joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d9bf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x44d9e6
call fcn.00452400
mov dword [eax], esi
call fcn.004523ed
push 0x16
pop esi
mov dword [eax], esi
call fcn.00454ea7
mov eax, esi
jmp 0x44da3b
test dword [ebp + 0xc], 0xfffffff9
jne 0x44d9cc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44da13
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00452413
pop ecx
call fcn.004523ed
mov eax, dword [eax]
jmp 0x44da3b
test al, 0x10
jne 0x44da39
test al, 1
je 0x44da39
test byte [ebp + 0xc], 2
je 0x44da39
call fcn.00452400
mov dword [eax], 5
call fcn.004523ed
mov dword [eax], 0xd
jmp 0x44da0a
xor eax, eax
pop esi
pop ebp
ret

Function at 0x45d09e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4997d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00452a35
and dword [ebp - 0x14], 0
cmp dword [0x49d288], 0
mov dword [ebp - 0x18], eax
jne 0x45d151
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x45d1f9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x45d1f9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x49d288], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x49d28c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x49d290], eax
call edi
push eax
call esi
mov dword [0x49d298], eax
test eax, eax
je 0x45d151
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x49d294], eax
mov eax, dword [0x49d294]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x45d1aa
cmp dword [0x49d298], ecx
je 0x45d1aa
push eax
call esi
push dword [0x49d298]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x45d1aa
test ebx, ebx
je 0x45d1aa
call edi
test eax, eax
je 0x45d1a1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x45d1a1
test byte [ebp - 8], 1
jne 0x45d1aa
or dword [ebp + 0x10], 0x200000
jmp 0x45d1dd
mov eax, dword [0x49d28c]
cmp eax, dword [ebp - 0x18]
je 0x45d1dd
push eax
call esi
test eax, eax
je 0x45d1dd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x45d1dd
mov eax, dword [0x49d290]
cmp eax, dword [ebp - 0x18]
je 0x45d1dd
push eax
call esi
test eax, eax
je 0x45d1dd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x49d288]
call esi
test eax, eax
je 0x45d1f9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x45d1fb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044b3ec
leave
ret
Function at 0x401077
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4010aa
push 0xfffffffffffffffe
pop eax
jmp 0x40121c
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + 0xa]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x4010d3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4010ef
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
lea eax, [ebp - 0x10]
push 0
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4010f7
or eax, 0xffffffff
jmp 0x40121c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi], 0x42
jne 0x401205
cmp byte [esi + 1], 0x4d
jne 0x401205
push 0
sub edi, 0xe
pop eax
je 0x401125
mov cl, byte [eax + esi + 0xe]
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x401119
cmp dword [esi + 0x10], 0
je 0x401132
push 0xfffffffffffffff0
jmp 0x401207
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
mov dword [edi + 8], eax
mov eax, dword [esi + 8]
and dword [edi + 4], 0
mov dword [edi + 0xc], eax
movzx eax, word [esi + 0xe]
dec eax
je 0x40116e
sub eax, 3
je 0x40116a
sub eax, 4
je 0x401163
sub eax, 0x10
jne 0x401205
xor eax, eax
jmp 0x401171
mov eax, 0x400
jmp 0x401171
push 0x40
jmp 0x401170
push 8
pop eax
mov ebx, dword [esi]
push 0
add ebx, eax
add ebx, esi
call dword [sym.imp.USER32.dll_GetDC]
and dword [ebp + 0xc], 0
push 0xc
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
cmp eax, 8
jne 0x40119b
mov dword [ebp + 0xc], 1
cmp word [esi + 0xe], 8
jne 0x4011ca
cmp dword [ebp + 0xc], 0
je 0x4011ca
push esi
call fcn.00401223
pop ecx
mov dword [edi + 4], eax
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SelectPalette]
push dword [ebp + 8]
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0
push esi
push ebx
push 4
push esi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [edi], eax
cmp word [esi + 0xe], 8
jne 0x4011f7
cmp dword [ebp + 0xc], 0
je 0x4011f7
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SelectPalette]
push dword [ebp + 8]
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x401208
push 0xfffffffffffffff8
pop esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40140d
Capabilities:
Get file size

Disassembly:
mov eax, 0x4618e8
call fcn.00433ae8
sub esp, 0x134
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4014da
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
push 4
push esi
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x4014d3
push edi
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
je 0x4014c9
lea eax, [ebp + 0xb]
push 1
push eax
lea ecx, [ebp - 0x3c]
push dword [ebp + 0xc]
call fcn.0040175f
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.0040198d
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.00433600
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x3c]
call fcn.00401bc2
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x14]
push edi
call fcn.004013af
add esp, 0xc
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40159c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
push 4
push esi
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
cmp ebx, esi
je 0x4015f9
push edi
push esi
push esi
push esi
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
je 0x4015f1
push dword [ebp + 0xc]
push dword [ebp - 4]
push edi
call fcn.004014ff
add esp, 0xc
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4015ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov byte [ebp - 4], 0x13
mov byte [ebp - 3], 0x35
mov byte [ebp - 2], 0x86
mov byte [ebp - 1], 7
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
push ebx
call fcn.00433b07
mov esi, eax
pop ecx
test esi, esi
je 0x40164d
xor edx, edx
test ebx, ebx
jbe 0x40164d
sub edi, esi
mov eax, edx
lea ecx, [edx + esi]
and eax, 3
mov al, byte [ebp + eax - 4]
xor al, byte [edi + ecx]
inc edx
cmp edx, ebx
mov byte [ecx], al
jb 0x401637
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4043f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x404505
cmp byte [ebp + 0xc], bl
jne 0x404470
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [edi + 1]
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x404505
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ebx
push ecx
mov eax, dword [eax]
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0xc]
test eax, eax
je 0x4044fb
call fcn.00433e50
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.004052e6
push dword [ebp + 0xc]
jmp 0x4044ed
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [edi + 3]
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x404505
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ebx
push ecx
mov eax, dword [eax]
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0xc]
test eax, eax
je 0x4044fb
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp + 8], eax
add eax, 3
and al, 0xfc
call fcn.00434210
mov edi, esp
push ebx
push ebx
push dword [ebp + 8]
mov byte [edi], bl
push edi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
call fcn.00433e50
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push edi
call fcn.004052e6
push dword [ebp + 0xc]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
jmp 0x404507
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4050e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov byte [ebp - 1], bl
je 0x40514f
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x408]
push 0x400
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 2
jb 0x405132
movzx eax, byte [ebp - 0x408]
cmp eax, 0xffffffff
jne 0x405132
movzx eax, byte [ebp - 0x407]
cmp eax, 0xfffffffe
jne 0x405132
mov byte [ebp - 1], 1
jmp 0x40514f
xor eax, eax
cmp dword [ebp - 8], ebx
jbe 0x40514f
cmp byte [ebp - 1], bl
jne 0x40514f
cmp byte [ebp + eax - 0x408], bl
sete byte [ebp - 1]
inc eax
cmp eax, dword [ebp - 8]
jb 0x405139
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, byte [ebp - 1]
pop ebx
leave
ret 4
Function at 0x407451
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0040104a
mov ecx, eax
call fcn.00426dc1
mov edi, dword [esp + 0x10]
mov esi, eax
push edi
push dword [esp + 0x18]
shr esi, 0xa
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x407492
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
push edi
mov ecx, ebx
call fcn.004074e7
test eax, eax
jne 0x4074de
push dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jle 0x4074ae
push esi
push edi
mov ecx, ebx
call fcn.004074e7
test eax, eax
jne 0x4074de
push 0x483640
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push esi
push 3
call fcn.0042f785
add esp, 0xc
test eax, eax
jge 0x4074de
push edi
push esi
push 4
call fcn.0042f785
add esp, 0xc
test eax, eax
jge 0x4074de
xor eax, eax
jmp 0x4074e1
push 1
pop eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x409d9a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x409dc0
push ebx
push ebx
call fcn.004350f5
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp + 0x10], eax
jne 0x409dd8
push ebx
push ebx
call fcn.004350f5
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, ebx
jne 0x409def
push ebx
push ebx
call fcn.004350f5
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [esi], eax
jne 0x409e05
push ebx
push ebx
call fcn.004350f5
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [esi]
call fcn.00434440
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40a2d8
Capabilities:
Copy file
Create thread

Disassembly:
mov eax, 0x462449
call fcn.00433ae8
sub esp, 0x47c
push ebx
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.0040a504
test al, al
je 0x40a30b
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x40a4ad
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x487]
mov byte [ebp - 0x488], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x488]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.0040a52c
push 1
lea eax, [ebp + 0xb]
pop edi
lea ecx, [ebp - 0x60]
push edi
push eax
lea eax, [ebp - 0x488]
push eax
call fcn.0040175f
lea eax, [ebp - 0x60]
lea ecx, [esi + 0x90]
push eax
mov dword [ebp - 4], ebx
call fcn.0040950c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.00401bc2
lea eax, [ebp + 0xf]
push edi
push eax
lea ecx, [ebp - 0x88]
push dword [ebp + 0xc]
call fcn.0040175f
lea eax, [ebp - 0x88]
lea ecx, [esi + 0xb8]
push eax
mov dword [ebp - 4], edi
call fcn.0040950c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.00401bc2
push 0x2c
call fcn.00433b07
pop ecx
mov dword [ebp + 8], eax
cmp eax, ebx
mov dword [ebp - 4], 2
je 0x40a3d4
lea ecx, [esi + 0x90]
call fcn.00408ddc
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
push 4
push esi
push eax
call fcn.0040a4bd
jmp 0x40a3d6
xor eax, eax
mov dword [esi + 0xe0], eax
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
push eax
push ebx
push esi
push 0x40a282
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 4
mov dword [ebp + 8], eax
call fcn.00433b07
pop ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
push 0xff
push 0xffffffffffffffff
push ebx
mov dword [eax], ecx
push eax
push edi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, edi
mov dword [ebp - 0x10], eax
jne 0x40a45f
push edi
push ebx
push ebx
lea eax, [ebp - 0x38]
push ebx
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40a452
cmp dword [ebp - 0x34], 0x8032
jne 0x40a446
mov ecx, dword [esi + 0xe0]
call fcn.0040a93e
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40a420
push 0xff
push 0xffffffffffffffff
push ebx
push dword [ebp - 0x14]
jmp 0x40a412
push dword [ebp - 0x14]
call fcn.0043311a
mov esi, dword [esi + 0xe0]
pop ecx
cmp esi, ebx
pop edi
je 0x40a482
lea ecx, [esi + 8]
call fcn.0040a688
push esi
call fcn.0043311a
pop ecx
cmp dword [ebp - 0x10], 0xffffffff
jne 0x40a48c
xor eax, eax
jmp 0x40a4ad
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x18], ebx
setge al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x40a8d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x10]
test ebx, ebx
jne 0x40a8e9
xor esi, esi
jmp 0x40a916
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.00434210
xor eax, eax
mov esi, esp
push eax
push eax
and byte [esi], 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40a934
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x64
jl 0x40a8db
lea esp, [ebp - 0x10]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b55e
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4625e3
call fcn.00433ae8
sub esp, 0x27c
push ebx
push esi
lea eax, [ebp - 0x184]
push edi
xor ebx, ebx
push eax
mov esi, ecx
push 0x104
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x80]
lea ecx, [esi + 8]
push eax
mov dword [ebp - 0x10], ecx
call fcn.0040bc27
mov edi, eax
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.0040ba49
mov edi, dword [edi + 4]
lea eax, [ebp - 0x288]
push eax
push ebx
lea eax, [ebp - 0x184]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], bl
call fcn.0040a688
lea eax, [ebp - 0x288]
push ebx
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x24], 0x469604
mov dword [ebp - 0x1c], 0x4695fc
call fcn.0040b777
mov edi, 0x4695f8
mov dword [ebp - 0x30], edi
cmp byte [esi + 0x28], bl
mov dword [ebp - 4], 2
je 0x40b67b
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
push eax
call fcn.0040bc27
mov esi, eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0040ba49
push dword [esi + 4]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x184]
push eax
call esi
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.0040a688
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.0040be75
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 4
call fcn.0040ba49
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
lea eax, [ebp - 0x184]
push eax
call esi
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.0040a688
lea eax, [ebp - 0x184]
lea ecx, [ebp - 0x30]
push eax
call fcn.0040bbe2
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x30]
push ebx
push eax
mov ecx, esi
mov dword [esi + 0xc], 0x469604
mov dword [esi + 0x14], 0x4695fc
call fcn.0040b846
mov dword [esi], edi
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.0040a688
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40f805
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x40f91a
cmp byte [ebp + 0xc], bl
jne 0x40f885
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [edi + 1]
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x40f91a
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ebx
push ecx
mov eax, dword [eax]
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0xc]
test eax, eax
je 0x40f910
call fcn.00433e50
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.00403ccb
push dword [ebp + 0xc]
jmp 0x40f902
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [edi + 3]
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x40f91a
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ebx
push ecx
mov eax, dword [eax]
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0xc]
test eax, eax
je 0x40f910
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp + 8], eax
add eax, 3
and al, 0xfc
call fcn.00434210
mov edi, esp
push ebx
push ebx
push dword [ebp + 8]
mov byte [edi], bl
push edi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
call fcn.00433e50
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push edi
call fcn.00403ccb
push dword [ebp + 0xc]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
jmp 0x40f91c
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40fff2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov byte [ebp - 1], bl
je 0x410061
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x408]
push 0x400
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 2
jb 0x410044
movzx eax, byte [ebp - 0x408]
cmp eax, 0xffffffff
jne 0x410044
movzx eax, byte [ebp - 0x407]
cmp eax, 0xfffffffe
jne 0x410044
mov byte [ebp - 1], 1
jmp 0x410061
xor eax, eax
cmp dword [ebp - 8], ebx
jbe 0x410061
cmp byte [ebp - 1], bl
jne 0x410061
cmp byte [ebp + eax - 0x408], bl
sete byte [ebp - 1]
inc eax
cmp eax, dword [ebp - 8]
jb 0x41004b
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, byte [ebp - 1]
pop ebx
leave
ret 4
Function at 0x412825
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x47ba50
push SysFreeString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41287c
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push 0x4836ec
push 0
push 0
push 0x47ba3c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x412873
mov byte [0x4846f0], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret