joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418d5f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x28]
cmp dword [eax + 0x3dc], 0
je 0x418ee7
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x418ee7
mov edi, dword [ebp + 8]
test edi, edi
je 0x418ee7
cmp dword [esi + 0xac], edi
lea eax, [esi + 0xac]
je 0x418ee7
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [eax], edi
test byte [0x451b34], 1
jne 0x418dca
or byte [0x451b34], 1
call ebx
mov dword [0x451b30], eax
call ebx
mov ecx, eax
sub ecx, dword [0x451b30]
cmp byte [0x44d994], 0
mov dword [0x451b30], eax
jne 0x418deb
cmp ecx, 0x64
jb 0x418ee7
and byte [0x44d994], 0
xor ebx, ebx
cmp edi, 0x100000
lea edi, [edi + edi*4]
setle bl
dec ebx
push 1
and ebx, 0xa
add ebx, 0xa
shl edi, 1
mov cl, bl
sar edi, cl
lea ecx, [ebp - 0x64]
call fcn.00402749
push 0
lea eax, [ebp - 0x64]
push 0xffffffffffffffff
push eax
mov ecx, dword [esi + 0xc]
xor eax, eax
cmp bx, 0x14
setne al
add eax, 0x4e
push eax
call fcn.00419b9f
push 1
lea ecx, [ebp - 0x48]
call fcn.00402749
mov ecx, dword [esi + 0xc]
push 0
lea eax, [ebp - 0x48]
push 0xffffffffffffffff
push eax
push 0x50
call fcn.00419b9f
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402749
lea ecx, [ebp - 0x48]
call fcn.00402db3
mov ebx, dword [ebp - 0x44]
lea ecx, [ebp - 0x64]
call fcn.00402db3
push ebx
lea eax, [ebp - 0x2c]
push dword [ebp - 0x60]
mov dword [ebp - 8], eax
mov eax, edi
xor edx, edx
push 0xa
and byte [ebp - 0xc], 0
pop ecx
and dword [ebp - 4], 0
div ecx
mov eax, edi
mov dword [ebp - 0x10], 0x20
push edx
xor edx, edx
div ecx
lea ecx, [ebp - 0x10]
push eax
push 0x44d934
call fcn.00402733
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea ecx, [ebp - 0x10]
call fcn.00402a34
lea ecx, [ebp - 0x2c]
call fcn.00402db3
push dword [ebp - 0x28]
push 0x9108
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea ecx, [ebp - 0x2c]
call fcn.00402818
lea ecx, [ebp - 0x48]
call fcn.00402818
lea ecx, [ebp - 0x64]
call fcn.00402818
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4

Function at 0x41a29f
Capabilities:
Write file on windows

Disassembly:
push 0x4000
push dword [esp + 8]
push dword [0x451b68]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp fcn.0041a2b9
Function at 0x41a2b9
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x443ce0
call fcn.00421898
sub esp, 0x34
push ebx
push esi
push dword [0x451b64]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [ebp - 0x40]
call fcn.00407a28
push 4
xor ebx, ebx
sub esp, 0x1c
mov ecx, 0x451b3c
mov esi, esp
mov dword [ebp - 0x14], esp
push 1
mov dword [ebp - 4], ebx
call fcn.0040716d
push eax
mov ecx, esi
call fcn.0040713c
lea ecx, [ebp - 0x40]
call fcn.0040808d
cmp al, bl
je 0x41a36c
push dword [0x451b68]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 2
push ebx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x10], eax
call fcn.0040ce3c
lea eax, [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
push eax
lea eax, [ebp - 0x10]
push 4
push eax
push dword [ebp - 0x3c]
call esi
push 0x21
lea ecx, [ebp - 0x14]
push dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push dword [0x451b68]
call fcn.004206bc
mov eax, dword [0x451b68]
lea ecx, [ebp - 0x18]
push ebx
push ecx
push dword [ebp - 0x10]
push eax
push dword [ebp - 0x3c]
call esi
lea ecx, [ebp - 0x40]
call fcn.00407f58
push dword [0x451b64]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x40], 0x4465c8
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 1
call fcn.00407f58
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0040252a
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x41a658
Capabilities:
Create directory

Disassembly:
mov eax, 0x443d5c
call fcn.00421898
sub esp, 0x60
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x6c]
push ebx
push ebx
push eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.0040406b
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00403aeb
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], bl
call fcn.0040e0a8
lea eax, [ebp - 0x6c]
lea ecx, [ebp + 8]
push eax
call fcn.00405303
lea ecx, [ebp - 0x6c]
call fcn.0040e0a8
lea ecx, [ebp + 8]
mov dword [0x451b9c], ebx
call fcn.00404c32
mov byte [ebp - 0xd], al
lea eax, [ebp - 0xe]
mov edi, 0x4465a8
mov esi, 0x4465a0
push ebx
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x24], esi
call fcn.00403e8f
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 1
push 1
lea eax, [ebp - 0x1c]
push dword [ebp - 0x14]
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x1c], 0x5c
push eax
call fcn.00404618
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
je 0x41a774
sub eax, dword [ebp - 0x14]
lea ecx, [ebp + 8]
inc eax
push eax
lea eax, [ebp - 0x6c]
push dword [ebp - 0x14]
push eax
call fcn.0041af6f
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 3
call fcn.0041afa3
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 2
call fcn.0040e0a8
mov eax, dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x18], 1
mov dword [ebp - 0x14], eax
jle 0x41a774
cmp dword [ebp - 0x18], 2
jg 0x41a748
cmp byte [ebp - 0xd], bl
jne 0x41a774
push ebx
lea ecx, [ebp - 0x44]
call fcn.00405033
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41a774
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov dword [0x451b9c], eax
jne 0x41a7ae
mov dword [0x451b9c], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x41a6e3
mov byte [ebp - 0xd], 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], bl
call fcn.0040e0a8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040e0a8
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
sub esp, 0x28
lea eax, [ebp - 0x44]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00403eea
call fcn.0041a7d2
add esp, 0x28
mov byte [ebp - 0xd], bl
jmp 0x41a785
Function at 0x41aeac
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x443ecc
call fcn.00421898
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
push 0x20019
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.00405033
push eax
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
call fcn.0040a091
cmp eax, ebx
je 0x41aeff
cmp dword [ebp - 0x10], ebx
mov dword [0x451b9c], eax
je 0x41aefa
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 0x5c]
jmp 0x41af40
lea ecx, [ebp + 0x34]
call fcn.00405033
lea ecx, [ebp + 8]
mov dword [ebp - 0x14], ebx
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push ebx
push eax
mov dword [ebp + 8], 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x41aee4
cmp dword [ebp - 0x10], ebx
mov esi, dword [ebp - 0x18]
je 0x41af40
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.0040e0a8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x34]
call fcn.0040e0a8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41cfca
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
push ebx
push edi
mov edi, ecx
mov dword [ebp - 0x10], 1
call fcn.0041d1b0
xor ebx, ebx
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x41d07e
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41d070
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push ebx
push str.ProxyEnable
mov dword [ebp - 8], 4
push dword [ebp - 4]
call esi
test eax, eax
je 0x41d034
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x824
push eax
lea eax, [ebp - 0x838]
push eax
push ebx
push ebx
push str.AutoConfigURL
push dword [ebp - 4]
call esi
test eax, eax
pop esi
je 0x41d05d
mov byte [ebp - 0x838], bl
cmp dword [ebp - 0xc], ebx
jne 0x41d06a
cmp byte [ebp - 0x838], bl
je 0x41d070
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], ebx
je 0x41d07e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0041cc42
add esp, 0x14
cmp dword [ebp + 0xc], ebx
mov dword [edi + 4], eax
je 0x41d0a3
cmp dword [ebp + 0xc], 4
jne 0x41d0cf
cmp dword [ebp - 0x14], ebx
jne 0x41d0cf
mov ax, word [edi + 0x14]
cmp ax, 3
jne 0x41d0bb
mov ecx, edi
call fcn.0041d613
jmp 0x41d0cf
cmp ax, 4
mov ecx, edi
jne 0x41d0ca
call fcn.0041d7f4
jmp 0x41d0cf
call fcn.0041dbc8
xor eax, eax
cmp dword [edi + 4], ebx
pop edi
pop ebx
setne al
leave
ret 0x14
Function at 0x41d613
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1190
call fcn.00420c00
and byte [ebp - 0x96c], 0
push ebx
push esi
mov dword [ebp - 0x10], ecx
mov edx, 0x208
push edi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x96b]
and byte [ebp - 0x1190], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x118f]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push str.SOFTWARENetscapeNetscape_NavigatorProxy_Information
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41d7e1
lea eax, [ebp - 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push str.Proxy_Type
push dword [ebp - 4]
mov dword [ebp - 0x48], str.http
mov dword [ebp - 0x44], str.HTTP_Proxy
mov dword [ebp - 0x40], str.HTTP_ProxyPort
mov dword [ebp - 0x3c], str.https
mov dword [ebp - 0x38], str.HTTPS_Proxy
mov dword [ebp - 0x34], str.HTTPS_ProxyPort
mov dword [ebp - 0x30], str.ftp
mov dword [ebp - 0x2c], str.FTP_Proxy
mov dword [ebp - 0x28], str.FTP_ProxyPort
mov dword [ebp - 8], 4
call ebx
test eax, eax
jne 0x41d7e1
cmp dword [ebp - 0x14], 1
jne 0x41d7e1
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edi, [ebp - 0x48]
mov dword [ebp - 0xc], 3
lea eax, [ebp - 8]
mov dword [ebp - 8], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x148]
push eax
push 0
push 0
push dword [edi + 4]
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x41d7a4
cmp byte [ebp - 0x148], al
je 0x41d7a4
push dword [edi]
lea eax, [ebp - 0x96c]
push eax
call esi
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x96c]
push eax
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push dword [edi + 8]
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x41d796
lea eax, [ebp - 0x96c]
push 0x44e22c
push eax
call esi
push dword [ebp - 0x18]
lea eax, [ebp - 0x96c]
push 0x44ca84
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x96c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x96c]
push 0x44e228
push eax
call esi
add edi, 0xc
dec dword [ebp - 0xc]
jne 0x41d6fa
lea eax, [ebp - 0x96c]
push 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1190]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x10]
push 0x26
mov dword [ebp - 0x24], 3
push dword [eax + 4]
call fcn.0041ce1b
add esp, 0x10
xor esi, esi
cmp dword [ebp - 4], esi
je 0x41d7ef
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e768
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 0xf4]
cmp eax, 0x7530
jbe 0x41e7cb
mov ecx, dword [esi + 0xe8]
lea eax, [esi + 0xe8]
mov edx, dword [esi + 0xf0]
mov dword [esi + 0xdc], ecx
xor ecx, ecx
mov dword [esi + 0xe4], edx
mov dword [eax], ecx
lea eax, [esi + 0xf0]
mov edx, dword [esi + 0xec]
mov dword [esi + 0xec], ecx
mov dword [eax], ecx
lea eax, [esi + 0xec]
mov dword [esi + 0xe0], edx
call edi
mov dword [esi + 0xf4], eax
mov edi, dword [esi + 0xe4]
test edi, edi
jne 0x41e7dd
mov eax, dword [esi + 0xdc]
jmp 0x41e835
push ebx
push ebp
push 0xa
xor eax, eax
pop ecx
xor ebp, ebp
test eax, eax
jne 0x41e833
or eax, 0xffffffff
xor edx, edx
div ecx
mov ebx, dword [esi + 0xdc]
cmp ebx, eax
jbe 0x41e80b
shr ebx, 1
shr edi, 1
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe4], edi
mov eax, dword [esi + 0xdc]
mov edi, dword [esi + 0xe4]
imul eax, ecx
xor edx, edx
div edi
xor edx, edx
imul eax, eax, 0x3e8
div ecx
lea ecx, [ecx + ecx*4]
inc ebp
shl ecx, 1
cmp ebp, 3
jb 0x41e7e6
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x41ef83
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
push ebx
push 8
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41efea
call esi
cmp eax, 0x3f0
jne 0x41efdd
lea eax, [ebp - 4]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call esi
cmp eax, 0x78
jne 0x41efe6
push 1
jmp 0x41f009
cmp eax, ebx
je 0x41f008
lea eax, [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push eax
push ebx
push ebx
push 2
push dword [ebp - 4]
call edi
test eax, eax
jne 0x41f008
call esi
cmp eax, 0x7a
je 0x41f018
push ebx
push dword [ebp - 4]
call fcn.0041ef74
pop ecx
pop ecx
jmp 0x41f0ff
push dword [ebp - 8]
call fcn.00420be5
mov esi, eax
pop ecx
lea eax, [ebp - 8]
cmp esi, ebx
push eax
push dword [ebp - 8]
setne byte [ebp - 0x20]
push esi
push 2
push dword [ebp - 4]
call edi
test eax, eax
jne 0x41f05e
push ebx
push dword [ebp - 4]
call fcn.0041ef74
cmp byte [ebp - 0x20], bl
pop ecx
pop ecx
mov byte [ebp + 0xb], al
je 0x41f056
push esi
call fcn.00420754
pop ecx
mov al, byte [ebp + 0xb]
jmp 0x41f0ff
lea eax, [ebp - 0xc]
push eax
mov al, byte [ebp + 8]
neg al
push ebx
push ebx
sbb eax, eax
push ebx
and al, 0xfd
push ebx
push ebx
add eax, 0x223
push ebx
push eax
push 0x20
lea eax, [ebp - 0x18]
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x41f0a8
push ebx
push dword [ebp - 4]
call fcn.0041ef74
cmp byte [ebp - 0x20], bl
pop ecx
pop ecx
mov byte [ebp + 0xb], al
je 0x41f0a3
push esi
call fcn.00420754
pop ecx
mov al, byte [ebp + 0xb]
jmp 0x41f0ff
cmp dword [esi], ebx
mov byte [ebp - 0x10], bl
mov dword [ebp + 8], ebx
jbe 0x41f0d7
lea edi, [esi + 4]
push dword [ebp - 0xc]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x41f0d3
inc dword [ebp + 8]
add edi, 8
mov eax, dword [ebp + 8]
cmp eax, dword [esi]
jb 0x41f0b5
jmp 0x41f0d7
mov byte [ebp - 0x10], 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.0041ef74
cmp byte [ebp - 0x20], bl
pop ecx
pop ecx
mov byte [ebp + 0xb], al
je 0x41f0fc
push esi
call fcn.00420754
pop ecx
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41f14f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push ebx
push eax
mov ebx, ecx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 4], eax
je 0x41f1a1
push eax
call fcn.00420be5
pop ecx
mov dword [ebx + 0x40], eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x41f1a1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x44caa4
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x41f1a5
xor al, al
jmp 0x41f206
push esi
push edi
mov edi, ebx
lea eax, [ebx + 4]
neg edi
sbb edi, edi
mov esi, dword [ebp - 0xc]
push 0xd
and edi, eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
pop edi
pop esi
test eax, eax
je 0x41f204
mov eax, dword [ebp - 4]
shr eax, 2
mov dword [ebx + 0x3c], eax
shl eax, 2
push eax
call fcn.00420be5
mov dword [ebx + 0x38], eax
xor eax, eax
cmp dword [ebx + 0x3c], eax
pop ecx
jbe 0x41f204
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 0x3c]
jb 0x41f1f2
mov al, 1
pop ebx
leave
ret 4
Function at 0x41f20b
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, 0x443fd3
call fcn.00421898
sub esp, 0x1dc
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
call fcn.0041f4e7
test al, 0x10
pop ecx
je 0x41f386
push 1
lea eax, [ebp + 8]
pop edi
push 0x44dbe0
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0040b46f
add esp, 0xc
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], 1
push ecx
mov ecx, eax
call fcn.0040cea0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
call fcn.0040e0a8
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 0xffffffff
je 0x41f331
test edi, edi
je 0x41f32a
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [ebp - 0x1bc]
push 0x44dbd8
push eax
call edi
test eax, eax
je 0x41f315
lea eax, [ebp - 0x1bc]
push 0x44dbd4
push eax
call edi
test eax, eax
je 0x41f315
lea eax, [ebp - 0x11]
push 0
push eax
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x446878
mov dword [ebp - 0x20], 0x446870
call fcn.0040cb18
sub esp, 0x28
lea ecx, [ebp - 0x40]
mov eax, esp
mov dword [ebp - 0x18], esp
push ecx
lea ecx, [ebp + 8]
push ecx
push eax
mov byte [ebp - 4], 4
call fcn.0041f3bb
add esp, 0xc
call fcn.0041f20b
add esp, 0x28
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.0040e0a8
lea eax, [ebp - 0x1e8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, eax
jmp 0x41f28f
push esi
call ebx
or dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040cea0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x41f360
lea eax, [ebp + 8]
push 1
push eax
lea ecx, [ebp - 0x60]
call fcn.0041f434
lea eax, [ebp - 0x60]
push 0x4485c8
push eax
call fcn.004226d7
cmp dword [ebp - 0x10], 0xffffffff
je 0x41f36b
push dword [ebp - 0x10]
call ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040e0a8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
lea ecx, [ebp + 8]
call fcn.0040cea0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x41f36b
lea eax, [ebp + 8]
push 1
push eax
lea ecx, [ebp - 0xa8]
call fcn.0041f434
lea eax, [ebp - 0xa8]
push 0x4485c8
push eax
call fcn.004226d7

Function at 0x41f4e7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov ecx, dword [ebp + 8]
call fcn.0040cea0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41f51c
push 1
lea ecx, [ebp - 0x48]
push dword [ebp + 8]
call fcn.0041f434
lea eax, [ebp - 0x48]
push 0x4485c8
push eax
call fcn.004226d7
leave
ret
Function at 0x41ff24
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4440e0
call fcn.00421898
sub esp, 0x250
lea eax, [ebp - 0x25c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x41ffe2
and byte [ebp - 0x158], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x157]
rep stosd dword es:[edi], eax
push dword [0x44e5b4]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x158]
push 0x44c3f4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x54]
call fcn.0040e9b4
and dword [ebp - 4], 0
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x54]
call fcn.0041f14f
mov eax, dword [ebp - 0x48]
pop edi
shr eax, 0x10
cmp ax, 4
jne 0x41ffcf
cmp word [ebp - 0x48], 0x5a
jne 0x41ffcf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], 0x44717c
call fcn.0040ea11
push 1
pop eax
jmp 0x41ffe4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], 0x44717c
call fcn.0040ea11
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x4204dc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, 0x104
lea eax, [ebp - 0x104]
push esi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor ecx, ecx
xor eax, eax
cmp ecx, esi
pop esi
jae 0x420510
cmp byte [ebp - 0x104], cl
je 0x420510
push 1
pop eax
push eax
push 0
push 0x465
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
leave
ret
Function at 0x420523
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.USER32.dll_CharNextA]
push edi
mov ebx, eax
call esi
cmp ebx, 1
jle 0x420566
mov cl, byte [eax]
cmp cl, 0x3a
jne 0x42056d
mov cl, byte [edi]
cmp cl, 0x61
jl 0x42055c
cmp cl, 0x7a
jle 0x420596
cmp cl, 0x41
jl 0x420566
cmp cl, 0x5a
jle 0x420596
xor al, al
pop edi
pop esi
pop ebx
leave
ret
cmp byte [edi], 0x5c
jne 0x420566
cmp cl, 0x5c
jne 0x420566
xor edi, edi
push eax
call esi
mov cl, byte [eax]
cmp cl, 0x5c
jne 0x420584
inc edi
cmp edi, 2
je 0x420596
test cl, cl
jne 0x420579
cmp edi, 2
je 0x420596
cmp byte [eax], cl
jne 0x420566
push eax
call esi
and byte [ebp - 0x104], 0
push 0x40
mov ebx, eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, ebx
sub eax, dword [ebp + 8]
inc eax
push eax
lea eax, [ebp - 0x104]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x420566
shr eax, 4
and al, 1
mov byte [ebp + 0xb], al
je 0x420566
mov al, byte [ebx]
test al, al
je 0x420637
movsx eax, al
cmp eax, 0x3a
jg 0x420610
je 0x420566
cmp eax, 0x22
je 0x420566
cmp eax, 0x2a
je 0x420566
cmp eax, 0x2f
jmp 0x42062a
cmp eax, 0x3c
je 0x420566
cmp eax, 0x3d
jle 0x420630
cmp eax, 0x3f
jle 0x420566
cmp eax, 0x7c
je 0x420566
push ebx
call esi
mov ebx, eax
jmp 0x4205e5
mov al, 1
jmp 0x420568