cd8], eax
cmp eax, ebx
je 0x1000f742
push 0x1000216c
push edi
call esi
push eax
call fcn.100079ae
pop ecx
mov dword [0x10018cd4], eax
mov eax, dword [0x10018cd4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1000f7bb
cmp dword [0x10018cd8], esi
je 0x1000f7bb
push eax
call fcn.10007a34
pop ecx
call eax
cmp eax, ebx
je 0x1000f788
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x10018cd8]
call fcn.10007a34
pop ecx
call eax
test eax, eax
je 0x1000f788
test byte [ebp - 0x18], 1
jne 0x1000f7bb
lea eax, [ebp - 0xc]
push eax
call fcn.10007792
pop ecx
test eax, eax
je 0x1000f7a3
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10008bc1
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x1000f7b2
or dword [ebp + 0x10], 0x200000
jmp 0x1000f7ec
or dword [ebp + 0x10], 0x40000
jmp 0x1000f7ec
mov eax, dword [0x10018ccc]
cmp eax, esi
je 0x1000f7ec
push eax
call fcn.10007a34
pop ecx
call eax
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1000f7ec
mov eax, dword [0x10018cd0]
cmp eax, esi
je 0x1000f7ec
push dword [ebp - 4]
push eax
call fcn.10007a34
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x10018cc8]
call fcn.10007a34
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10015806
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.10015747
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.10006f00
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x10015879
cmp dword [ebp - 0x94], 5
jb 0x1001589a
jmp 0x10015896
cmp dword [ebp - 0x88], 1
jne 0x1001589a
cmp dword [ebp - 0x94], 4
ja 0x10015896
jne 0x1001589a
cmp dword [ebp - 0x90], 0
jbe 0x1001589a
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10002de0
call fcn.100155ba
test eax, eax
jge 0x100158bb
mov byte [0x10018340], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10006eb4
leave
ret
Function at 0x407be9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x1c]
mov esi, ecx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
test eax, eax
mov dword [esi], eax
setne cl
mov al, cl
pop esi
pop ebp
ret 0x18

Function at 0x40c37a
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 8], 0
mov eax, dword [ecx]
mov edx, dword [esp + 4]
jbe 0x40c3a9
push esi
push edi
movzx esi, byte [edx]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x452228]
dec dword [esp + 0x10]
inc edx
cmp dword [esp + 0x10], 0
ja 0x40c389
pop edi
pop esi
mov dword [ecx], eax
ret 8

Function at 0x40e87e
Capabilities:
Set file attributes

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x40e95a
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x40e96e
xor al, al
jmp 0x40e97e
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
ret 4

Function at 0x40ed5e
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, 0x105
push eax
push eax
mov ecx, esi
call fcn.0040ca41
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [esi]
push edi
mov ebx, eax
call fcn.0040c7a6
mov byte [edi + eax], 0
mov dword [esi + 4], eax
dec ebx
mov eax, 0x103
cmp eax, ebx
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
ret 4

Function at 0x40ef1c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x45265c], 0
je 0x40ef3f
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
neg eax
sbb eax, eax
neg eax
jmp 0x40ef65
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040ed13
push dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call fcn.0040e87e
push dword [ebp - 0xc]
mov bl, al
call fcn.0040c525
pop ecx
mov al, bl
pop ebx
leave
ret 8

Function at 0x40ef69
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x45265c], 0
je 0x40ef89
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
jmp 0x40efab
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040ed13
push dword [eax]
call fcn.0040e8ac
push dword [ebp - 0xc]
mov bl, al
call fcn.0040c525
pop ecx
mov al, bl
pop ebx
leave
ret 4

Function at 0x40f01c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x45265c], 0
je 0x40f03e
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
neg eax
sbb eax, eax
neg eax
jmp 0x40f060
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040ed13
push dword [eax]
call fcn.0040e91e
push dword [ebp - 0xc]
mov bl, al
call fcn.0040c525
pop ecx
mov al, bl
pop ebx
leave
ret 4
Function at 0x40f064
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp byte [0x45265c], bl
je 0x40f098
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp eax, ebx
je 0x40f094
cmp eax, 0x50
je 0x40f094
cmp eax, 0xb7
je 0x40f094
xor al, al
jmp 0x40f0b8
mov al, 1
jmp 0x40f0b8
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040ed13
push dword [eax]
call fcn.0040e933
push dword [ebp - 0xc]
mov bl, al
call fcn.0040c525
pop ecx
mov al, bl
pop ebx
leave
ret 4

Function at 0x40f0db
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x45265c], 0
je 0x40f109
push 0
push dword [ebp + 8]
call fcn.0040ef1c
test al, al
je 0x40f12b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
jmp 0x40f12b
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040ed13
push dword [eax]
call fcn.0040e95a
push dword [ebp - 0xc]
mov bl, al
call fcn.0040c525
pop ecx
mov al, bl
pop ebx
leave
ret 4

Function at 0x40f3ab
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, 0x105
push edi
mov ecx, esi
call fcn.0040ca41
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, dword [esi]
push edi
mov ebx, eax
call fcn.0040c7a6
mov byte [edi + eax], 0
mov dword [esi + 4], eax
dec ebx
mov eax, 0x103
cmp eax, ebx
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
ret 4

Function at 0x40f52b
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, 0x105
push edi
mov ecx, esi
call fcn.0040ca41
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, dword [esi]
push edi
mov ebx, eax
call fcn.0040c7a6
mov byte [edi + eax], 0
mov dword [esi + 4], eax
dec ebx
mov eax, 0x103
cmp eax, ebx
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
ret 4

Function at 0x40f826
Capabilities:
Delete file

Disassembly:
push 0x10
mov eax, 0x4412bf
call fcn.0041efd5
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov byte [ebp - 0x1c], bl
call fcn.0040c9f9
mov esi, dword [ebp + 0xc]
jmp 0x40f893
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40f8c1
push dword [esi]
call fcn.00410f86
test al, al
jne 0x40f873
push dword [esi]
call fcn.0040e91e
test al, al
jne 0x40f8d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40f8c1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040ea1b
push dword [ebp - 0x18]
call fcn.0040c525
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 0x1c], bl
call fcn.0040c9f9
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.0040f78b
test al, al
jne 0x40f844
lea ecx, [ebp - 0x1c]
call fcn.0040ea1b
push dword [ebp - 0x18]
call fcn.0040c525
pop ecx
xor al, al
call fcn.0041f0ad
ret 8
lea ecx, [ebp - 0x1c]
call fcn.0040ea1b
push dword [ebp - 0x18]
call fcn.0040c525
pop ecx
mov al, bl
jmp 0x40f8b9
mov bl, 1
jmp 0x40f8c1
Function at 0x40ff1c
Capabilities:
Delete directory
Set file attributes

Disassembly:
push 0x6c
mov eax, 0x44140b
call fcn.0041efd5
lea ecx, [ebp - 0x48]
call fcn.0040c9f9
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
push 0x5c
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.0040fadc
push 0x2a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 1
call fcn.0040fadc
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.0040ecb7
push dword [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.0040c525
pop ecx
jmp 0x40ff90
lea eax, [ebp - 0x78]
push eax
sub esp, 0xc
lea eax, [ebp - 0x18]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.0040ca11
call fcn.0040feb1
test al, al
je 0x40ffed
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x38]
call fcn.00410c38
test al, al
jne 0x40ff72
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0040c525
pop ecx
lea ecx, [ebp - 0x38]
call fcn.0041062e
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x410002
push dword [esi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.0040c525
push dword [ebp - 0x48]
call fcn.0040c525
test esi, esi
setne al
pop ecx
pop ecx
call fcn.0041f0ad
ret 4
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0040c525
pop ecx
lea ecx, [ebp - 0x38]
call fcn.0041062e
push dword [ebp - 0x18]
call fcn.0040c525
push dword [ebp - 0x48]
call fcn.0040c525
xor al, al
jmp 0x40ffe3

Function at 0x411052
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x411079
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x411079
xor al, al
jmp 0x411099
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.004229f0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x415157
Capabilities:
Check os version
Identify system language via api
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x114
mov eax, dword [0x45116c]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
mov esi, 0x9c
push esi
xor ebx, ebx
lea eax, [ebp - 0x8c]
push ebx
push eax
call fcn.00422070
add esp, 0xc
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x4151be
lea eax, [ebp - 0x8c]
push eax
mov dword [ebp - 0x8c], 0x94
call esi
test eax, eax
jne 0x4151be
xor ax, ax
jmp 0x4152fb
mov eax, dword [ebp - 0x7c]
push edi
xor edi, edi
dec eax
je 0x415243
dec eax
jne 0x4152f1
cmp dword [ebp - 0x88], 5
jb 0x4151e5
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
jmp 0x4152e7
xor eax, eax
mov word [ebp - 0x9c], bx
lea edi, [ebp - 0x98]
push str.ntdll.dll
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x4152f1
lea ecx, [ebp - 0x9c]
push ecx
push 0x415142
push 1
push 0x10
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
test eax, eax
je 0x4152f1
mov eax, dword [ebp - 0x98]
dec eax
cmp eax, 1
ja 0x4152f1
movzx edi, word [ebp - 0x9c]
jmp 0x4152e7
lea eax, [ebp - 0x90]
push eax
push 1
push ebx
push str.DefaultControl_PanelDesktopResourceLocale
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4152f1
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push ebx
lea eax, [ebp - 0x94]
push eax
push ebx
push ebx
push dword [ebp - 0x90]
mov dword [ebp - 0x94], ebx
call esi
test eax, eax
jne 0x4152db
cmp dword [ebp - 0x94], 1
jne 0x4152db
push 0x62
lea eax, [ebp + 0x12]
push ebx
push eax
mov dword [ebp - 0x98], 0x64
mov word [ebp + 0x10], bx
call fcn.00422070
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x94]
push eax
push ebx
push ebx
push dword [ebp - 0x90]
call esi
test eax, eax
jne 0x4152db
lea eax, [ebp + 0x10]
push eax
call fcn.00422dbb
pop ecx
movzx edi, ax
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp di, bx
je 0x4152f1
movzx eax, di
jmp 0x4152fa
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
pop edi
mov ecx, dword [ebp + 0x74]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041eb21
add ebp, 0x78
leave
ret

Function at 0x417a81
Capabilities:
Hide graphical window

Disassembly:
push 0xc
mov eax, 0x442220
call fcn.0041efd5
mov esi, ecx
push 0
push dword [ebp + 8]
lea ecx, [esi + 0x68]
call fcn.00417a38
push 0x285f
lea eax, [ebp - 0x18]
push eax
call fcn.00411c73
push dword [eax]
and dword [ebp - 4], 0
push dword [esi + 0x6c]
call fcn.004121b2
push dword [ebp - 0x18]
call fcn.0040c525
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
call fcn.0041f0ad
ret 4
Function at 0x41a33c
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x10004]
mov eax, 0x10004
call fcn.00423440
push 0xffffffffffffffff
push 0x442642
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x45116c]
xor eax, ebp
mov dword [ebp + 0x10000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x1000c]
and dword [ebp - 0x18], 0
mov dword [ebp - 0x28], ebx
xor edi, edi
mov esi, 0x443c3c
inc edi
push esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], edi
mov byte [ebp - 0xd], 0
call fcn.0040b91e
push esi
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0040b91e
and dword [ebp - 0x14], 0
cmp dword [ebp + 0x10014], 0
mov dword [ebp - 0x18], edi
jle 0x41a4ef
push edi
push dword [ebp - 0x14]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp + 0x10010]
call fcn.0040b988
push 0x444160
push eax
mov byte [ebp - 4], 3
call fcn.0040baab
push dword [ebp - 0x34]
mov byte [ebp - 0xe], al
mov byte [ebp - 4], 2
call fcn.004232ae
cmp byte [ebp - 0xe], 0
pop ecx
je 0x41a45e
cmp byte [ebp - 0xd], 0
sete al
test al, al
mov byte [ebp - 0xd], al
jne 0x41a4dd
push 0x7fff
lea eax, [ebp]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp]
push eax
push ebx
lea eax, [ebp - 0x70]
push eax
call fcn.0041376b
push eax
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.0040b954
push dword [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.004232ae
pop ecx
push esi
lea ecx, [ebp - 0x24]
call fcn.0040e4ca
push esi
lea eax, [ebp]
push 0x7fff
push eax
call fcn.00422deb
add esp, 0xc
jmp 0x41a4dd
cmp byte [ebp - 0xd], 0
push edi
push dword [ebp - 0x14]
lea ecx, [ebp + 0x10010]
je 0x41a4a3
lea eax, [ebp - 0x64]
push eax
call fcn.0040b988
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 5
call fcn.0040d542
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
call fcn.0040b954
push dword [ebp - 0x4c]
call fcn.004232ae
push dword [ebp - 0x64]
jmp 0x41a4d2
lea eax, [ebp - 0x58]
push eax
call fcn.0040b988
push eax
push ebx
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 7
call fcn.0040d542
push eax
mov ecx, ebx
mov byte [ebp - 4], 8
call fcn.0040b954
push dword [ebp - 0x40]
call fcn.004232ae
push dword [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.004232ae
pop ecx
pop ecx
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0x10014]
jl 0x41a3be
push dword [ebp - 0x24]
call fcn.004232ae
push dword [ebp + 0x10010]
call fcn.004232ae
pop ecx
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x10000]
xor ecx, ebp
call fcn.0041eb21
add ebp, 0x10004
leave
ret 0x10