joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403360
Capabilities:
Check if file exists
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11d]
mov byte [esp + 0x11c], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x364]
mov dword [esp + 0x14], 0
stosw word es:[edi], ax
push esi
stosb byte es:[edi], al
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4034f0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 4
jb 0x4034f0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x104
lea eax, [esp + 0x120]
push esi
push eax
call ebp
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [esp + 0x11c]
push 0x42056c
push ecx
call ebx
lea edx, [esp + 0x220]
lea eax, [esp + 0x11c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x4034f0
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [esp + 0x1c]
push esi
push ecx
stosb byte es:[edi], al
call ebp
lea edx, [esp + 0x24c]
lea eax, [esp + 0x18]
push edx
push eax
call ebx
test byte [esp + 0x220], 0x10
jne 0x403452
lea ecx, [esp + 0x18]
push 1
push ecx
call fcn.00402400
add esp, 8
jmp 0x403495
lea edx, [esp + 0x24c]
push edx
push 0x420568
call sub.MSVCRT.dll__mbsicmp
add esp, 8
test eax, eax
je 0x403495
lea eax, [esp + 0x24c]
push eax
push 0x420564
call sub.MSVCRT.dll__mbsicmp
add esp, 8
test eax, eax
je 0x403495
lea ecx, [esp + 0x18]
push ecx
call fcn.00403360
add esp, 4
test eax, eax
je 0x4034b7
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x220]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403406
mov edi, 1
jmp 0x4034bb
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
je 0x4034f0
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4034e0
push 1
push esi
call fcn.00402400
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x350
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x350
ret

Function at 0x403a50
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x403a83
cmp dword [esp + 4], 6
jb 0x403a83
mov eax, 1
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret
Function at 0x4046d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x25c
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], 0x44
mov edx, dword [esp + 0x264]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
mov ecx, 0x81
mov dword [esp + 8], eax
lea edi, [esp + 0x59]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x58], al
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x268]
stosw word es:[edi], ax
push ecx
push edx
stosb byte es:[edi], al
push 0x4206a8
lea eax, [esp + 0x64]
push 0x207
push eax
call sub.MSVCRT.dll__snprintf
add esp, 0x14
lea ecx, [esp + 4]
lea edx, [esp + 0x14]
lea eax, [esp + 0x58]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
jne 0x40476c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add esp, 0x25c
ret
mov eax, dword [esp + 0x268]
test eax, eax
jbe 0x404783
mov ecx, dword [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
mov eax, 1
pop esi
add esp, 0x25c
ret

Function at 0x405110
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], bl
mov byte [esp + 0xc], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [0x421fc8], ebx
jne 0x40515d
pop edi
xor eax, eax
pop ebx
add esp, 0x20c
ret 0x10
mov ecx, dword [esp + 0x218]
push esi
lea eax, [esp + 0x114]
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40520b
lea edx, [esp + 0x10]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0x10]
push str.dllcache
push eax
call esi
lea ecx, [esp + 0x114]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
lea edx, [esp + 0x10]
push eax
push edx
call esi
push 1
lea eax, [esp + 0x14]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
cmp esi, ebx
je 0x40520b
mov ecx, dword [esp + 0x220]
push ecx
push esi
call fcn.00405030
cmp eax, ebx
je 0x405204
mov ecx, dword [esp + 0x228]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x228]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop edi
pop ebx
add esp, 0x20c
ret 0x10
Function at 0x405220
Capabilities:
Check for sandbox and av modules

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x419738
push eax
mov eax, dword [0x421fc8]
mov dword fs:[0], esp
sub esp, 0xc
test eax, eax
push esi
je 0x4052ca
push edi
mov ecx, 0x421fe0
call fcn.00404900
xor esi, esi
push str.Dbghelp.dll
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [esp + 8], eax
jne 0x405287
push str.Dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esp + 8], eax
je 0x405295
mov dword [esp + 0xc], esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
mov dword [esp + 0x1c], 0
pop edi
je 0x4052ca
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
call esi
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
mov eax, dword [esp + 0x28]
cmp ax, 0x10
jb 0x4052e8
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
mov edx, dword [esp + 0x20]
and eax, 0xffff
mov ecx, dword [edx + 0x3c]
lea ecx, [ecx + eax*8 + 0x78]
mov eax, dword [ecx + edx]
add ecx, edx
add eax, edx
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x40530c
mov ecx, dword [ecx + 4]
mov dword [edx], ecx
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10

Function at 0x406460
Capabilities:
Check if file exists
Delete file

Disassembly:
sub esp, 0x104
push esi
mov edx, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
add edx, 4
push eax
push edx
call fcn.00407240
add esp, 0xc
lea ecx, [esp + 8]
mov esi, eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4064c0
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x4064c0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret

Function at 0x4064d0
Capabilities:
Check if file exists
Delete file

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x110]
push 0x103
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push ecx
call fcn.00407240
add esp, 0xc
lea edx, [esp + 8]
mov esi, eax
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x406532
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x406532
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret 4
Function at 0x406ce0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
je 0x406daf
mov eax, dword [esp + 0x10]
cmp eax, 1
jne 0x406d30
cmp dword [esp + 4], 4
jne 0x406daf
mov eax, 1
add esp, 0x94
ret
cmp eax, 2
jne 0x406daf
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x406d74
mov eax, dword [esp + 8]
test eax, eax
jne 0x406d52
mov eax, 2
add esp, 0x94
ret
cmp eax, 1
jne 0x406d63
mov eax, 3
add esp, 0x94
ret
cmp eax, 2
jne 0x406daf
mov eax, 4
add esp, 0x94
ret
cmp eax, 6
jne 0x406daf
mov eax, dword [esp + 8]
test eax, eax
jne 0x406d8d
mov eax, 5
add esp, 0x94
ret
cmp eax, 1
jne 0x406d9e
mov eax, 6
add esp, 0x94
ret
cmp eax, 2
jne 0x406daf
mov eax, 7
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret

Function at 0x407cf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov dword [esp + 8], 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x21c]
lea ecx, [esp + 0x10]
push eax
push str.CLSID_sInprocServer32
push 0x103
push ecx
call sub.MSVCRT.dll__snprintf
add esp, 0x10
lea edx, [esp + 4]
lea eax, [esp + 0x10]
push edx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x407d71
xor al, al
pop edi
add esp, 0x214
ret
lea ecx, [esp + 8]
lea edx, [esp + 0x114]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x407dab
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop edi
add esp, 0x214
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esp + 0x114]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
cmp ecx, 4
setae al
add esp, 0x214
ret

Function at 0x407e80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
lea eax, [esp]
mov ecx, 0x422ad8
push ebx
push eax
xor ebx, ebx
call fcn.00404900
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x407ef8
push edi
mov ecx, 0x40
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
stosb byte es:[edi], al
push ecx
mov ecx, dword [esp + 0x120]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push eax
push ebx
push ecx
push edx
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop edi
jne 0x407eed
mov bl, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0x110
ret
Function at 0x407f10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
lea eax, [esp]
mov ecx, 0x422ac8
push ebx
push eax
xor ebx, ebx
call fcn.00404900
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x407f88
push edi
mov ecx, 0x40
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
stosb byte es:[edi], al
push ecx
mov ecx, dword [esp + 0x120]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push eax
push ebx
push ecx
push edx
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop edi
jne 0x407f7d
mov bl, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0x110
ret

Function at 0x408240
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
mov esi, ecx
push edi
lea ecx, [esi + 8]
call fcn.0040a250
xor edx, edx
mov ecx, 0x41
xor eax, eax
lea edi, [esi + 0x118]
mov dword [esi], 0x41aa40
mov dword [esi + 4], edx
mov byte [esi + 0x14], dl
mov dword [esi + 0x21c], 0xffffffff
rep stosd dword es:[edi], eax
mov ecx, 0x63
lea edi, [esp + 0xa]
mov word [esp + 8], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov eax, esi
pop edi
pop esi
add esp, 0x190
ret 4
Function at 0x409bd0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push esi
push edi
xor eax, eax
mov ecx, 0x49
lea edi, [esp + 0xc]
mov dword [esp + 8], 0
push eax
push 2
rep stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x409c69
lea eax, [esp + 8]
mov dword [esp + 8], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x409c62
lea ecx, [esp + 0x2c]
push str.explorer.exe
push ecx
call sub.MSVCRT.dll__mbsicmp
add esp, 8
test eax, eax
je 0x409c4e
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x409c62
lea eax, [esp + 0x2c]
push str.explorer.exe
push eax
call sub.MSVCRT.dll__mbsicmp
add esp, 8
test eax, eax
jne 0x409c29
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
add esp, 0x128
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x128
ret
Function at 0x40a010
Capabilities:
Check if file exists
Delete file

Disassembly:
sub esp, 0x208
push ebx
push ebp
mov ebp, dword [esp + 0x21c]
push esi
test ebp, ebp
push edi
je 0x40a109
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x40a109
mov esi, dword [esp + 0x220]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40a09c
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push esi
call fcn.0040d0a0
add esp, 8
lea ecx, [esp + 0x10]
push ebp
push ecx
call ebx
test eax, eax
jne 0x40a091
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x208
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40a109
mov edx, dword [esp + 0x21c]
push 0
push 0xa
push esi
push edx
call fcn.00407110
add esp, 0x10
test eax, eax
je 0x40a109
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x114]
push eax
push esi
call fcn.0040d0a0
add esp, 8
lea ecx, [esp + 0x114]
push ebp
push ecx
call ebx
test eax, eax
jne 0x40a102
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x208
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret 0xc

Function at 0x40b130
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
sub esp, 0x104
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 4]
push str.SogouDownLoadupdate_tmp
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
pop edi
jne 0x40b196
push eax
lea eax, [esp + 4]
push eax
call fcn.00402de0
add esp, 8
test eax, eax
jne 0x40b196
add esp, 0x104
ret
mov ecx, dword [esp + 0x10c]
mov eax, dword [esp + 0x108]
lea edx, [esp]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, 1
add esp, 0x104
ret
Function at 0x40b780
Capabilities:
Get file version info

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, ecx
push 0
lea ebp, [esi + 0x30]
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x40b7a0
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
push edi
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, ebx
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 8], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 8]
push eax
push ebx
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
pop edi
jne 0x40b7da
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.0040b480
test eax, eax
jne 0x40b7f1
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
mov eax, dword [esp + 0x14]
push 0x104
mov edx, eax
mov word [esi + 0xe], ax
mov eax, dword [esp + 0x1c]
shr edx, 0x10
mov ecx, eax
mov word [esi + 0x12], ax
mov eax, dword [esp + 0x20]
mov word [esi + 0xc], dx
shr ecx, 0x10
mov edx, eax
mov word [esi + 0x16], ax
mov eax, dword [esp + 0x24]
mov word [esi + 0x10], cx
mov ecx, eax
mov word [esi + 0x1a], ax
mov eax, dword [esp + 0x2c]
shr ecx, 0x10
shr edx, 0x10
mov word [esi + 0x18], cx
mov ecx, dword [esp + 0x30]
mov word [esi + 0x14], dx
mov edx, dword [esp + 0x28]
mov dword [esi + 0x24], ecx
lea ecx, [esi + 0x134]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x38]
push ecx
push str.CompanyName
mov ecx, esi
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], eax
call fcn.0040b600
test eax, eax
jne 0x40b87b
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea edx, [esi + 0x33c]
push 0x104
push edx
push str.FileDescription
mov ecx, esi
call fcn.0040b600
test eax, eax
jne 0x40b89e
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea eax, [esi + 0x238]
push 0x104
push eax
push str.ProductName
mov ecx, esi
call fcn.0040b600
neg eax
sbb eax, eax
pop esi
pop ebp
pop ebx
neg eax
add esp, 0x34
ret
Function at 0x40c470
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x40d0a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x490
mov ecx, 8
xor eax, eax
push ebx
mov ebx, dword [esp + 0x49c]
push esi
push edi
mov edi, ebx
push 0
rep stosd dword es:[edi], eax
push 0
push 3
stosb byte es:[edi], al
mov eax, dword [esp + 0x4ac]
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40d0ec
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x490
ret
lea ecx, [esp + 0x44]
push ecx
call fcn.0040c470
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 4
lea edx, [esp + 0xc]
lea eax, [esp + 0x9c]
push 0
push edx
push 0x400
push eax
push esi
call edi
test eax, eax
je 0x40d153
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x40d153
lea ecx, [esp + 0x9c]
push eax
lea edx, [esp + 0x48]
push ecx
push edx
call fcn.0040c4a0
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 0x9c]
push 0
push eax
push 0x400
push ecx
push esi
call edi
test eax, eax
jne 0x40d11a
lea edx, [esp + 0x44]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.0040c550
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
lea edi, [esp + 0x20]
xor ecx, ecx
mov cl, byte [esp + esi + 0x10]
push ecx
push str._02x
push 2
push edi
call sub.MSVCRT.dll__snprintf
add esp, 0x10
inc esi
add edi, 2
cmp esi, 0x10
jl 0x40d172
mov ecx, 8
lea esi, [esp + 0x20]
mov edi, ebx
mov al, 1
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
add esp, 0x490
ret

Function at 0x40d8e0
Capabilities:
Check if file exists
Copy file

Disassembly:
sub esp, 0x208
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov esi, dword [esp + 0x218]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x104
push eax
push esi
call fcn.004131e0
add esp, 0xc
test eax, eax
jne 0x40d928
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x208
ret
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea ecx, [esp + 0xc]
push ecx
call ebp
test eax, eax
jne 0x40d989
mov ecx, 0x40
lea edi, [esp + 0x111]
mov byte [esp + 0x110], al
lea edx, [esp + 0x110]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push esi
stosb byte es:[edi], al
call fcn.0040da00
add esp, 8
test eax, eax
je 0x40d91c
lea eax, [esp + 0x110]
push eax
call ebp
test eax, eax
je 0x40d91c
lea ecx, [esp + 0xc]
push 0
lea edx, [esp + 0x114]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0xc]
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x208
ret
Function at 0x40d9b0
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push esi
push edi
call fcn.0040da00
add esp, 8
test eax, eax
jne 0x40d9d8
mov eax, dword [esp + 0x18]
push eax
push esi
push edi
call fcn.0040da80
add esp, 0xc
call fcn.00403a50
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40d9f8
push esi
call ebx
test eax, eax
jne 0x40d9f8
push esi
push edi
call fcn.0040d8e0
add esp, 8
push esi
call ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40da00
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x104
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
push 0x104
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x110]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push ecx
call fcn.00413260
add esp, 0xc
test eax, eax
pop edi
je 0x40da6e
lea edx, [esp]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40da6e
mov ecx, dword [esp + 0x10c]
lea eax, [esp]
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, 1
add esp, 0x104
ret
xor eax, eax
add esp, 0x104
ret