joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ba8d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
push ebx
push edi
test eax, eax
jl 0x40bc36
cmp eax, dword [esi + 0x50]
jge 0x40bc36
mov edx, dword [ebp + 0x10]
test edx, edx
jl 0x40bc36
mov edi, dword [ebp + 0xc]
jg 0x40bac1
test edi, edi
jb 0x40bc36
test edx, edx
jl 0x40bad9
jg 0x40bacb
test edi, edi
jbe 0x40bad9
mov ecx, dword [esi + 0x60]
imul eax, eax, 0x18
mov dword [ecx + eax + 0x10], edi
mov dword [ecx + eax + 0x14], edx
lea ebx, [esi + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x14]
add dword [esi + 0x10], eax
mov eax, dword [ebp + 0x18]
push ebx
adc dword [esi + 0x14], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.0040cfe0
test eax, eax
je 0x40bc36
push edi
push 5
push dword [esi + 0xa0]
push dword [ebp + 8]
push esi
call fcn.0040d492
xor edi, edi
cmp dword [esi + 0x54], edi
je 0x40bc36
cmp dword [esi + 0x50], edi
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x10], edi
jle 0x40bb7d
mov dword [ebp + 8], edi
mov eax, dword [esi + 0x58]
add eax, dword [ebp + 8]
call fcn.00406cf2
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
sub ebx, eax
mov eax, dword [esi + 0x58]
sbb edi, edx
add eax, dword [ebp + 8]
call fcn.00406d80
add eax, ebx
adc edx, edi
inc dword [ebp + 0x10]
add dword [ebp + 8], 0x128
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x10]
cmp eax, dword [esi + 0x50]
mov dword [ebp + 0x18], edx
jl 0x40bb3f
xor edi, edi
mov eax, esi
call fcn.0040cec4
cmp edx, edi
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
jl 0x40bc36
jg 0x40bb9c
cmp eax, edi
jbe 0x40bc36
mov ebx, eax
sub ebx, dword [ebp + 0x14]
mov eax, edx
sbb eax, dword [ebp + 0x18]
push 0x20
mov dword [ebp + 0x18], eax
call fcn.0044c232
pop ecx
cmp eax, edi
je 0x40bbc8
mov dword [eax + 0x18], edi
mov dword [eax], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov edi, eax
mov eax, dword [esi + 0xa0]
mov dword [edi], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0xc], eax
call ebx
sub eax, dword [esi + 0x38]
jne 0x40bbf7
and dword [edi + 0x18], eax
jmp 0x40bc0e
push 0
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0045c110
imul eax, eax, 0x3e8
mov dword [edi + 0x18], eax
call ebx
mov ecx, dword [esi + 0xac]
add ecx, 0x64
cmp eax, ecx
jbe 0x40bc36
push edi
push 3
push dword [esi + 0xa0]
push 0xffffffffffffffff
push esi
call fcn.0040d492
call ebx
mov dword [esi + 0xac], eax
pop edi
pop ebx
leave
ret 0x14
Function at 0x40c3ea
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c
mov eax, 0x46e9b8
call fcn.00451557
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.0040c22a
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push connect
mov dword [ebp - 4], ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x10], edi
cmp edi, 0xffffffff
je 0x40c519
lea eax, [ebp - 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40c519
push 0xfffffffffffffffc
pop eax
push 2
lea edx, [ebp - 0x30]
push edx
or ecx, 0xffffffff
push ecx
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
call edi
test eax, eax
je 0x40c519
push 0
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], ebx
push 4
lea ebx, [esi + 0x5c]
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40c519
cmp dword [ebp - 0x14], 4
jne 0x40c519
mov eax, dword [ebx]
test eax, eax
jbe 0x40c519
cmp eax, 0x3f
ja 0x40c519
test eax, eax
jle 0x40c4a7
mov ecx, esi
call fcn.0040b4d3
jmp 0x40c4a9
xor eax, eax
test eax, eax
je 0x40c519
push esi
call fcn.0040bc3c
test eax, eax
je 0x40c519
mov ecx, dword [esi + 0x50]
imul ecx, ecx, 0x18
push 0xfffffffffffffffc
pop eax
push 2
sub eax, ecx
cdq
lea ecx, [ebp - 0x38]
push ecx
push edx
push eax
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x40c519
xor edi, edi
push edi
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esi + 0x50]
imul eax, eax, 0x18
push eax
push dword [esi + 0x60]
mov dword [ebp - 0x18], edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov eax, dword [esi + 0x50]
je 0x40c509
imul eax, eax, 0x18
cmp dword [ebp - 0x18], eax
jne 0x40c50c
mov dword [ebp - 0x20], 1
jmp 0x40c519
imul eax, eax, 0x18
push eax
push edi
push dword [esi + 0x60]
call fcn.00451670
add esp, 0xc
cmp dword [ebp - 0x10], 0
je 0x40c52e
cmp dword [ebp - 0x10], 0xffffffff
je 0x40c52e
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004026ee
mov eax, dword [ebp - 0x20]
call fcn.0045162f
ret
Function at 0x40c542
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x54]
sub esp, 0x28
push ebx
push edi
xor edi, edi
cmp eax, edi
je 0x40c662
cmp dword [eax + 0x74], edi
jne 0x40c564
xor eax, eax
inc eax
jmp 0x40c664
lea eax, [ebp - 4]
push eax
push esi
call fcn.0040c22a
push edi
push 0x80
push 3
push edi
push 3
push 0xc0000000
push dword [ebp - 4]
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40c657
cmp dword [esi + 0x5c], edi
je 0x40c64c
cmp dword [esi + 0x60], edi
je 0x40c64c
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40c631
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0xfffffffffffffffc
pop eax
push 2
lea edx, [ebp - 0x20]
push edx
or ecx, 0xffffffff
push ecx
push eax
push ebx
call edi
test eax, eax
je 0x40c631
and dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [esi + 0x5c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40c5f0
test ebx, ebx
jmp 0x40c64e
mov ecx, dword [esi + 0x50]
imul ecx, ecx, 0x18
push 0xfffffffffffffffc
pop eax
push 2
sub eax, ecx
cdq
lea ecx, [ebp - 0x28]
push ecx
push edx
push eax
push ebx
call edi
test eax, eax
je 0x40c631
and dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x50]
imul eax, eax, 0x18
push eax
push dword [esi + 0x60]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c5ec
mov dword [ebp - 8], 1
test ebx, ebx
je 0x40c63c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004026ee
mov eax, dword [ebp - 8]
jmp 0x40c664
cmp ebx, edi
je 0x40c657
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004026ee
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x40eb59
Capabilities:
Read file on windows

Disassembly:
push ebp
sub esp, 0xf0
lea ebp, [esp - 4]
mov eax, dword [0x487ba4]
xor eax, ebp
mov dword [ebp + 0xf0], eax
push 0x38
mov eax, 0x46b9b0
call fcn.00451557
mov eax, dword [ebp + 0x100]
push 0x47a554
push dword [ebp + 0xfc]
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x28], edi
call fcn.0044e097
mov ebx, eax
pop ecx
pop ecx
mov dword [ebp - 0x20], ebx
test ebx, ebx
jne 0x40ebd4
test esi, esi
je 0x40ebcd
lea ecx, [ebp - 0x44]
call fcn.0040f570
and dword [ebp - 4], ebx
push 0xffffffffffffffff
push esi
call fcn.00401dec
push ebx
push 1
lea esi, [ebp - 0x44]
call fcn.00401e74
xor al, al
jmp 0x40ecd0
test edi, edi
je 0x40ebdf
mov eax, dword [edi]
mov dword [ebp - 0x1c], eax
jmp 0x40ebe3
and dword [ebp - 0x1c], 0
mov esi, dword [ebp - 0x18]
push 9
xor eax, eax
pop ecx
mov word [ebp + 0xc8], ax
lea edi, [ebp + 0xca]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xffffffffffffffff
xor edi, edi
call fcn.00401edf
push 2
push edi
push ebx
call fcn.0044e138
push ebx
call fcn.0044e35a
push edi
mov esi, eax
push edi
push ebx
mov dword [ebp - 0x24], esi
call fcn.0044e138
add esp, 0x1c
test esi, esi
je 0x40ec8f
push esi
call fcn.0044bd5e
push ebx
push 1
push esi
push eax
mov dword [ebp - 0x10], eax
call fcn.0044e668
push esi
push dword [ebp - 0x10]
xor ebx, ebx
call fcn.0040f333
mov edi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd5e
push esi
push dword [ebp - 0x10]
mov ebx, eax
call fcn.0040f333
mov esi, dword [ebp - 0x18]
add esp, 0x28
mov eax, edi
mov ecx, ebx
call fcn.00404293
push ebx
call fcn.0044c7ac
push dword [ebp - 0x10]
call fcn.0044c7ac
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
pop ecx
pop ecx
push edi
push esi
lea eax, [ebp + 0xc8]
push eax
lea eax, [ebp]
push str._s_d_bytes_to__d_wide_chars
push eax
call fcn.0044e685
add esp, 0x14
cmp dword [ebp - 0x14], 0
je 0x40ecbb
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call fcn.00403f6b
push ebx
call fcn.0044e794
mov eax, dword [ebp - 0x28]
pop ecx
test eax, eax
je 0x40ecce
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xf0]
xor ecx, ebp
call fcn.0044c18b
add ebp, 0xf4
leave
ret
Function at 0x40ecf3
Capabilities:
Write file on windows

Disassembly:
push ebp
sub esp, 0xf0
lea ebp, [esp - 4]
mov eax, dword [0x487ba4]
xor eax, ebp
mov dword [ebp + 0xf0], eax
push 0x54
mov eax, 0x46b980
call fcn.00451557
mov ebx, dword [ebp + 0x100]
push 0x47a594
push dword [ebp + 0xfc]
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0xd], 1
call fcn.0044e097
pop ecx
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x40ed70
test edi, edi
je 0x40ed69
lea ecx, [ebp - 0x60]
call fcn.0040f570
and dword [ebp - 4], 0
push 0xffffffffffffffff
push edi
xor ebx, ebx
call fcn.00401dec
push ebx
push 1
lea esi, [ebp - 0x60]
call fcn.00401e74
xor al, al
jmp 0x40ee74
test ebx, ebx
je 0x40ed7b
mov eax, dword [ebx]
mov dword [ebp - 0x1c], eax
jmp 0x40ed7f
and dword [ebp - 0x1c], 0
xor eax, eax
push 9
mov word [ebp + 0xc8], ax
pop ecx
lea edi, [ebp + 0xca]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x14]
xor edi, edi
mov dword [ebp - 0x24], eax
test eax, eax
je 0x40ee01
cmp dword [esi + 0x18], 8
lea ebx, [esi + 4]
jb 0x40edae
mov eax, dword [ebx]
jmp 0x40edb0
mov eax, ebx
push 0
push 0
call fcn.0040f239
mov edi, eax
lea eax, [edi + 1]
push eax
call fcn.0044bd5e
add esp, 0xc
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x20], eax
jb 0x40edd2
mov ebx, dword [ebx]
push edi
push eax
mov eax, ebx
call fcn.0040f239
push dword [ebp - 0x14]
push 1
push edi
push dword [ebp - 0x20]
call fcn.0044e972
push dword [ebp - 0x20]
dec eax
neg eax
sbb al, al
inc al
mov byte [ebp - 0xd], al
call fcn.0044c7ac
mov ebx, dword [ebp - 0x18]
add esp, 0x1c
push edi
lea eax, [ebp + 0xc8]
push eax
push dword [ebp - 0x24]
lea eax, [ebp]
push str._d_wide_chars_to__s_d_bytes
push eax
call fcn.0044e685
mov esi, dword [ebp - 0x28]
add esp, 0x14
test esi, esi
je 0x40ee2e
lea eax, [ebp]
push eax
push esi
call fcn.00403f6b
cmp byte [ebp - 0xd], 0
jne 0x40ee5f
test esi, esi
je 0x40ee5f
lea ecx, [ebp - 0x44]
call fcn.0040f570
push 0xffffffffffffffff
push esi
xor ebx, ebx
mov dword [ebp - 4], 1
call fcn.00401dec
push ebx
push 1
lea esi, [ebp - 0x44]
call fcn.00401e74
mov ebx, dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.0044e794
pop ecx
test ebx, ebx
je 0x40ee71
mov eax, dword [ebp - 0x1c]
mov dword [ebx], eax
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xf0]
xor ecx, ebp
call fcn.0044c18b
add ebp, 0xf4
leave
ret
Function at 0x412e19
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 8], ebx
jne 0x412e31
push 3
pop eax
jmp 0x412eca
push dword [ebp + 8]
xor edi, edi
inc edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push 0x80
push edi
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x412ebf
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jl 0x412eab
mov esi, dword [ebp + 0xc]
jg 0x412e6c
cmp esi, ebx
jbe 0x412eab
push ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x412ead
cmp eax, esi
jne 0x412ead
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x10]
jne 0x412ead
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffffe
inc edi
inc edi
jmp 0x412ead
xor edi, edi
cmp dword [ebp - 8], ebx
je 0x412ebb
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x412ec8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x412ecf
Capabilities:
Terminate thread

Disassembly:
push edi
xor edi, edi
inc edi
test esi, esi
je 0x412ef8
cmp esi, 0xffffffff
je 0x412ef8
push dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x412ef8
xor edi, edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, edi
pop edi
ret
Function at 0x4164a0
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
sub esp, 0x11c
lea ebp, [esp - 4]
mov eax, dword [0x487ba4]
xor eax, ebp
mov dword [ebp + 0x11c], eax
push 0xc
mov eax, 0x46c306
call fcn.00451557
mov ebx, ecx
xor edi, edi
push 0x479d30
lea ecx, [ebp]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], edi
call fcn.00401685
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push edi
mov dword [ebp - 4], edi
push 2
mov dword [ebp - 0x14], edi
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
push dword [ebp - 0x14]
call fcn.0044d4ff
pop ecx
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push 2
push 2
mov dword [ebp - 0x10], esi
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
je 0x41651c
push esi
jmp 0x416574
cmp dword [esi + 0x34], 6
jae 0x416522
mov esi, dword [esi + 8]
cmp esi, edi
jne 0x416513
jmp 0x416571
mov ebx, 0x100
push ebx
lea eax, [ebp + 0x1c]
push edi
push eax
call fcn.00451670
movzx eax, byte [esi + 0x31]
push eax
movzx eax, byte [esi + 0x30]
push eax
movzx eax, byte [esi + 0x2f]
push eax
movzx eax, byte [esi + 0x2e]
push eax
movzx eax, byte [esi + 0x2d]
push eax
movzx eax, byte [esi + 0x2c]
push eax
push str._02X_02X_02X_02X_02X_02X
lea eax, [ebp + 0x1c]
push ebx
push eax
call fcn.0044ce83
add esp, 0x30
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.00401662
mov ebx, dword [ebp - 0x18]
push dword [ebp - 0x10]
call fcn.0044d5c9
pop ecx
lea eax, [ebp]
push eax
mov ecx, ebx
call fcn.004011f6
push edi
push 1
lea ecx, [ebp]
call fcn.0040150f
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x11c]
xor ecx, ebp
call fcn.0044c18b
add ebp, 0x120
leave
ret

Function at 0x4165b5
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
sub esp, 0x2a0
lea ebp, [esp - 4]
mov eax, dword [0x487ba4]
xor eax, ebp
mov dword [ebp + 0x2a0], eax
push 4
mov eax, 0x46c2d6
call fcn.00451557
push 0x104
lea eax, [ebp + 0x9c]
xor ebx, ebx
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebx
lea ecx, [ebp]
mov dword [ebp + 0x18], 0xf
call fcn.004015d4
push 3
lea eax, [ebp + 0x9c]
push eax
lea ecx, [ebp]
call fcn.004015f0
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x18], 0x10
mov ecx, dword [ebp + 4]
mov dword [ebp - 0x10], ebx
jae 0x416623
lea ecx, [ebp + 4]
mov eax, 0x80
push eax
lea edx, [ebp + 0x1a0]
push edx
push ebx
push ebx
lea edx, [ebp - 0x10]
push edx
push eax
lea eax, [ebp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0x7f
lea eax, [ebp + 0x221]
push ebx
push eax
mov byte [ebp + 0x220], bl
call fcn.00451670
push dword [ebp - 0x10]
lea eax, [ebp + 0x220]
push str._08X
push eax
call fcn.0044ce06
add esp, 0x18
lea eax, [ebp + 0x220]
push eax
mov ecx, esi
call fcn.00401685
push ebx
push 1
lea ecx, [ebp]
call fcn.0040150f
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2a0]
xor ecx, ebp
call fcn.0044c18b
add ebp, 0x2a4
leave
ret
Function at 0x416c67
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x46b873
call fcn.004515c0
xor ebx, ebx
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x21c], ebx
mov esi, edi
mov dword [ebp - 4], 1
call fcn.00401bbc
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 0x21c], 1
call fcn.00451670
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x2e
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x416d0f
lea eax, [ebp - 0x218]
push eax
push edi
call fcn.00403f6b
mov esi, 0x479d68
push esi
push edi
call fcn.00403efe
cmp dword [ebp + 0x1c], ebx
je 0x416cfd
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x416cfa
lea eax, [ebp + 0xc]
push eax
jmp 0x416d02
push 0x47a4b8
push edi
call fcn.00403efe
push esi
push edi
call fcn.00403efe
cmp dword [edi + 0x18], 8
jb 0x416d1a
mov eax, dword [edi + 4]
jmp 0x416d1d
lea eax, [edi + 4]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push ebx
push 1
lea esi, [ebp + 8]
call fcn.00401e74
mov eax, edi
call fcn.00451643
ret

Function at 0x416de1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0xe4
lea ebp, [esp - 4]
mov eax, dword [0x487ba4]
xor eax, ebp
mov dword [ebp + 0xe4], eax
push 0x34
mov eax, 0x46bbaa
call fcn.00451557
mov eax, dword [ebp + 0xf0]
mov dword [ebp - 0x14], eax
xor edi, edi
xor eax, eax
mov dword [ebp - 0x10], edi
push 0xc6
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push edi
push eax
call fcn.00451670
add esp, 0xc
mov dword [ebp - 0x1c], 0x64
mov dword [ebp - 0x24], edi
xor esi, esi
call fcn.00416da8
test eax, eax
je 0x416e45
mov esi, 0x200
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
or esi, 0x20019
push esi
push edi
push edi
push edi
push str.SoftwareMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor ebx, ebx
inc ebx
test eax, eax
jne 0x416e96
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push str.Version
push dword [ebp - 0x18]
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x1c]
push eax
lea esi, [ebp]
call fcn.004070da
mov dword [ebp - 4], edi
cmp dword [ebp + 0x14], edi
jne 0x416ebf
push 0x47aa58
lea esi, [ebp - 0x40]
call fcn.004070da
mov byte [ebp - 4], bl
mov dword [ebp - 0x10], ebx
jmp 0x416ec2
lea eax, [ebp]
mov esi, dword [ebp - 0x14]
push eax
call fcn.00401bcf
or dword [ebp - 0x10], 2
test byte [ebp - 0x10], bl
je 0x416ede
push edi
push ebx
lea esi, [ebp - 0x40]
call fcn.00401e74
push edi
push ebx
lea esi, [ebp]
call fcn.00401e74
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xe4]
xor ecx, ebp
call fcn.0044c18b
add ebp, 0xe8
leave
ret
Function at 0x41743b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x487ba4]
xor eax, ebp
mov dword [ebp + 0x94], eax
push edi
push 0x114
xor edi, edi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.00451670
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x417487
cmp dword [ebp - 0x7c], 6
jb 0x417487
inc edi
mov ecx, dword [ebp + 0x94]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0044c18b
add ebp, 0x98
leave
ret

Function at 0x417b22
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, eax
push 0x1c
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x417b40
xor eax, eax
jmp 0x417bae
cmp dword [ebp - 0x14], 0x10000
je 0x417b3c
push edi
mov edi, dword [ebp - 0x20]
push 0x104
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x417bab
mov eax, dword [edi + 0x3c]
sub esi, dword [ebp - 0x20]
and dword [ebp - 4], 0
add eax, edi
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
xor edx, edx
mov dword [ebp - 8], eax
cmp dx, ax
jae 0x417bab
mov edx, dword [ecx + 0x10]
mov edi, dword [ecx + 8]
mov eax, dword [ecx + 0xc]
cmp edx, edi
ja 0x417b91
mov edx, edi
cmp esi, eax
jb 0x417b9b
add edx, eax
cmp esi, edx
jbe 0x417bb1
inc dword [ebp - 4]
mov ax, word [ebp - 4]
add ecx, 0x28
cmp ax, word [ebp - 8]
jb 0x417b82
xor eax, eax
pop edi
pop esi
leave
ret
sub esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ecx]
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
xor eax, eax
mov byte [ebx + 8], 0
inc eax
jmp 0x417bad