joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4046db
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x45f05e
call fcn.0043b410
sub esp, 0x224
push ebx
push esi
lea eax, [ebp - 0x230]
push edi
xor ebx, ebx
push eax
push 0x104
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40471f
lea ecx, [ebp - 0x58]
call fcn.004048bf
lea eax, [ebp - 0x58]
push 0x46a280
push eax
call fcn.0043bb7a
push 0x24
xor eax, eax
pop ecx
lea edi, [ebp - 0x128]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
mov edi, 0x467578
mov esi, 0x467570
je 0x40485e
cmp dword [ebp - 0x11c], 1
jne 0x40485e
lea eax, [ebp - 0xe]
push ebx
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
call fcn.00405541
push str.123.tmp
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.00404ca2
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea ecx, [ebp - 0x3c]
call fcn.004058ed
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x40483d
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.00404a41
pop ecx
pop ecx
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 2
push ecx
mov ecx, eax
call fcn.00404b7e
push dword [0x467558]
mov ecx, eax
add eax, 4
mov byte [ebp - 4], 3
neg ecx
sbb ecx, ecx
push ebx
and ecx, eax
push ecx
lea ecx, [ebp - 0x38]
call fcn.004023d9
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 2
call fcn.00401279
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.00401279
push 0x4763f0
lea ecx, [ebp - 0x3c]
call fcn.00404ca2
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401b24
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c]
jmp 0x4048a8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x3c]
call fcn.004058ed
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
call fcn.00401279
lea eax, [ebp - 0xd]
push ebx
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x44], esi
call fcn.00405541
push 0x4763ec
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 4
call fcn.00404ca2
mov ecx, dword [ebp + 8]
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401b24
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x64]
call fcn.00401279
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x404a41
Capabilities:
Get common file path

Disassembly:
mov eax, 0x45f0cb
call fcn.0043b410
sub esp, 0x15c
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
push 1
mov esi, 0x104
pop ebx
cmp dword [ebp + 0xc], ebx
jne 0x404aec
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x404aec
push str.GetSystemWindowsDirectoryA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x47640c], eax
je 0x404aec
lea ecx, [ebp - 0x168]
push esi
push ecx
call eax
test eax, eax
je 0x404aec
lea eax, [ebp + 0xf]
push 0
push eax
lea eax, [ebp - 0x168]
mov edi, 0x467578
mov esi, 0x467570
push eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x44], esi
call fcn.00405541
push 0x4763ec
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], ebx
call fcn.00404ca2
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401b24
mov dword [ebp - 0x14], ebx
and byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
jmp 0x404b67
lea eax, [ebp - 0x168]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x404b14
lea ecx, [ebp - 0x30]
call fcn.004048bf
lea eax, [ebp - 0x30]
push 0x46a280
push eax
call fcn.0043bb7a
lea eax, [ebp - 0xd]
push 0
push eax
lea eax, [ebp - 0x168]
mov edi, 0x467578
mov esi, 0x467570
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
call fcn.00405541
push 0x4763ec
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 2
call fcn.00404ca2
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401b24
and byte [ebp - 4], 0
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x3c]
call fcn.00401279
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40644a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x406470
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00406182
add eax, 0x8dc64c15
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x40682a
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x406836
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x406831
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40681b
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x406823
cmp edx, ebx
jne 0x406971
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x4067f2
add eax, dword [eax + 4]
jmp 0x4067df
mov dword [ebp + 0xc], ebx
jmp 0x406841

Function at 0x40685a
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x406859
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x406877
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4068d5
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4068bc
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4068c5
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4068cf
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4068b1
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40683b
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x406922
dec eax
je 0x406919
sub eax, 3
je 0x406910
mov dword [ebp - 4], 0x40
jmp 0x40693f
mov dword [ebp - 4], 4
jmp 0x406925
mov dword [ebp - 4], 0x20
jmp 0x406925
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x406971
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4068f1
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00406182
hlt
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a1dd
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x45faab
call fcn.0043b410
mov eax, 0x10a0
call fcn.0043aff0
push ebx
push esi
xor esi, esi
push edi
lea eax, [ebp - 0x21]
mov ebx, 0x4675b0
mov edi, 0x4675a8
push esi
push eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x34], edi
call fcn.0040b2ce
or dword [ebp - 0x20], 0xffffffff
push 1
pop eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push esi
push 0x80
push 3
push esi
push eax
push SysReAllocStringLen
mov byte [ebp - 4], 2
call fcn.0040bc49
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x28], eax
je 0x40a30d
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xac]
push eax
call fcn.0043641a
pop ecx
lea eax, [ebp + 0xc]
push esi
push eax
lea eax, [ebp - 0x10ac]
push 0x1000
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a29a
push dword [ebp + 0xc]
lea eax, [ebp - 0x10ac]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.00436442
add esp, 0xc
cmp dword [ebp + 0xc], esi
ja 0x40a25e
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004364e0
movzx eax, byte [ebp - 0xd]
pop ecx
pop ecx
push eax
movzx eax, byte [ebp - 0xe]
push eax
movzx eax, byte [ebp - 0xf]
push eax
movzx eax, byte [ebp - 0x10]
push eax
movzx eax, byte [ebp - 0x11]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
movzx eax, byte [ebp - 0x15]
push eax
movzx eax, byte [ebp - 0x16]
push eax
movzx eax, byte [ebp - 0x17]
push eax
movzx eax, byte [ebp - 0x18]
push eax
movzx eax, byte [ebp - 0x19]
push eax
movzx eax, byte [ebp - 0x1a]
push eax
movzx eax, byte [ebp - 0x1b]
push eax
movzx eax, byte [ebp - 0x1c]
push eax
lea eax, [ebp - 0x54]
push str._02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X
push eax
call fcn.0040b005
add esp, 0x48
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x54]
push 0
push eax
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 0x20], edi
call fcn.0040b343
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 0x20], 0xffffffff
je 0x40a33d
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40a33d
push dword [ebp - 0x20]
call eax
and byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0040632e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x413cee
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0
je 0x413d33
mov eax, dword [ebp + 8]
test eax, eax
je 0x413d08
and dword [eax], 0
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov edi, eax
cmp edi, 0xffffffff
jne 0x413d8f
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.00413be9
lea eax, [ebp - 0x4c]
push 0x46c760
push eax
call fcn.0043bb7a
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x413d8f
cmp dword [ebp + 8], 0
jne 0x413d68
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.004138a9
lea eax, [ebp - 0x48]
push 0x46c628
push eax
call fcn.0043bb7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x413d8f
push 1
add esi, 0xc
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.00413b22
lea eax, [ebp - 0x48]
push 0x46c628
push eax
call fcn.0043bb7a
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x417186
Capabilities:
Get disk information

Disassembly:
mov eax, 0x461648
call fcn.0043b410
sub esp, 0x50
push esi
mov esi, ecx
lea eax, [ebp - 0x5c]
push edi
lea ecx, [esi + 4]
push eax
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, eax
call fcn.00403767
and dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
push 0
push ecx
mov ecx, eax
call fcn.00401e08
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00401f8a
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00401279
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00401279
cmp edi, 2
je 0x417216
cmp edi, 5
je 0x417216
cmp edi, 3
je 0x417212
cmp edi, 4
je 0x417212
cmp edi, 6
je 0x417212
mov ecx, esi
call fcn.00416fef
dec ax
neg ax
sbb eax, eax
neg eax
jmp 0x417218
xor al, al
jmp 0x417218
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x418eda
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
mov eax, 0x461a54
call fcn.0043b410
sub esp, 0x4c
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov esi, dword [edi + 0xa8]
cmp esi, eax
je 0x418fe5
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x418f23
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
push edi
push str..debug
call fcn.00419035
pop ecx
test eax, eax
pop ecx
je 0x418f4f
cmp dword [eax + 0xc], esi
jne 0x418f4f
mov ecx, dword [eax + 0x14]
mov edx, dword [edi + 0xac]
mov dword [ebp + 0xc], edx
mov edi, ecx
lea eax, [ecx + ebx]
mov dword [ebp + 0x10], edx
jmp 0x418fa2
push edi
push str..rdata
call fcn.00419035
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x418f75
push edi
push str..text
call fcn.00419035
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x418fe5
mov edi, dword [edi + 0xac]
push 0x1c
mov dword [ebp + 0x10], edi
mov eax, edi
xor edx, edx
pop edi
div edi
test eax, eax
mov dword [ebp + 0xc], eax
je 0x418fe5
sub esi, dword [ecx + 0xc]
mov eax, dword [ecx + 0x14]
lea ecx, [eax + esi]
mov edi, ecx
lea eax, [ecx + ebx]
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0x10], ecx
mov ecx, eax
sub ecx, ebx
cmp ecx, dword [ebp - 0x18]
jbe 0x418ff0
cmp dword [ebp + 8], 0
je 0x418ff0
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, edi
xor edx, edx
div dword [ebp - 0x3c]
xor edx, edx
mov esi, eax
mov eax, edi
div dword [ebp - 0x3c]
imul esi, dword [ebp - 0x3c]
add edx, dword [ebp + 0x10]
push edx
push esi
push 0
push 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x418fe9
xor eax, eax
jmp 0x419026
mov dword [ebp - 0x10], eax
sub eax, esi
add eax, edi
mov edx, dword [ebp + 0xc]
test edx, edx
jbe 0x41900f
add eax, 0x10
mov ecx, dword [eax]
mov esi, dword [eax + 8]
add esi, ecx
cmp esi, dword [ebp + 0x14]
jbe 0x419009
add dword [ebp - 0x14], ecx
add eax, 0x1c
dec edx
jne 0x418ffa
cmp dword [ebp - 0x10], 0
je 0x419023
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x419023
push dword [ebp - 0x10]
call eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41907b
Capabilities:
Create directory

Disassembly:
mov eax, 0x461a70
call fcn.0043b410
sub esp, 0x3c
push ebx
push esi
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.0041a06e
mov ecx, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 0x2c]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0041914a
mov eax, dword [eax + 0x10]
cmp eax, ebx
jne 0x4190b2
xor esi, esi
jmp 0x4190bb
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov esi, eax
lea ecx, [ebp - 0x2c]
call fcn.00419eea
push 0x5c
inc esi
pop edi
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp + 8]
push esi
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.0041a712
cmp dword [0x467f90], eax
je 0x41912d
lea esi, [eax + 1]
push ebx
push esi
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x20], 0x467f78
mov dword [ebp - 0x18], 0x467f70
call fcn.00419c24
mov dword [ebp - 0x2c], vtable.zpath.0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0041a992
push ebx
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00419eea
mov dword [ebp - 0x10], edi
jmp 0x4190ca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.0041a0f3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x41b317
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x41b32b
push 0x26
pop eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41b35f
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.00437c90
test al, al
jne 0x41b392
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.00413be9
lea eax, [ebp - 0x4c]
push 0x46c760
push eax
call fcn.0043bb7a
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41b392
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.004138a9
lea eax, [ebp - 0x48]
push 0x46c628
push eax
call fcn.0043bb7a
mov eax, dword [ebp + 8]
pop esi
leave
ret 8

Function at 0x41b39a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x41b3ae
push 6
pop eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41b3e2
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.00437c90
test al, al
jne 0x41b415
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.00413be9
lea eax, [ebp - 0x4c]
push 0x46c760
push eax
call fcn.0043bb7a
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41b415
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.004138a9
lea eax, [ebp - 0x48]
push 0x46c628
push eax
call fcn.0043bb7a
mov eax, dword [ebp + 8]
pop esi
leave
ret 8
Function at 0x41fb1f
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x462600
call fcn.0043b410
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
lea eax, [ebp - 0xd]
push 0
push eax
mov dword [esi], 0x467548
mov dword [esi + 0x20], 0x467550
call fcn.00401aaf
lea eax, [ebp - 0x20]
push 0x105
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004017a8
mov edi, eax
mov ecx, dword [edi]
mov byte [ebp - 4], 2
call fcn.00401f8a
push eax
push 0x104
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.004019fd
lea ecx, [ebp + 8]
call fcn.00401f8a
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401279
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0x28

Function at 0x41fbab
Capabilities:
Set current directory

Disassembly:
mov eax, 0x462614
call fcn.0043b410
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
cmp dword [esi + 0xc], 0
je 0x41fbd2
call fcn.00401f8a
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00401279
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x42410f
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x462d9b
call fcn.0043b410
sub esp, 0x138
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
and byte [ebp - 0x144], bl
xor eax, eax
lea edi, [ebp - 0x143]
mov dword [ebp - 0x14], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x10], ebx
test byte [ebp + 0xf], 0x80
push 1
mov eax, 0x20019
pop esi
mov dword [ebp - 4], esi
je 0x42415a
and byte [ebp + 0xf], 0x7f
mov eax, 0x20119
lea ecx, [ebp - 0x10]
push ecx
push eax
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4241a1
cmp dword [ebp + 0xc], esi
mov dword [ebp - 0x18], 0x104
mov eax, str.CommonFilesDir
je 0x42418a
mov eax, str.ProgramFilesDir
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x144]
push ecx
push ebx
push ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0xf]
push ebx
push eax
lea eax, [ebp - 0x144]
mov edi, 0x4680a4
mov esi, 0x46809c
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x20], esi
call fcn.00401721
push 0x4763ec
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00424220
mov ebx, dword [ebp + 8]
push 0
push eax
mov ecx, ebx
mov dword [ebx], edi
mov dword [ebx + 0x20], esi
call fcn.00401b24
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00401279
cmp dword [ebp - 0x10], 0
je 0x42420f
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x42420f
push dword [ebp - 0x10]
call eax
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x424847
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
mov eax, 0x462eb4
call fcn.0043b410
sub esp, 0x144
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 0
je 0x4248c3
or dword [ebp - 0x10], 0xffffffff
and dword [ebp - 4], 0
lea eax, [ebp - 0x150]
push eax
call fcn.0040bc49
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4248c3
push ebx
mov ecx, esi
mov dword [ebp - 0x10], edi
call fcn.0040bc49
mov ecx, esi
mov ebx, eax
call fcn.0040bc49
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, esi
call fcn.0040bc49
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
test eax, eax
je 0x4248c3
push edi
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x424c1c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov dword [ebx], esi
mov dword [eax], esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, esi
je 0x424cb5
push edi
call fcn.0043cd96
push edi
push esi
push eax
mov dword [ebp + 0xc], eax
call fcn.0043c590
add esp, 0x10
push dword [ebp + 0xc]
push edi
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x424cac
lea eax, [ebp - 0x3c]
push 0x34
mov dword [ebp + 8], eax
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.0043c590
add esp, 0xc
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp + 8]
push eax
push 0x476c60
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x424cac
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebx], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
push dword [ebp + 0xc]
call fcn.0043ccad
pop ecx
pop edi
pop esi
mov al, 1
pop ebx
leave
ret 0xc