joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408004
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00403624
push dword [esp + 0x14]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x408032
xor al, al
jmp 0x40805c
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x408050
push dword [esp + 0x14]
push ecx
call fcn.0041fc0c
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
jmp 0x408055
and dword [esp + 0x10], 0
mov edx, esi
call fcn.00407c46
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x408262
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x4014
call fcn.0041cf30
push ebx
push ebp
push esi
push edi
mov edi, edx
xor ebp, ebp
mov eax, dword [edi + 4]
mov dword [edi + 8], ebp
test eax, eax
je 0x408283
xor edx, edx
mov word [eax], dx
push ebp
push ebp
push 3
push ebp
push 3
push ebp
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x408307
mov ebx, 0x4000
mov dword [esp + 0x10], ebp
push ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x20], ebp
push ebp
push eax
call fcn.0041de00
add esp, 0xc
mov dword [esp + 0x14], ebp
lea eax, [esp + 0x10]
mov dword [esp + 0x18], ebp
push ebp
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
push 0xc
lea eax, [esp + 0x28]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x408300
mov eax, dword [esp + 0x10]
cmp eax, 0x28
jb 0x408300
lea edx, [esp + 0x20]
lea ecx, [esp + 0x20]
add edx, eax
add ecx, dword [esp + 0x38]
push edi
call fcn.00408433
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4014
ret

Function at 0x408a80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00403624
push dword [esp + 0x14]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x408aae
xor al, al
jmp 0x408ad8
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x408acc
push dword [esp + 0x14]
push ecx
call fcn.0041fc0c
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
jmp 0x408ad1
and dword [esp + 0x10], 0
mov edx, esi
call fcn.004086c2
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408add
Capabilities:
Generate random numbers via winapi

Disassembly:
push ecx
push ecx
push ebp
push esi
mov esi, ecx
mov ebp, edx
test esi, esi
je 0x408bb6
push ebx
push edi
push 0
call fcn.0042b938
pop ecx
push 2
mov edi, eax
mov ebx, edx
push 8
lea eax, [esp + 0x18]
add edi, 0xab5b7200
push eax
push 0
adc ebx, 0xffffffff
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
je 0x408b2b
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
jmp 0x408b2f
mov ecx, dword [esp + 0x10]
and ecx, 0x1ffffff
xor eax, eax
or ecx, ebx
or eax, edi
or ecx, 0x44000000
push ecx
push eax
push 0x46d834
push 0xffffffffffffffff
push ebp
push esi
call fcn.00401ea4
add esp, 0x18
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, ebx
call fcn.00403e01
mov edi, str.SOFTWAREMetaQuotes_Software
test al, al
jne 0x408b74
push ecx
mov edx, edi
mov ecx, ebx
call fcn.00403da9
pop ecx
push ecx
push esi
push ecx
mov ebp, 0x46d038
mov edx, edi
push ebp
mov ecx, ebx
call fcn.00403d74
add esp, 0x10
mov ebx, SysReAllocStringLen
mov ecx, ebx
call fcn.00403e01
test al, al
jne 0x408ba4
push ecx
mov edx, edi
mov ecx, ebx
call fcn.00403da9
pop ecx
push ecx
push esi
push ecx
push ebp
mov edx, edi
mov ecx, ebx
call fcn.00403d74
add esp, 0x10
pop edi
pop ebx
pop esi
pop ebp
pop ecx
pop ecx
ret

Function at 0x408c0a
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
xor eax, eax
push esi
mov dword [ebp - 4], eax
mov esi, 0x100
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x214]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x408c7c
push 3
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.0042a52a
add esp, 0x10
xor eax, eax
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x214]
push esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x40e668
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x20
or dword [esp + 0x1c], 0xffffffff
mov eax, ecx
push ebx
push ebp
push esi
push edi
push ecx
push 3
push 3
push SysReAllocStringLen
push dword [esp + 0x44]
xor ebx, ebx
mov dword [esp + 0x38], eax
lea ecx, [esp + 0x3c]
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [esp + 0x3c], 0x4679a8
call fcn.00401442
mov esi, dword [esp + 0x2c]
test al, al
je 0x40e7f7
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
cmp esi, 0xffffffff
je 0x40e6d5
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40e6d5
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
jmp 0x40e6e6
xorps xmm0, xmm0
movlpd qword [esp + 0x28], xmm0
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, edi
mov dword [esp + 0x14], ebp
add ecx, 2
mov eax, ebp
adc eax, ebx
push eax
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.00403a3c
test al, al
je 0x40e7e8
cmp esi, 0xffffffff
je 0x40e7a7
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
test eax, eax
je 0x40e7a7
cmp ebp, ebx
ja 0x40e72a
cmp edi, 1
jb 0x40e7a7
mov eax, dword [esp + 0x14]
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x34], ecx
mov edx, edi
mov dword [esp + 0x18], ebx
sub edx, ebp
sbb eax, ecx
cmp eax, ebx
jb 0x40e764
ja 0x40e75b
cmp edx, 0xfffffff
jbe 0x40e764
mov eax, 0xfffffff
mov ecx, ebp
jmp 0x40e76a
mov ecx, ebp
mov eax, edi
sub eax, ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [esp + 0x34]
add eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x34]
test eax, eax
je 0x40e7b8
cmp dword [esp + 0x18], ebx
je 0x40e7b8
add ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
adc ecx, ebx
mov dword [esp + 0x34], ecx
cmp ecx, eax
jb 0x40e743
ja 0x40e7b8
cmp ebp, edi
jb 0x40e743
jmp 0x40e7b8
xorps xmm0, xmm0
movlpd qword [esp + 0x28], xmm0
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
cmp ebp, edi
jne 0x40e7e8
mov ebp, dword [esp + 0x14]
cmp ecx, ebp
jne 0x40e7e8
cmp esi, 0xffffffff
je 0x40e7d3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
mov eax, dword [esp + 0x24]
mov ecx, eax
mov dword [eax + 8], edi
mov dword [eax + 0xc], ebp
call fcn.004039f0
mov bl, al
jmp 0x40e7f7
cmp esi, 0xffffffff
je 0x40e803
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
cmp esi, 0xffffffff
je 0x40e803
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x20
ret 0xc
Function at 0x40eb13
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x660
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x24], 0x10
jbe 0x40ebe7
push 0x250
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0041de00
add esp, 0xc
lea ecx, [esp + 0x258]
call fcn.0040491d
push dword [esi + 0x20]
mov eax, ecx
push str._s.
push eax
call fcn.004011fb
add esp, 0xc
lea eax, [esp + 8]
push eax
push dword [esp + 0x260]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40ebdc
test byte [esp + 8], 0x10
jne 0x40ebbc
lea eax, [esp + 0x34]
push eax
push dword [esi + 0x20]
lea eax, [esp + 0x260]
push 0x470ff8
push eax
call fcn.004011fb
add esp, 0x10
mov ecx, esi
push dword [esp + 0x25c]
call fcn.0040e80f
test al, al
je 0x40ebbc
push dword [esp + 0x25c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [esi + 0xce81], 0
jne 0x40ebd5
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40eb79
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esi + 0x95d8]
mov eax, dword [ecx]
call dword [eax + 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ed67
Capabilities:
Reference wmi statements

Disassembly:
sub esp, 0x130
push ebx
push ebp
push esi
mov esi, dword [esp + 0x140]
mov ebp, ecx
push edi
test esi, esi
je 0x40ef32
lea eax, [esp + 0x40]
mov dword [esp + 0x3c], 0x80
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x30], 0x46fce0
mov word [esp + 0x40], ax
xor ebx, ebx
mov eax, dword [esi]
push str.SELECT__FROM_Win32_VideoController
mov dword [esp + 0x18], ebx
mov dword [esp + 0x3c], ebx
mov eax, dword [eax + 0x50]
mov dword [esp + 0x1c], eax
call fcn.0040ec19
mov edi, dword [eax]
test edi, edi
je 0x40edcc
mov edi, dword [edi]
jmp 0x40edce
mov edi, ebx
push 0x471c70
lea ecx, [esp + 0x14]
call fcn.0040ec19
mov eax, dword [eax]
test eax, eax
je 0x40ede6
mov eax, dword [eax]
jmp 0x40ede8
mov eax, ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push 0x30
push edi
push eax
push esi
call dword [esp + 0x30]
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.0040ec8b
lea ecx, [esp + 0x1c]
call fcn.0040ec8b
test esi, esi
js 0x40ef2e
jmp 0x40ef0a
lea edx, [esp + 0x18]
mov dword [esp + 0x18], ebx
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov eax, dword [ecx]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
test eax, eax
jne 0x40ef1e
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x40ef1e
cmp dword [esp + 0x18], ebx
je 0x40ef18
lea edi, [esp + 0x20]
mov esi, str.Caption
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ecx]
lea edx, [esp + 0x20]
push ebx
push ebx
push edx
push ebx
push esi
push ecx
call dword [eax + 0x10]
test eax, eax
jns 0x40ee79
push str.n_a
jmp 0x40eec6
movzx eax, word [esp + 0x20]
cmp eax, 3
je 0x40eeac
mov ecx, ebp
cmp eax, 8
je 0x40ee91
push str.n_a
jmp 0x40eec8
cmp dword [esp + 0x28], ebx
mov eax, 0x471c78
cmovne eax, dword [esp + 0x28]
push eax
call fcn.0040ecb9
push 0x471d00
jmp 0x40eec6
push dword [esp + 0x28]
lea eax, [esp + 0x34]
push 0x471c80
push eax
call fcn.004011fb
add esp, 0xc
push dword [esp + 0x34]
mov ecx, ebp
call fcn.0040ecb9
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40eedd
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 2
cmp word [esi], bx
je 0x40ef00
mov ecx, dword [esp + 0x10]
jmp 0x40ee5f
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x40ee18
jmp 0x40ef2c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40ef2c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov bl, 1
mov al, bl
jmp 0x40ef34
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x130
ret 0xc
Function at 0x40ef41
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
sub esp, 0x10
xor eax, eax
mov edx, str.SOFTWAREMetaQuotes_Software
push ebx
push ebp
push esi
push edi
push 0x100
mov edi, ecx
mov ebp, 0x471d04
push 0x3fe
push edi
push ebp
mov ecx, SysReAllocStringLen
mov word [edi], ax
call fcn.00403e35
add esp, 0x10
xor ebx, ebx
test al, al
je 0x40ef81
cmp word [edi], bx
jne 0x40f0ca
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x40efa1
cmp eax, 0x80010119
jne 0x40f054
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
push 0x45f8ac
push 1
push ebx
push 0x45f8bc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40f054
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40f054
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x1c]
mov eax, dword [eax]
push str.ROOTCIMV2
mov esi, dword [eax + 0xc]
call fcn.0040ec19
mov eax, dword [eax]
test eax, eax
je 0x40eff2
mov eax, dword [eax]
jmp 0x40eff4
mov eax, ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push dword [esp + 0x38]
call esi
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.0040ec8b
test esi, esi
js 0x40f04a
cmp dword [esp + 0x14], ebx
je 0x40f04a
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [esp + 0x30]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x40f040
push ecx
push ecx
push dword [esp + 0x1c]
mov ecx, edi
call fcn.0040ed67
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40f059
sub ecx, edx
sar ecx, 1
je 0x40f07e
cmp word [edi + ecx*2 - 2], 0x7c
jne 0x40f07e
sub ecx, 1
push 0
pop eax
mov word [edi + ecx*2], ax
jne 0x40f06a
mov esi, 0x471d00
jmp 0x40f08b
push 0x2c
pop ecx
mov word [eax], cx
push esi
push edi
call fcn.0041d0fe
pop ecx
pop ecx
test eax, eax
jne 0x40f085
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x40f09d
sub esi, ecx
mov edx, str.SOFTWAREMetaQuotes_Software
sar esi, 1
push ecx
lea eax, [esi*2 + 2]
push eax
push edi
push ecx
push ebp
mov ecx, SysReAllocStringLen
call fcn.00403d07
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x40f0d4
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x4bb638]
sub esp, 0x604
push ebx
push esi
push edi
test eax, eax
jne 0x40f106
push 0x45f8cc
push 0x200000
call fcn.0041bf4d
mov dword [0x4bb638], eax
pop ecx
pop ecx
test eax, eax
je 0x40f10b
xor ecx, ecx
mov word [eax], cx
xor ebx, ebx
cmp dword [0x4c6ef4], ebx
jne 0x40f12d
push 4
push 0x3000
push 0x22000
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x4c6ef4], eax
push dword [0x4ba090]
mov dword [0x4c6ef8], ebx
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, 0x4ba08c
mov ecx, esi
call fcn.00403fdc
push 0x4700c0
mov ecx, esi
call fcn.00403832
push dword [0x4ba090]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 0xffffffff
jne 0x40f17e
push ebx
push dword [0x4ba090]
call esi
push str.Crashes
mov ecx, 0x4ba08c
call fcn.00403832
push dword [0x4ba090]
call edi
cmp eax, 0xffffffff
jne 0x40f1a3
push ebx
push dword [0x4ba090]
call esi
push str.MT5WEBSETUP
mov ecx, 0x4ba2a4
call fcn.00403488
push str.MetaTrader_Web_Setup
mov ecx, 0x4ba4bc
call fcn.00403488
mov eax, 0xe75
mov dword [0x4bb5d0], 0x1f4
mov dword [0x4bb5d4], eax
mov ecx, 0x4ba6d4
mov dword [0x4bb5d8], 0x286b
push ebx
mov dword [0x4c6f28], eax
call fcn.00403488
mov eax, dword [0x4bb630]
or eax, dword [0x4bb634]
jne 0x40f20e
push ebx
call fcn.0042b938
pop ecx
mov dword [0x4bb630], eax
mov dword [0x4bb634], edx
push str.28_Apr_2023
mov ecx, 0x4bb5dc
call fcn.00403488
mov edi, 0x4baf34
mov ecx, edi
call fcn.00401b89
test al, al
je 0x40f2f6
push 0x200
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0041de00
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [esp + 0x1c]
add esp, 0xc
push 0x100
push eax
push str.CLIENTNAME
call esi
test eax, eax
jne 0x40f274
push 0x100
lea eax, [esp + 0x14]
push eax
push str.COMPUTERNAME
call esi
test eax, eax
je 0x40f2ad
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.00403488
push 0x100
lea eax, [esp + 0x14]
push eax
push str.USERDOMAIN
call esi
test eax, eax
je 0x40f2ad
push 0x46cf58
mov ecx, edi
call fcn.00403832
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.00403832
push 0x100
push 0x1fe
lea eax, [esp + 0x18]
mov edx, str.SOFTWAREMetaQuotes_SoftwareSettings
push eax
push str.MQL5.Login
mov ecx, SysReAllocStringLen
call fcn.00403e35
add esp, 0x10
test al, al
je 0x40f2f6
cmp word [esp + 0x10], bx
je 0x40f2f6
push str._for
mov ecx, edi
call fcn.00403832
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.00403832
mov esi, 0x400
lea eax, [esp + 0x210]
push esi
push ebx
push eax
call fcn.0041de00
pop ecx
pop ecx
lea ecx, [esp + 0x214]
call fcn.0040ef41
lea eax, [esp + 0x210]
mov ecx, 0x4bb14c
push eax
call fcn.00403488
lea eax, [esp + 0x210]
mov byte [eax], bl
inc eax
sub esi, 1
jne 0x40f331
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x40f7a5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, ecx
push edi
test esi, esi
je 0x40f821
xor edi, edi
cmp word [esi], di
je 0x40f821
call fcn.0040f47b
test al, al
je 0x40f821
push 0x471d20
push esi
push str._scheckwritepermissions._s
push 0xffffffffffffffff
lea eax, [ebp - 0x208]
push 0x103
push eax
call fcn.00401ea4
add esp, 0x18
lea eax, [ebp - 0x208]
push edi
push 0x80
push 2
push edi
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40f821
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
jmp 0x40f823
xor al, al
pop edi
pop esi
leave
ret

Function at 0x40f827
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push esi
push edi
call fcn.004013bb
test eax, eax
jne 0x40f8c0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x40f8c0
push 0x424
lea eax, [ebp - 0x424]
push 0
push eax
call fcn.0041de00
add esp, 0xc
mov dword [ebp - 0x428], 0x428
lea eax, [ebp - 0x428]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x40f8b5
xor edi, edi
push dword [edi + 0x471dd0]
lea eax, [ebp - 0x408]
push eax
call fcn.0042bc09
pop ecx
pop ecx
test eax, eax
je 0x40f8c6
add edi, 4
cmp edi, 0xc
jb 0x40f887
lea eax, [ebp - 0x428]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x40f885
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x40f8c2
Function at 0x410241
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
cmp dword [esp + 0x10], 0
push ebx
push esi
je 0x410318
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push dword [esp + 0x1c]
mov dword [esp + 0x14], ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x410318
mov eax, dword [0x4c6efc]
cmp esi, dword [0x4c6f00]
jbe 0x4102b8
test eax, eax
je 0x410294
push 0x8000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x4c6efc], ebx
push 4
push 0x3000
push esi
push ebx
mov dword [0x4c6f00], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x4c6efc], eax
test eax, eax
je 0x410318
mov dword [0x4c6f00], esi
push eax
push esi
push ebx
push dword [esp + 0x24]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x410314
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
push 0x46cf64
push dword [0x4c6efc]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x410314
mov edx, dword [esp + 0x10]
test edx, edx
je 0x410314
mov eax, dword [esp + 0x1c]
mov ecx, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
mov dword [eax], ecx
mov eax, dword [esp + 0x20]
mov dword [eax], edx
test ecx, ecx
je 0x410314
test edx, edx
je 0x410314
mov bl, 1
mov al, bl
jmp 0x41031a
xor al, al
pop esi
pop ebx
add esp, 0xc
ret 0xc
Function at 0x4111af
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push dword [0x4ba090]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4111d6
mov ecx, dword [0x4ba090]
call fcn.0041111f
cmp word [0x4bb57c], 0
je 0x4112b3
or dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 0x228]
mov dword [ebp - 0xc], 0x4679a8
call fcn.00403624
push 0x4bb57c
push dword [0x4ba2a8]
mov eax, ecx
push dword [0x4ba090]
push 0x472e18
push eax
call fcn.004011fb
add esp, 0x10
lea ecx, [ebp - 0xc]
push 2
push 3
push 0x40000000
push dword [ebp - 0x224]
call fcn.00401442
mov esi, dword [ebp - 8]
test al, al
je 0x41128f
and dword [ebp - 4], 0
cmp esi, 0xffffffff
je 0x411256
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x472dc4
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [0x4bb638]
mov ecx, ebx
call fcn.00409665
and dword [ebp - 4], 0
add eax, eax
cmp esi, 0xffffffff
je 0x41128f
test ebx, ebx
je 0x411285
test eax, eax
je 0x411285
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
and dword [ebp - 0x224], 0
and dword [ebp - 0x220], 0
mov dword [ebp - 0x228], 0x4654d8
cmp esi, 0xffffffff
je 0x4112b3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
leave
ret

Function at 0x411384
Capabilities:
Create process memory minidump
Delete file

Disassembly:
sub esp, 0x224
xor eax, eax
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [esp + 0x238]
test edi, edi
je 0x4113b0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
push 0x4bb57c
push dword [0x4ba2a8]
lea eax, [esp + 0x30]
push dword [0x4ba090]
push str._s_s._s.dmp
push 0xffffffffffffffff
push 0x103
push eax
call fcn.00401ea4
add esp, 0x1c
lea eax, [esp + 0x28]
xor ebp, ebp
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x411479
mov ecx, 0x4ba8ec
call fcn.00401b89
test al, al
je 0x41141c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebp
jmp 0x411440
mov eax, dword [0x4ba8f0]
mov dword [esp + 0x20], 0x4112b7
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x20]
push ecx
xor edx, edx
lea ecx, [esp + 0x18]
push ebp
test edi, edi
cmove ecx, edx
push ecx
push dword [esp + 0x248]
push ebx
push esi
push eax
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x28]
push eax
call fcn.0041174d
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x224
ret 8