joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7aaf10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x7bf9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x7ab002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.007aedff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x7ab002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.007a66e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.007af20b
push 0x10
call fcn.007af1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x7aafc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.0079b1c0
jmp 0x7aafc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.007aab80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x7aaff0
mov ecx, edi
call fcn.0079b2c0
push edi
call fcn.007af1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x7ab021
inc ebx
cmp ebx, 0x20
jb 0x7aaf3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x7ac250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7c0808
push 0x7b0288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x7ac329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x7ac329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.007af1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x7ac329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x7ac329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x7ac32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.007ac351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7acd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x7acd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x7acd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x7acd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x7acd94
push eax
push esi
call fcn.007af20b
add esp, 8
pop esi
ret 0x10

Function at 0x7acda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7ace22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x7ace15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x7c5320
push ecx
mov dword [esp + 0x1c], 4
call fcn.007aedff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x7acdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x7ace30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7acec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x7aceb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x7c5320
push ecx
mov dword [esp + 0x1c], 4
call fcn.007aedff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x7aceab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x7ace6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x7ad000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x7ad131
push esi
call fcn.007b0145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0079f080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x7ad131
push 0
push ebp
call fcn.0079f3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0079f260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x7ad08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0079f2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x7ad121
push 0x7c5918
push edi
call fcn.007ae3f0
push eax
push ebx
push esi
call fcn.007acf60
push 0x7c58f8
push edi
call fcn.007ae3f0
push eax
push ebx
push esi
call fcn.007acf60
push 0x7c58d8
push edi
call fcn.007ae3f0
push eax
push ebx
push esi
call fcn.007acf60
push 0x7c58c0
push edi
call fcn.007ae3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.007acf60
push 0x7c58a0
push edi
call fcn.007ae3f0
push eax
push ebx
push esi
call fcn.007acf60
push 0x7c5888
push edi
call fcn.007ae3f0
push eax
push ebx
push esi
call fcn.007acf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x7ae1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.007ae140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.007ae140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.007ae140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.007ae140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x7aebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7aec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x7c087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7aec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x7aec52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4034f3
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x45fbc8
call fcn.00458110
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00403686
xor ebx, ebx
mov dword [esi + 0x30], 4
mov dword [ebp - 4], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x20], 0x466438
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 1
mov byte [esi + 0x34], 1
call fcn.004035e4
lea ecx, [esi + 0x88]
mov byte [esi + 0x84], bl
push 0xf
mov byte [ebp - 4], 2
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.004014fb
lea ecx, [esi + 0x98]
mov byte [esi + 0x94], bl
push 0xf
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.004014fb
lea ecx, [esi + 0xa8]
mov byte [esi + 0xa4], bl
mov byte [esi + 0xa5], bl
mov byte [esi + 0xa6], bl
push 0xf
mov byte [ebp - 4], 4
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.004014fb
lea ecx, [esi + 0xb4]
push 0xf
mov byte [ebp - 4], 5
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.004014fb
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xc0]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], 8
mov dword [eax], 0x466430
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4035e4
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x45fc08
call fcn.00458110
push ecx
push ebx
push esi
push edi
push 0xf
mov esi, ecx
pop edi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.004014fb
lea ecx, [esi + 0xc]
push edi
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.004014fb
lea ecx, [esi + 0x18]
push edi
mov byte [ebp - 4], 1
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.004014fb
lea ecx, [esi + 0x24]
push edi
mov byte [ebp - 4], 2
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.004014fb
lea ecx, [esi + 0x34]
mov byte [esi + 0x30], bl
push edi
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.004014fb
lea ecx, [esi + 0x40]
push edi
mov byte [ebp - 4], 4
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.004014fb
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405906
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jbe 0x405931
push ebx
push edi
movzx edi, byte [edx]
movzx ebx, al
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x478784]
xor eax, edi
inc edx
dec esi
jne 0x405917
pop edi
pop ebx
mov dword [ecx], eax
pop esi
ret 8
Function at 0x407602
Capabilities:
Get common file path

Disassembly:
mov eax, 0x460300
call fcn.00458110
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x105
cmp dword [esi + 8], edi
jg 0x40762b
push 0x106
mov ecx, esi
call fcn.004014fb
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, dword [esi]
xor ebx, ebx
xor edx, edx
cmp word [ecx], bx
je 0x40764a
mov edi, ecx
inc edx
inc edi
inc edi
cmp word [edi], bx
jne 0x407642
mov word [ecx + edx*2], bx
cmp eax, ebx
mov dword [esi + 4], edx
je 0x407661
mov ecx, 0x104
cmp ecx, eax
sbb eax, eax
inc eax
jmp 0x4076ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
je 0x407670
xor al, al
jmp 0x4076ce
push 0xf
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00404c65
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
call fcn.004075bb
test al, al
je 0x4076c3
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004061b6
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004014bd
push dword [ebp - 0x24]
call fcn.00405c78
pop ecx
mov bl, 1
push dword [ebp - 0x18]
call fcn.00405c78
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4076df
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x460314
call fcn.00458110
sub esp, 0x18
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x407700
mov al, 1
jmp 0x40775e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
je 0x40770f
xor al, al
jmp 0x40775e
push ebx
lea ecx, [ebp - 0x18]
push dword [ebp + 8]
call fcn.0040258d
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040625e
push dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0x24]
test eax, eax
setne bl
call fcn.00405c78
push dword [ebp - 0x18]
call fcn.00405c78
pop ecx
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4077f2
Capabilities:
Move file

Disassembly:
mov eax, 0x46034c
call fcn.00458110
sub esp, 0x30
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x407816
mov al, 1
jmp 0x4078af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
je 0x407828
xor al, al
jmp 0x4078af
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push dword [ebp + 0xc]
mov esi, eax
neg esi
sbb esi, esi
lea ecx, [ebp - 0x24]
inc esi
call fcn.0040258d
push dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0040258d
lea eax, [ebp - 0x24]
push esi
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 1
call fcn.0040625e
mov edi, dword [eax]
lea eax, [ebp - 0x18]
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.0040625e
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push dword [ebp - 0x30]
test eax, eax
setne bl
call fcn.00405c78
push dword [ebp - 0x3c]
call fcn.00405c78
push dword [ebp - 0x18]
call fcn.00405c78
push dword [ebp - 0x24]
call fcn.00405c78
add esp, 0x10
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 8

Function at 0x407b50
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x407b64
xor al, al
jmp 0x407b74
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
ret 4

Function at 0x40838e
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, 0x104
push edi
mov edi, 0x105
cmp dword [esi + 8], ebx
jg 0x4083ac
push edi
mov ecx, esi
call fcn.00404c65
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, esi
mov edi, eax
call fcn.00408992
test edi, edi
jbe 0x4083cb
cmp edi, ebx
ja 0x4083cb
push 1
pop eax
jmp 0x4083cd
xor eax, eax
pop edi
pop esi
pop ebx
ret 4
Function at 0x4083d3
Capabilities:
Get common file path

Disassembly:
mov eax, 0x46054c
call fcn.00458110
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, 0x105
mov eax, dword [esi]
mov dword [esi + 4], ebx
mov word [eax], bx
cmp dword [esi + 8], 0x104
jg 0x408406
push edi
mov ecx, esi
call fcn.004014fb
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esi]
xor edx, edx
cmp word [ecx], bx
je 0x408422
mov edi, ecx
inc edx
inc edi
inc edi
cmp word [edi], bx
jne 0x40841a
mov word [ecx + edx*2], bx
cmp eax, ebx
mov dword [esi + 4], edx
jne 0x40849c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
je 0x40843c
xor al, al
jmp 0x4084ac
push 0xf
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00404c65
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
call fcn.0040838e
test al, al
je 0x40848f
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004061b6
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004014bd
push dword [ebp - 0x24]
call fcn.00405c78
pop ecx
mov bl, 1
push dword [ebp - 0x18]
call fcn.00405c78
pop ecx
mov al, bl
jmp 0x4084ac
jbe 0x4084aa
cmp eax, 0x104
ja 0x4084aa
push 1
pop eax
jmp 0x4084ac
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4084fa
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4605c4
call fcn.00458110
sub esp, 0x40
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [edi + 8], 0x104
jg 0x408526
push 0x105
mov ecx, edi
call fcn.004014fb
push dword [edi]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp + 0x10], eax
mov eax, dword [edi]
xor ecx, ecx
cmp word [eax], bx
je 0x40854b
mov edx, eax
inc ecx
inc edx
inc edx
cmp word [edx], bx
jne 0x408543
cmp dword [ebp + 0x10], ebx
mov word [eax + ecx*2], bx
mov dword [edi + 4], ecx
jne 0x40868d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x40868d
push esi
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov esi, eax
push 0xf
neg esi
sbb esi, esi
lea ecx, [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00404c65
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], ebx
je 0x4085cc
push dword [ebp + 0xc]
lea ecx, [ebp - 0x34]
call fcn.0040258d
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x34]
push esi
push eax
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 1
call fcn.0040625e
mov dword [ebp - 0x10], 3
mov eax, dword [eax]
mov dword [ebp - 4], 2
mov dword [ebp + 0xc], eax
jmp 0x4085cf
mov dword [ebp + 0xc], ebx
xor eax, eax
push 4
cmp dword [ebp + 8], eax
pop ebx
je 0x408605
push dword [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.0040258d
or dword [ebp - 0x10], ebx
lea eax, [ebp - 0x28]
push esi
push eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 4], 3
call fcn.0040625e
or dword [ebp - 0x10], 8
mov eax, dword [eax]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp + 0xc]
push eax
call fcn.004084bd
test byte [ebp - 0x10], 8
mov dword [ebp + 0x10], eax
je 0x408628
push dword [ebp - 0x40]
and dword [ebp - 0x10], 0xfffffff7
call fcn.00405c78
pop ecx
test byte [ebp - 0x10], bl
je 0x40863a
push dword [ebp - 0x28]
and dword [ebp - 0x10], 0xfffffffb
call fcn.00405c78
pop ecx
test byte [ebp - 0x10], 2
je 0x40864d
push dword [ebp - 0x4c]
and dword [ebp - 0x10], 0xfffffffd
call fcn.00405c78
pop ecx
and dword [ebp - 4], 0
test byte [ebp - 0x10], 1
je 0x408660
push dword [ebp - 0x34]
call fcn.00405c78
pop ecx
lea eax, [ebp - 0x1c]
push esi
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.004061b6
push eax
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.004014bd
push dword [ebp - 0x4c]
call fcn.00405c78
push dword [ebp - 0x1c]
call fcn.00405c78
pop ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x408dcb
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4606a0
call fcn.00458110
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 1
mov eax, dword [esi]
push 0
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
push 0
mov dword [edi + 0x18], eax
push dword [esi + 0x1c]
call fcn.004583d0
mov ecx, dword [esi + 0x20]
xor ebx, ebx
add eax, ecx
lea ecx, [ebp - 0x18]
mov dword [edi + 0x20], eax
lea eax, [esi + 0x2c]
adc edx, ebx
push eax
mov dword [edi + 0x24], edx
call fcn.0040616f
and dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00408e84
push eax
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 1
call fcn.004014bd
push dword [ebp - 0x24]
call fcn.00405c78
push dword [ebp - 0x18]
call fcn.00405c78
mov eax, dword [esi + 0x24]
pop ecx
pop ecx
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40913c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409163
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x409163
xor al, al
jmp 0x409183
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.004583d0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x40ca6f
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x460b10
call fcn.00458110
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004025ee
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.004025ee
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.004025ee
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.004025ee
mov al, byte [edi + 0x30]
lea ecx, [esi + 0x34]
mov byte [esi + 0x30], al
lea eax, [edi + 0x34]
push eax
mov byte [ebp - 4], 3
call fcn.004025ee
add edi, 0x40
lea ecx, [esi + 0x40]
push edi
mov byte [ebp - 4], 4
call fcn.004025ee
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4