joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c777
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push edi
mov edi, ecx
lea ecx, [ebp - 0x14]
call fcn.0041cf28
mov ecx, 0x47f450
call fcn.0041de81
push eax
lea eax, [ebp - 0x14]
push str._s_installation_couldnt_be_found._Try_re_installing_the_application_before_running_update.
push eax
call fcn.0041d5b5
add esp, 0xc
lea eax, [ebp - 4]
xor ebx, ebx
mov ecx, 0x47f68c
push eax
push 0x20019
push ebx
call fcn.0041de81
push eax
push dword [0x47f688]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41c838
cmp dword [0x47f698], ebx
jne 0x41c7ed
cmp dword [0x47f6a4], ebx
jne 0x41c7ed
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41c87a
mov eax, 0x104
push esi
mov dword [ebp - 8], eax
push eax
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.00425820
add esp, 0xc
lea eax, [ebp - 8]
mov ecx, 0x47f698
push eax
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
call fcn.0041de81
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
pop esi
je 0x41c872
cmp dword [0x47f7bc], ebx
je 0x41c85b
and dword [0x47f28c], 0xffffffbf
push ebx
push str._IsUpdate_
call fcn.0041e93d
mov ecx, edi
call fcn.00416d63
jmp 0x41c87a
push ebx
lea ecx, [ebp - 0x14]
call fcn.0041de81
push eax
push ebx
mov ecx, 0x47f0b8
call fcn.0041c404
jmp 0x41c89e
cmp dword [0x47f6a4], ebx
jne 0x41c87e
mov bl, 1
jmp 0x41c89e
test byte [0x47f291], 0x20
lea eax, [ebp - 0x118]
mov ecx, edi
push eax
je 0x41c897
call fcn.0041c8ac
jmp 0x41c89c
call fcn.0041ca4d
mov bl, al
lea ecx, [ebp - 0x14]
call fcn.0041d05e
mov al, bl
pop edi
pop ebx
leave
ret
Function at 0x41dc28
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x41dc5e
push 0xfffffffffffffffd
pop eax
jmp 0x41dd25
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [ebp - 4]
push 2
push ecx
push ebx
push eax
mov dword [ebp - 4], ebx
call edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push ebx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call edi
mov ecx, dword [ebp - 0xc]
cmp dword [ebp + 0xc], ecx
jbe 0x41dc8f
mov dword [ebp + 0xc], ecx
sub ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
cmp ecx, eax
jb 0x41dc9f
cmp eax, ebx
ja 0x41dca1
mov dword [esi], ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esi]
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi], ebx
mov dword [esi + 8], eax
jne 0x41dcdb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x41dd25
cmp dword [esi + 4], ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x41dcfc
push dword [ebp + 8]
call edi
mov ecx, 0x47fa34
call fcn.0041de81
push eax
call fcn.0041ea8b
pop ecx
lea eax, [ebp - 8]
push ebx
push eax
mov dword [ebp - 8], ebx
push dword [esi]
push dword [esi + 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 8]
call edi
mov ecx, dword [ebp - 8]
xor eax, eax
cmp ecx, dword [esi]
sete al
dec eax
and al, 0xfe
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x41df71
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 2
push edi
push edi
push 0xc0000000
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41df9f
push 0xfffffffffffffffd
pop eax
jmp 0x41dfc8
lea eax, [ebp + 8]
push edi
push eax
mov dword [ebp + 8], edi
push dword [esi]
push dword [esi + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
xor eax, eax
cmp ecx, dword [esi]
sete al
dec eax
and al, 0xfd
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x41eb68
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
push 0x42f1c8
call fcn.0041d075
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, 0xfffffc00
mov ecx, edx
and eax, esi
test ecx, ecx
ja 0x41ebbb
jb 0x41eb9a
cmp eax, 0x100000
jae 0x41ebbb
mov eax, dword [ebp + 8]
push 0xa
pop ecx
call fcn.00426380
push eax
push str._d_KB
push dword [ebp + 0x10]
call fcn.0041d5b5
add esp, 0xc
jmp 0x41ecec
mov eax, dword [ebp + 8]
push 0xa
pop ecx
call fcn.00426380
and byte [ebp - 0xc], 0
mov ebx, eax
xor eax, eax
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
push 0xa
push eax
push 0xe
push 0x400
mov dword [ebp + 0xc], edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x41ebfd
lea eax, [ebp - 0xc]
push 0x42d038
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [ebp + 0xc]
mov eax, ebx
mov ecx, edi
and eax, esi
test ecx, ecx
ja 0x41ec4c
jb 0x41ec13
cmp eax, 0x100000
jae 0x41ec4c
push 0xa
mov eax, ebx
pop ecx
mov edx, edi
call fcn.00426380
mov esi, eax
xor ecx, ecx
shl eax, 0xa
sub ebx, eax
push ecx
sbb edi, ecx
push 0x64
push edi
push ebx
call fcn.004265f0
cmp eax, 0xa
jb 0x41ec3c
push 9
pop eax
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str._d_s_d_MB
jmp 0x41ece1
push 0xa
mov eax, ebx
pop ecx
mov edx, edi
call fcn.00426380
mov edi, eax
mov ebx, edx
and eax, esi
test ebx, ebx
ja 0x41eca1
jb 0x41ec6b
cmp eax, 0x100000
jae 0x41eca1
push 0xa
mov eax, edi
pop ecx
mov edx, ebx
call fcn.00426380
mov esi, eax
xor ecx, ecx
shl eax, 0xa
sub edi, eax
push ecx
sbb ebx, ecx
push 0x64
push ebx
push edi
call fcn.004265f0
cmp eax, 0xa
jb 0x41ec94
push 9
pop eax
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str._d_s_d_GB
jmp 0x41ece1
push 0xa
mov eax, edi
pop ecx
mov edx, ebx
call fcn.00426380
push 0xa
mov esi, eax
pop ecx
mov edi, edx
call fcn.00426380
mov ebx, eax
xor ecx, ecx
shl eax, 0xa
sub esi, eax
push ecx
sbb edi, ecx
push 0x64
push edi
push esi
call fcn.004265f0
cmp eax, 0xa
jb 0x41ecd6
push 9
pop eax
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str._d_s_d_TB
push dword [ebp + 0x10]
call fcn.0041d5b5
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41ecf1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
xor esi, esi
cmp eax, esi
push edi
jne 0x41ed08
or eax, 0xffffffff
jmp 0x41eda9
mov dword [eax], esi
lea eax, [ebp + 8]
push eax
push 1
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41eda6
lea eax, [ebp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], esi
push dword [ebp + 8]
call edi
test eax, eax
jne 0x41eda2
mov eax, dword [ebp + 0xc]
inc eax
push eax
call fcn.004260f9
mov ebx, eax
pop ecx
cmp ebx, esi
jne 0x41ed63
mov ecx, 0x47fa34
call fcn.0041de81
push eax
call fcn.0041ea8b
pop ecx
mov eax, dword [ebp + 0xc]
inc eax
push eax
push esi
push ebx
call fcn.00425820
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x41ed97
mov eax, dword [ebp + 0x14]
push dword [ebp + 8]
mov dword [eax], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
jmp 0x41eda8
push ebx
call fcn.004260ee
pop ecx
push 0xfffffffffffffffe
jmp 0x41eda8
push 0xfffffffffffffffd
jmp 0x41eda8
push 0xfffffffffffffffc
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41ee09
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, 0x104
push edi
push esi
push 0
push dword [ebp + 8]
call fcn.00425820
push esi
call fcn.004260f9
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x41ee42
mov ecx, 0x47fa34
call fcn.0041de81
push eax
call fcn.0041ea8b
pop ecx
push esi
push 0
push edi
call fcn.00425820
add esp, 0xc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
jne 0x41ee6a
push 0x42e66c
push edi
call esi
jmp 0x41ee79
add eax, edi
cmp byte [eax - 1], 0x5c
je 0x41ee79
mov byte [eax], 0x5c
and byte [eax + 1], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
lea ebx, [eax + edi]
mov eax, dword [ebp - 4]
and byte [ebx], 0
inc dword [ebp - 4]
lea ecx, [ebp - 0x14]
push 0xa
push ecx
push eax
call fcn.00428c5f
add esp, 0xc
push 0x42e668
push edi
call esi
lea eax, [ebp - 0x14]
push eax
push edi
call esi
push dword [ebp + 0xc]
push edi
call esi
push edi
call fcn.0040ea14
test al, al
pop ecx
jne 0x41ee8d
push edi
push dword [ebp + 8]
call esi
push edi
call fcn.004260ee
mov eax, dword [ebp + 8]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41f834
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push esi
push str.GetSystemWindowsDirectoryA
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41f863
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x41f8c1
push edi
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0x90]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x84], 2
pop edi
push dword [ebp + 0xc]
push dword [ebp + 8]
jne 0x41f8bb
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
test esi, esi
je 0x41f8c1
push 0x5c
push dword [ebp + 8]
call fcn.00426040
pop ecx
test eax, eax
pop ecx
je 0x41f8b7
and byte [eax], 0
mov eax, esi
jmp 0x41f8c1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
pop esi
leave
ret
Function at 0x41f943
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x60], ebx
jne 0x41faa3
push dword [esp + 0xc]
lea ecx, [esi + 0x64]
call fcn.0041d075
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 0x60], eax
je 0x41faa7
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MP3Close
push eax
call edi
push str.MP3DeInit
mov dword [esi], eax
push dword [esi + 0x60]
call edi
push str.MP3GetCurrentPos
mov dword [esi + 4], eax
push dword [esi + 0x60]
call edi
push str.MP3GetLength
mov dword [esi + 8], eax
push dword [esi + 0x60]
call edi
push str.MP3GetMPEG_Args
mov dword [esi + 0xc], eax
push dword [esi + 0x60]
call edi
push str.MP3GetPlayer
mov dword [esi + 0x10], eax
push dword [esi + 0x60]
call edi
push str.MP3GetPlayerMode
mov dword [esi + 0x14], eax
push dword [esi + 0x60]
call edi
push str.MP3Init
mov dword [esi + 0x18], eax
push dword [esi + 0x60]
call edi
push str.MP3Open
mov dword [esi + 0x1c], eax
push dword [esi + 0x60]
call edi
push str.MP3Pause
mov dword [esi + 0x20], eax
push dword [esi + 0x60]
call edi
push str.MP3Play
mov dword [esi + 0x24], eax
push dword [esi + 0x60]
call edi
push str.MP3SetDevice
mov dword [esi + 0x28], eax
push dword [esi + 0x60]
call edi
push str.MP3SetExternalValues
mov dword [esi + 0x2c], eax
push dword [esi + 0x60]
call edi
push str.MP3SetPriority
mov dword [esi + 0x30], eax
push dword [esi + 0x60]
call edi
push str.MP3Stop
mov dword [esi + 0x34], eax
push dword [esi + 0x60]
call edi
push str.MP3Resume
mov dword [esi + 0x38], eax
push dword [esi + 0x60]
call edi
push str.MP3Suspend
mov dword [esi + 0x40], eax
push dword [esi + 0x60]
call edi
cmp dword [esi + 0x2c], ebx
mov dword [esi + 0x3c], eax
pop edi
je 0x41faa7
cmp dword [esi + 0x20], ebx
je 0x41faa7
cmp dword [esi + 0x34], ebx
je 0x41faa7
cmp dword [esi + 0x28], ebx
je 0x41faa7
cmp dword [esi], ebx
je 0x41faa7
cmp dword [esi + 0x10], ebx
je 0x41faa7
cmp dword [esi + 0x14], ebx
je 0x41faa7
cmp dword [esi + 8], ebx
je 0x41faa7
cmp dword [esi + 0xc], ebx
je 0x41faa7
cmp dword [esi + 0x18], ebx
je 0x41faa7
cmp dword [esi + 4], ebx
je 0x41faa7
cmp dword [esi + 0x1c], ebx
je 0x41faa7
cmp dword [esi + 0x30], ebx
je 0x41faa7
cmp dword [esi + 0x24], ebx
je 0x41faa7
cmp eax, ebx
je 0x41faa7
cmp dword [esi + 0x40], ebx
je 0x41faa7
mov al, 1
jmp 0x41faa9
xor al, al
pop esi
pop ebx
ret 4
Function at 0x4205ef
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
push str.RAM:_t
lea ecx, [ebp - 0xc]
call fcn.0041cf98
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ebx, dword [ebp - 0x24]
shr ebx, 0x14
test bl, 1
je 0x420624
inc ebx
mov esi, str._d_MB_t
push ebx
lea eax, [ebp - 0xc]
push esi
push eax
mov dword [0x47f7f0], ebx
call fcn.0041d5b5
mov eax, dword [0x47f23c]
add esp, 0xc
test eax, eax
jne 0x420656
push eax
push 0x42e7ec
lea ecx, [ebp - 0xc]
call fcn.0041d195
jmp 0x42066c
push eax
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.0041d5b5
add esp, 0xc
cmp ebx, dword [0x47f23c]
jb 0x420673
push 0x47fa04
jmp 0x42067e
inc dword [0x47f3c0]
push 0x47f9ec
lea ecx, [ebp - 0xc]
call fcn.0041d213
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.0042015f
lea ecx, [ebp - 0xc]
mov dword [0x47f3c4], ebx
call fcn.0041d05e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x420c66
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
push edi
je 0x420cfc
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x420cfc
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp + 0xc], eax
jbe 0x420cf5
push eax
call fcn.004260f9
mov esi, eax
pop ecx
test esi, esi
jne 0x420ca4
mov eax, 0x8007000e
jmp 0x420d01
push esi
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x420cee
and dword [ebp + 8], 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push 0x42cc78
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x420cee
mov eax, dword [ebp + 8]
test eax, eax
je 0x420cee
mov ecx, dword [eax + 8]
push esi
mov dword [edi + 4], ecx
mov eax, dword [eax + 0xc]
mov dword [edi], eax
call fcn.004260ee
pop ecx
xor eax, eax
jmp 0x420d01
push esi
call fcn.004260ee
pop ecx
mov eax, 0x80004005
jmp 0x420d01
mov eax, 0x80070057
pop edi
pop esi
leave
ret
Function at 0x420e1b
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
push 0x47f0bc
lea ecx, [ebp - 0x10]
call fcn.0041cffc
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
dec eax
push eax
call fcn.0041da2a
cmp al, 0x5c
je 0x420e4c
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.0041d146
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push str.Microsoft.NETFramework_
lea ecx, [ebp - 0x10]
call fcn.0041d195
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041cffc
push ebx
push 0x42cfc8
lea ecx, [ebp - 0x28]
call fcn.0041d195
push 0x140
lea eax, [ebp - 0x168]
push ebx
push eax
call fcn.00425820
add esp, 0xc
lea eax, [ebp - 0x168]
lea ecx, [ebp - 0x28]
push eax
call fcn.0041de81
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x420f89
test byte [ebp - 0x168], 0x10
je 0x420f65
cmp byte [ebp - 0x13c], 0x2e
je 0x420f65
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x1c]
push eax
call fcn.0041cffc
lea eax, [ebp - 0x13c]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041d195
push ebx
push str._system.dll
lea ecx, [ebp - 0x1c]
call fcn.0041d195
lea ecx, [ebp - 0x1c]
call fcn.0041de81
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x420f5d
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jb 0x420f5d
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x26b]
mov byte [ebp - 0x26c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x139]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.004263a0
cmp byte [ebp - 0x26c], 0x31
pop ecx
pop ecx
je 0x420f7a
cmp byte [ebp - 0x26c], 0x30
jne 0x420f5d
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x1c]
call fcn.0041d05e
lea eax, [ebp - 0x168]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jmp 0x420ead
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 1
call fcn.0041d05e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x28]
call fcn.0041d05e
lea ecx, [ebp - 0x10]
call fcn.0041d05e
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x420fa8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
and byte [ebp - 0x408], 0
push esi
push edi
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0x407]
and byte [ebp - 0x208], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
mov esi, dword [ebp + 8]
push 0x104
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x408]
mov dword [ebp + 8], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x421004
mov eax, esi
jmp 0x42118f
lea eax, [ebp - 0x408]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
lea eax, [ebp - 0x208]
push eax
call ebx
lea eax, [ebp - 0x208]
push str.d3d8.dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00420c66
pop ecx
pop ecx
push 4
test eax, eax
pop edi
jl 0x4210ad
mov eax, dword [ebp - 4]
mov esi, 0x371
mov ecx, eax
shr ecx, 0x10
cmp cx, di
jne 0x42107a
push esi
push 1
push 8
push edi
call fcn.00420d05
push edx
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00420d24
add esp, 0x20
test eax, eax
jge 0x4210a6
mov eax, dword [ebp - 4]
shr eax, 0x10
cmp ax, 5
jne 0x4210ad
push esi
push 0xa28
push 1
push 5
call fcn.00420d05
push edx
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00420d24
add esp, 0x20
test eax, eax
jl 0x4210ad
mov dword [ebp + 8], 0x10008
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x208]
push eax
call ebx
lea eax, [ebp - 0x208]
push str.dpnet.dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00420c66
pop ecx
test eax, eax
pop ecx
jl 0x42114c
mov eax, dword [ebp - 4]
mov esi, 0x86
mov ecx, eax
shr ecx, 0x10
cmp cx, di
jne 0x421119
push esi
push 0
push 9
push edi
call fcn.00420d05
push edx
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00420d24
add esp, 0x20
test eax, eax
jge 0x421145
mov eax, dword [ebp - 4]
shr eax, 0x10
cmp ax, 5
jne 0x42114c
push esi
push 0xe5d
push 2
push 5
call fcn.00420d05
push edx
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00420d24
add esp, 0x20
test eax, eax
jl 0x42114c
mov dword [ebp + 8], 0x20008
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x208]
push eax
call ebx
lea eax, [ebp - 0x208]
push str.d3d9.dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00420c66
pop ecx
pop ecx
pop ebx
test eax, eax
jl 0x42118c
mov dword [ebp + 8], 9
mov eax, dword [ebp + 8]
pop edi
pop esi
leave
ret
Function at 0x4213eb
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov dword [ebp - 0x14], ecx
xor esi, esi
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
call fcn.0041cf28
push 0x13c
call fcn.004260f9
cmp eax, esi
pop ecx
je 0x421436
push 0x1a
lea esi, [eax + 4]
pop ecx
mov edi, esi
mov dword [eax], ecx
mov ebx, ecx
mov ecx, edi
call fcn.0041cf28
add edi, 0xc
dec ebx
jne 0x421422
mov dword [ebp - 8], esi
xor esi, esi
jmp 0x421439
mov dword [ebp - 8], esi
cmp dword [ebp - 8], esi
je 0x421457
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
call esi
mov ebx, eax
push ebx
call fcn.004260f9
mov edi, eax
pop ecx
test edi, edi
jne 0x421462
inc dword [0x47f3c8]
jmp 0x421608
push edi
push ebx
call esi
push str._HD_space_placeholder_
lea ecx, [ebp - 0x4c]
mov esi, edi
call fcn.0041cf98
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x4c]
push eax
call fcn.0042015f
cmp byte [edi], 0
je 0x421554
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push esi
call fcn.0041d075
mov ecx, dword [ebp - 4]
call fcn.0041de81
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x42153a
inc dword [ebp - 0xc]
push str.
lea ecx, [ebp - 0x28]
call fcn.0041d075
push dword [ebp - 4]
lea ecx, [ebp - 0x28]
call fcn.0041d213
push 9
lea ecx, [ebp - 0x28]
call fcn.0041d146
mov ecx, dword [ebp - 4]
push 1
call fcn.0041de81
push eax
call fcn.0040e90f
mov ebx, edx
pop ecx
cmp ebx, dword [0x47f754]
pop ecx
mov dword [ebp - 0x1c], eax
ja 0x421502
jb 0x4214ff
cmp eax, dword [0x47f750]
jae 0x421502
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x34]
call fcn.0041cf28
lea eax, [ebp - 0x34]
push eax
push ebx
push dword [ebp - 0x1c]
call fcn.0041eb68
add esp, 0xc
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x28]
push eax
call fcn.0041d213
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
push eax
call fcn.0042015f
lea ecx, [ebp - 0x34]
call fcn.0041d05e
add dword [ebp - 4], 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esi + eax + 1], 0
lea esi, [esi + eax + 1]
jne 0x421490
push edi
call fcn.004260ee
pop ecx
mov ecx, dword [ebp - 8]
push 3
call fcn.0041a1c1
push 0x47fb54
lea ecx, [ebp - 0x28]
call fcn.0041d0e3
xor esi, esi
lea ecx, [ebp - 0x28]
push esi
push 0x42ea38
call fcn.0041d195
lea ecx, [ebp - 0x40]
call fcn.0041cf28
lea eax, [ebp - 0x40]
push eax
push dword [0x47f754]
push dword [0x47f750]
call fcn.0041eb68
add esp, 0xc
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
call fcn.0041d213
push 9
lea ecx, [ebp - 0x28]
call fcn.0041d146
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x10], eax
jne 0x4215cd
inc dword [0x47f3c0]
push 0x47f9ec
jmp 0x4215d2
push 0x47fa04
lea ecx, [ebp - 0x28]
call fcn.0041d213
push 1
push esi
push esi
lea ecx, [ebp - 0x28]
call fcn.0041de81
push eax
lea ecx, [ebp - 0x4c]
call fcn.0041de81
mov ecx, dword [ebp - 0x14]
push eax
call fcn.0041dd5c
lea ecx, [ebp - 0x40]
call fcn.0041d05e
lea ecx, [ebp - 0x4c]
call fcn.0041d05e
lea ecx, [ebp - 0x28]
call fcn.0041d05e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x421615
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push 0x24
lea eax, [ebp - 0x30]
push 0
mov esi, ecx
push eax
call fcn.00425820
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x47fbf0
lea ecx, [ebp - 0xc]
call fcn.0041cffc
push dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
push 0x42ea5c
push eax
call fcn.0041d5b5
add esp, 0xc
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0042015f
lea ecx, [ebp - 0xc]
call fcn.0041d05e
pop esi
leave
ret