joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40106c
Capabilities:
Delete directory
Delete file

Disassembly:
mov eax, 0x4431d3
call fcn.004205a0
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x1c], esi
cmp byte [esi + 0x20], 0
mov dword [ebp - 4], 1
jne 0x40126b
mov edi, dword [esi + 4]
mov eax, dword [esi + 8]
cmp edi, eax
mov ebx, str.ISSetupDLLOp
je 0x401174
mov ecx, edi
call fcn.00401eea
push eax
lea eax, [ebp - 0xd]
push 1
push eax
push str.File_s
lea ecx, [ebp - 0x48]
call fcn.00401698
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0040171a
push eax
lea eax, [ebp - 0xe]
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x18], esp
push 1
push eax
push str.DeleterDeleteFile
call fcn.00401698
sub esp, 0x28
lea eax, [ebp - 0xf]
mov ecx, esp
mov dword [ebp - 0x20], esp
push 1
push eax
push ebx
mov byte [ebp - 4], 3
call fcn.00401698
mov byte [ebp - 4], 2
call fcn.0041973d
add esp, 0x58
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00401291
and dword [ebp - 0x18], 0
sub esp, 0x28
mov dword [ebp - 0x20], esp
mov ecx, esp
push 0
push edi
mov dword [ecx], 0x4494d8
mov dword [ecx + 0x20], 0x4494d0
call fcn.00401a9c
call fcn.00415634
add esp, 0x28
test al, al
je 0x401168
mov ecx, edi
call fcn.00401eea
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x401168
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x18]
cmp eax, 0x64
jge 0x401168
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401118
add edi, 0x28
cmp edi, dword [esi + 8]
jne 0x4010a5
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x14], eax
cmp eax, dword [esi + 0x14]
je 0x40125d
mov eax, dword [ebp - 0x14]
lea ecx, [eax - 0x28]
call fcn.00401eea
push eax
lea eax, [ebp - 0xf]
push 1
push eax
push str.Folder_s
lea ecx, [ebp - 0x48]
call fcn.00401698
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0040171a
push eax
lea eax, [ebp - 0xe]
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x20], esp
push 1
push eax
push str.DeleterDeleteFolder
call fcn.00401698
sub esp, 0x28
lea eax, [ebp - 0xd]
mov ecx, esp
mov dword [ebp - 0x18], esp
push 1
push eax
push ebx
mov byte [ebp - 4], 5
call fcn.00401698
mov byte [ebp - 4], 4
call fcn.0041973d
add esp, 0x58
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00401291
xor edi, edi
lea ecx, [ebp - 0x14]
call fcn.00401a21
sub esp, 0x28
mov dword [ebp - 0x20], esp
mov ecx, esp
push 0
push eax
mov dword [ecx], 0x4494d8
mov dword [ecx + 0x20], 0x4494d0
call fcn.00401a9c
call fcn.00415634
add esp, 0x28
test al, al
je 0x401251
mov eax, dword [ebp - 0x14]
lea ecx, [eax - 0x28]
call fcn.00401eea
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x401251
mov eax, edi
inc edi
cmp eax, 0x64
jge 0x401251
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4011f8
sub dword [ebp - 0x14], 0x28
mov eax, dword [ebp - 0x14]
jmp 0x40117a
cmp byte [esi + 0x21], 0
je 0x40126b
push 1
call fcn.0040130b
pop ecx
and byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.004019ee
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004019ee
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x40366f
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x443536
call fcn.004205a0
sub esp, 0x224
push ebx
push esi
lea eax, [ebp - 0x230]
push edi
xor ebx, ebx
push eax
push 0x104
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4036b3
lea ecx, [ebp - 0x58]
call fcn.00403853
lea eax, [ebp - 0x58]
push 0x44b9c8
push eax
call fcn.00420f48
push 0x24
xor eax, eax
pop ecx
lea edi, [ebp - 0x128]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
mov edi, 0x449500
mov esi, 0x4494f8
je 0x4037f2
cmp dword [ebp - 0x11c], 1
jne 0x4037f2
lea eax, [ebp - 0xe]
push ebx
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
call fcn.00404716
push str.123.tmp
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.00403c36
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea ecx, [ebp - 0x3c]
call fcn.00404afe
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x4037d1
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.004039d5
pop ecx
pop ecx
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 2
push ecx
mov ecx, eax
call fcn.00403b12
push dword [0x4494e0]
mov ecx, eax
add eax, 4
mov byte [ebp - 4], 3
neg ecx
sbb ecx, ecx
push ebx
and ecx, eax
push ecx
lea ecx, [ebp - 0x38]
call fcn.00402293
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 2
call fcn.00401291
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.00401291
push 0x453348
lea ecx, [ebp - 0x3c]
call fcn.00403c36
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401a9c
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c]
jmp 0x40383c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x3c]
call fcn.00404afe
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
call fcn.00401291
lea eax, [ebp - 0xd]
push ebx
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x44], esi
call fcn.00404716
push 0x453344
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 4
call fcn.00403c36
mov ecx, dword [ebp + 8]
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401a9c
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x64]
call fcn.00401291
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4039d5
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4435a3
call fcn.004205a0
sub esp, 0x15c
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
push 1
mov esi, 0x104
pop ebx
cmp dword [ebp + 0xc], ebx
jne 0x403a80
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x403a80
push str.GetSystemWindowsDirectoryA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x453364], eax
je 0x403a80
lea ecx, [ebp - 0x168]
push esi
push ecx
call eax
test eax, eax
je 0x403a80
lea eax, [ebp + 0xf]
push 0
push eax
lea eax, [ebp - 0x168]
mov edi, 0x449500
mov esi, 0x4494f8
push eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x44], esi
call fcn.00404716
push 0x453344
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], ebx
call fcn.00403c36
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401a9c
mov dword [ebp - 0x14], ebx
and byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
jmp 0x403afb
lea eax, [ebp - 0x168]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x403aa8
lea ecx, [ebp - 0x30]
call fcn.00403853
lea eax, [ebp - 0x30]
push 0x44b9c8
push eax
call fcn.00420f48
lea eax, [ebp - 0xd]
push 0
push eax
lea eax, [ebp - 0x168]
mov edi, 0x449500
mov esi, 0x4494f8
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
call fcn.00404716
push 0x453344
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 2
call fcn.00403c36
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401a9c
and byte [ebp - 4], 0
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x3c]
call fcn.00401291
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40dc9a
Capabilities:
Get disk information

Disassembly:
mov eax, 0x444b50
call fcn.004205a0
sub esp, 0x50
push esi
mov esi, ecx
lea eax, [ebp - 0x5c]
push edi
mov ecx, dword [esi + 0x154]
push eax
call fcn.00403252
and dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
push 0
push ecx
mov ecx, eax
call fcn.00401d68
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00401eea
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00401291
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00401291
cmp edi, 2
je 0x40dd26
cmp edi, 5
je 0x40dd26
cmp edi, 3
je 0x40dd22
cmp edi, 4
je 0x40dd22
cmp edi, 6
je 0x40dd22
mov ecx, esi
call fcn.0040d7a5
dec ax
neg ax
sbb eax, eax
neg eax
jmp 0x40dd28
xor al, al
jmp 0x40dd28
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40f97d
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
mov eax, 0x444f48
call fcn.004205a0
sub esp, 0x4c
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov esi, dword [edi + 0xa8]
cmp esi, eax
je 0x40fa88
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40f9c6
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
push edi
push str..debug
call fcn.0040fad8
pop ecx
test eax, eax
pop ecx
je 0x40f9f2
cmp dword [eax + 0xc], esi
jne 0x40f9f2
mov ecx, dword [eax + 0x14]
mov edx, dword [edi + 0xac]
mov dword [ebp + 0xc], edx
mov edi, ecx
lea eax, [ecx + ebx]
mov dword [ebp + 0x10], edx
jmp 0x40fa45
push edi
push str..rdata
call fcn.0040fad8
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x40fa18
push edi
push str..text
call fcn.0040fad8
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x40fa88
mov edi, dword [edi + 0xac]
push 0x1c
mov dword [ebp + 0x10], edi
mov eax, edi
xor edx, edx
pop edi
div edi
test eax, eax
mov dword [ebp + 0xc], eax
je 0x40fa88
sub esi, dword [ecx + 0xc]
mov eax, dword [ecx + 0x14]
lea ecx, [eax + esi]
mov edi, ecx
lea eax, [ecx + ebx]
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0x10], ecx
mov ecx, eax
sub ecx, ebx
cmp ecx, dword [ebp - 0x18]
jbe 0x40fa93
cmp dword [ebp + 8], 0
je 0x40fa93
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, edi
xor edx, edx
div dword [ebp - 0x3c]
xor edx, edx
mov esi, eax
mov eax, edi
div dword [ebp - 0x3c]
imul esi, dword [ebp - 0x3c]
add edx, dword [ebp + 0x10]
push edx
push esi
push 0
push 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x40fa8c
xor eax, eax
jmp 0x40fac9
mov dword [ebp - 0x10], eax
sub eax, esi
add eax, edi
mov edx, dword [ebp + 0xc]
test edx, edx
jbe 0x40fab2
add eax, 0x10
mov ecx, dword [eax]
mov esi, dword [eax + 8]
add esi, ecx
cmp esi, dword [ebp + 0x14]
jbe 0x40faac
add dword [ebp - 0x14], ecx
add eax, 0x1c
dec edx
jne 0x40fa9d
cmp dword [ebp - 0x10], 0
je 0x40fac6
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x40fac6
push dword [ebp - 0x10]
call eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40fb1e
Capabilities:
Create directory

Disassembly:
mov eax, 0x444f64
call fcn.004205a0
sub esp, 0x3c
push ebx
push esi
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.00410e9d
mov ecx, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 0x2c]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0040fbed
mov eax, dword [eax + 0x10]
cmp eax, ebx
jne 0x40fb55
xor esi, esi
jmp 0x40fb5e
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov esi, eax
lea ecx, [ebp - 0x2c]
call fcn.00410c99
push 0x5c
inc esi
pop edi
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp + 8]
push esi
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.0041160b
cmp dword [0x449e20], eax
je 0x40fbd0
lea esi, [eax + 1]
push ebx
push esi
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x20], 0x449e08
mov dword [ebp - 0x18], 0x449e00
call fcn.004109e5
mov dword [ebp - 0x2c], vtable.zpath.0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0041188b
push ebx
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00410c99
mov dword [ebp - 0x10], edi
jmp 0x40fb6d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00410f22
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40fe42
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0
je 0x40fe87
mov eax, dword [ebp + 8]
test eax, eax
je 0x40fe5c
and dword [eax], 0
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40fee3
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.0040da9c
lea eax, [ebp - 0x4c]
push 0x44d398
push eax
call fcn.00420f48
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40fee3
cmp dword [ebp + 8], 0
jne 0x40febc
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.0040ada6
lea eax, [ebp - 0x48]
push 0x44cc60
push eax
call fcn.00420f48
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40fee3
push 1
add esi, 0xc
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.0040d9d5
lea eax, [ebp - 0x48]
push 0x44cc60
push eax
call fcn.00420f48
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x41201b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x41202f
push 0x26
pop eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x412063
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.0041e0fb
test al, al
jne 0x412096
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.0040da9c
lea eax, [ebp - 0x4c]
push 0x44d398
push eax
call fcn.00420f48
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x412096
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.0040ada6
lea eax, [ebp - 0x48]
push 0x44cc60
push eax
call fcn.00420f48
mov eax, dword [ebp + 8]
pop esi
leave
ret 8
Function at 0x41209e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x4120b2
push 6
pop eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4120e6
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.0041e0fb
test al, al
jne 0x412119
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.0040da9c
lea eax, [ebp - 0x4c]
push 0x44d398
push eax
call fcn.00420f48
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x412119
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.0040ada6
lea eax, [ebp - 0x48]
push 0x44cc60
push eax
call fcn.00420f48
mov eax, dword [ebp + 8]
pop esi
leave
ret 8

Function at 0x41415a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x445644
call fcn.004205a0
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
and dword [esi], 0
movzx eax, word [ebp + 8]
and dword [ebp - 4], 0
push 5
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
mov dword [esi + 4], eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp dword [esi], edi
je 0x4141b4
mov ecx, esi
call fcn.00412b24
mov dword [esi], edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [esi]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [esi + 8]
call fcn.004205c0
mov eax, dword [esi + 8]
add esp, 0xc
cmp word [eax + 2], 0xffff
jne 0x4141ec
or dword [eax + 0xc], 0x48
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x414213
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x445660
call fcn.004205a0
sub esp, 0x18
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [ebp - 0x24]
push dword [esi + 8]
call fcn.0041415a
push dword [ebp - 0x1c]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0040289b
mov ecx, dword [esi + 0xc]
mov byte [ebp - 4], 1
add ecx, 4
call fcn.00401eea
mov ecx, dword [esi + 0xc]
mov cx, word [ecx + 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00402a58
mov eax, dword [esi + 0xc]
push esi
push 0x4142b2
mov ecx, dword [eax]
mov eax, dword [eax + 0x30]
push ecx
mov eax, dword [eax + 0x154]
push dword [ebp - 0x18]
mov edi, dword [eax + 0x38]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
push edi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0040293c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004141fe
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x414464
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41447f
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x415e97
Capabilities:
Create directory

Disassembly:
mov eax, 0x445910
call fcn.004205a0
sub esp, 0x60
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x6c]
push ebx
push ebx
push eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.0040174c
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0040192a
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], bl
call fcn.00401291
lea eax, [ebp - 0x6c]
lea ecx, [ebp + 8]
push eax
call fcn.004020d7
lea ecx, [ebp - 0x6c]
call fcn.00401291
lea ecx, [ebp + 8]
mov dword [0x458994], ebx
call fcn.00401eb4
mov byte [ebp - 0xd], al
lea eax, [ebp - 0xe]
mov edi, 0x4494d0
push ebx
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], 0x4494d8
mov dword [ebp - 0x24], edi
call fcn.00401a27
mov byte [ebp - 4], 2
xor esi, esi
mov dword [ebp - 0x14], 1
push 1
lea eax, [ebp - 0x1c]
push esi
push eax
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x1c], 0x5c
call fcn.00402420
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
je 0x415fe0
sub eax, esi
lea ecx, [ebp + 8]
inc eax
push eax
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.00401cf1
lea esi, [ebp - 0x6c]
lea eax, [ebp - 0x68]
neg esi
sbb esi, esi
push 0x453344
and esi, eax
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.004184eb
test eax, eax
je 0x415f81
lea eax, [ebp - 0x6c]
lea ecx, [ebp - 0x44]
push eax
call fcn.00417b5f
jmp 0x415f91
push dword [0x4494e0]
lea ecx, [ebp - 0x40]
push ebx
push esi
call fcn.00404b70
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 1
lea esi, [eax + 1]
jle 0x415fd4
cmp dword [ebp - 0x14], 4
jg 0x415fa8
cmp byte [ebp - 0xd], bl
jne 0x415fd4
push ebx
lea ecx, [ebp - 0x44]
call fcn.00401eea
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x415fd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov dword [0x458994], eax
jne 0x416015
mov dword [0x458994], ebx
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 2
call fcn.00401291
inc dword [ebp - 0x14]
cmp dword [ebp - 0x18], 0xffffffff
jne 0x415f20
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], bl
call fcn.00401291
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401291
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
sub esp, 0x28
lea eax, [ebp - 0x44]
mov dword [ebp - 0x18], esp
mov ecx, esp
push ebx
push eax
mov dword [ecx], 0x4494d8
mov dword [ecx + 0x20], edi
call fcn.00401a9c
call fcn.00415769
add esp, 0x28
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 2
call fcn.00401291
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], bl
call fcn.00401291
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401291
xor al, al
jmp 0x416006
Function at 0x41629c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x94], 0x94
and dword [eax], 0
lea eax, [ebp - 0x94]
and dword [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x84], 1
jne 0x416317
cmp dword [ebp - 0x8c], 0
je 0x41630f
cmp dword [ebp - 0x8c], 0xa
je 0x4162fa
cmp dword [ebp - 0x8c], 0x5a
je 0x416303
xor al, al
mov dword [esi], 0x80
jmp 0x41637b
call fcn.00416628
test al, al
je 0x416307
mov al, 1
jmp 0x4162ef
mov dword [esi], 0x40
jmp 0x416365
mov dword [esi], 0x10
jmp 0x416365
cmp dword [ebp - 0x84], 2
jne 0x416379
mov eax, dword [ebp - 0x90]
sub eax, 4
je 0x416371
mov ecx, dword [ebp - 0x8c]
dec eax
je 0x416341
dec eax
je 0x416369
xor al, al
mov dword [esi], 0x1000000
jmp 0x41637b
test ecx, ecx
jne 0x41634d
mov dword [esi], 0x100000
jmp 0x416365
cmp ecx, 1
jne 0x41635a
mov dword [esi], 0x400000
jmp 0x416365
cmp ecx, 2
jne 0x416369
mov dword [esi], 0x800000
mov al, 1
jmp 0x41637b
test ecx, ecx
jne 0x416337
mov al, 1
jmp 0x416339
mov dword [esi], 0x10000
jmp 0x416365
xor al, al
pop esi
leave
ret

Function at 0x41651d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x41654c
push str.GetSystemDefaultUILanguage
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41654c
call eax
jmp 0x416623
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
mov ebx, 0xf003f
push eax
push ebx
push 0
mov edi, VariantInit
push str..DefaultControl_PaneldesktopResourceLocale
push edi
mov dword [ebp - 0xc], 0xa
call esi
test eax, eax
jne 0x416598
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x458884
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4165f9
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push ebx
push 0
push str..DEFAULTControl_PanelInternational
push edi
call esi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x4165cd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push str.Locale
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4165e1
cmp esi, ebx
je 0x4165e1
push dword [ebp - 8]
call esi
cmp edi, ebx
je 0x416601
cmp dword [ebp - 4], ebx
je 0x4165f3
cmp esi, ebx
je 0x4165f3
push dword [ebp - 4]
call esi
mov ax, 0x409
jmp 0x416623
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
push 0x10
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.00422078
add esp, 0xc
cmp dword [ebp - 4], ebx
mov edi, eax
je 0x416620
cmp esi, ebx
je 0x416620
push dword [ebp - 4]
call esi
mov ax, di
pop edi
pop esi
pop ebx
leave
ret