joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4063c8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4314b1]
call sub.user32.dll_EnableWindow
push 0
push dword [0x4314bd]
call sub.user32.dll_EnableWindow
push 0
push dword [0x4314c1]
call sub.user32.dll_EnableWindow
push 0
push dword [0x4314c1]
call sub.user32.dll_ShowWindow
push 0x42c8ea
push dword [0x4314d5]
call sub.user32.dll_SetWindowTextA
push 0x42c8ea
push dword [0x4314d9]
call sub.user32.dll_SetWindowTextA
push 0x42d87d
push 0x42c8ea
call fcn.00411bd0
push 0x42d779
push 0x42c8ea
call fcn.00411bd0
push 0x42c8ea
push dword [ebp + 8]
call fcn.0040667e
leave
ret 4

Function at 0x4064e6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4314a9]
call sub.user32.dll_EnableWindow
push 0
push dword [0x4314ad]
call sub.user32.dll_EnableWindow
push 0
push dword [0x4314b1]
call sub.user32.dll_EnableWindow
push 0
push dword [0x4314b5]
call sub.user32.dll_EnableWindow
push 0
push dword [0x4314c5]
call sub.user32.dll_EnableWindow
push 0
push dword [0x4314c9]
call sub.user32.dll_EnableWindow
push 0
push dword [0x4314cd]
call sub.user32.dll_EnableWindow
push 0
push dword [0x4314d1]
call sub.user32.dll_EnableWindow
push 0
push dword [0x4314dd]
call sub.user32.dll_EnableWindow
push 0
push dword [0x4314e1]
call sub.user32.dll_EnableWindow
push 1
push dword [0x4314c1]
call sub.user32.dll_EnableWindow
push 1
push dword [0x4314c1]
call sub.user32.dll_ShowWindow
push 0
push dword [0x4314bd]
call sub.user32.dll_EnableWindow
push 0
push dword [0x4314bd]
call sub.user32.dll_ShowWindow
leave
ret 4

Function at 0x4065a3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 1
push dword [0x4314a9]
call sub.user32.dll_EnableWindow
push 1
push dword [0x4314ad]
call sub.user32.dll_EnableWindow
push 1
push dword [0x4314b1]
call sub.user32.dll_EnableWindow
push 1
push dword [0x4314b5]
call sub.user32.dll_EnableWindow
push 1
push dword [0x4314c5]
call sub.user32.dll_EnableWindow
push 1
push dword [0x4314c9]
call sub.user32.dll_EnableWindow
push 1
push dword [0x4314cd]
call sub.user32.dll_EnableWindow
push 1
push dword [0x4314d1]
call sub.user32.dll_EnableWindow
push 1
push dword [0x4314dd]
call sub.user32.dll_EnableWindow
push 1
push dword [0x4314e1]
call sub.user32.dll_EnableWindow
push 1
push dword [0x4314bd]
call sub.user32.dll_EnableWindow
push 1
push dword [0x4314bd]
call sub.user32.dll_ShowWindow
push 0
push dword [0x4314c1]
call sub.user32.dll_EnableWindow
push 0
push dword [0x4314c1]
call sub.user32.dll_ShowWindow
push dword [0x4314bd]
call sub.user32.dll_UpdateWindow
push dword [ebp + 8]
call sub.user32.dll_UpdateWindow
push dword [0x4314b9]
call sub.user32.dll_SetFocus
leave
ret 4
Function at 0x406cef
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
cmp dword [0x431308], 0
je 0x406d73
push dword [0x431308]
call fcn.00418e4a
mov dword [0x431308], 0
push 0x42bf3f
push 1
call fcn.004011f3
push 0x42bf3f
push 3
call fcn.004011f3
push 0x42bf3f
push 5
call fcn.004011f3
push 0x42bf3f
push 7
call fcn.004011f3
push 0
call fcn.004015db
push dword [0x431318]
call fcn.00412650
cmp dword [0x43130c], 0
je 0x406d73
push dword [0x43130c]
call fcn.00417416
mov dword [0x43130c], 0
call sub.kernel32.dll_GetTickCount
mov dword [0x43133c], eax
push 1
push dword [ebp + 0xc]
call fcn.004186c0
mov dword [0x431308], eax
or eax, eax
jne 0x406dad
mov dword [0x431308], 0
mov dword [0x43137c], 0
mov eax, 0
leave
ret 8
push dword [0x431308]
call fcn.00419af1
mov dword [ebp - 0x20], eax
push dword [0x431308]
call fcn.004191a3
mov dword [0x42e1a2], eax
push dword [0x431308]
call fcn.0041920c
cmp eax, 0xffffffff
je 0x406df5
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.00412220
lea eax, [ebp - 0x1c]
push eax
push 1
call fcn.004011f3
push 0x42b03c
push 0x42b02c
call fcn.00411bd0
push 0x42b271
push 0x42b03c
call fcn.00411ac0
push dword [0x42e1a2]
push 0x42b03c
call fcn.00411ac0
cmp dword [ebp - 0x20], 2
jne 0x406e3a
push str.__BIF_Compressed_
push 0x42b03c
call fcn.00411ac0
jmp 0x406e66
cmp dword [ebp - 0x20], 3
jne 0x406e51
push str.__BIFC_Compressed_
push 0x42b03c
call fcn.00411ac0
jmp 0x406e66
cmp dword [ebp - 0x20], 4
jne 0x406e66
push str.__BIF_V1.1_
push 0x42b03c
call fcn.00411ac0
push 0x42b03c
push dword [ebp + 8]
call sub.user32.dll_SetWindowTextA
push 0x42e1a6
push dword [0x42e1a2]
call fcn.00419236
cmp eax, 1
jne 0x406e94
mov dword [0x431360], 1
jmp 0x406e9e
mov dword [0x431360], 0
push 1
push 0x42e1a6
call fcn.00416710
mov dword [0x43130c], eax
push dword [0x42e1a2]
push dword [0x43130c]
call fcn.004177d3
mov dword [0x431320], eax
mov dword [0x43137c], 1
push 0x43131c
push 0
push dword [ebp + 8]
push 0x407722
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x431364], eax
mov eax, 1
leave
ret 8
Function at 0x406f38
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
pop dword [0x42b695]
mov dword [0x42b69d], 0x42b9b4
mov dword [0x42b6ad], 0x42b8b0
mov dword [0x42b6c1], 0x42ba08
mov dword [0x42b6b1], 0x104
mov dword [0x42b6cd], 0
mov dword [0x42b6c5], 0x80000
mov dword [0x42b691], 0x4c
push 0x42b691
call sub.comdlg32.dll_GetOpenFileNameA
or eax, eax
je 0x407048
cmp dword [0x43130c], 0
je 0x406fb0
push dword [0x43130c]
call fcn.00417416
call sub.kernel32.dll_GetTickCount
mov dword [0x43133c], eax
push dword [0x431308]
call fcn.004191a3
mov dword [0x42e1a2], eax
push 1
push 0x42b8b0
call fcn.00416710
mov dword [0x43130c], eax
push dword [0x42e1a2]
push dword [0x43130c]
call fcn.004177d3
mov dword [0x431320], eax
cmp eax, 0xffffffff
jne 0x40701c
push 0x42c30e
push str.Invalid_key_file_for_this_bif._Simulating_resource_names.
call fcn.00411bd0
push 2
call fcn.004015db
push 0x42c30e
push 7
call fcn.004011f3
leave
ret 4
push 0x42e1a6
push 0x42b8b0
call fcn.00411bd0
push 0x43131c
push 0
push dword [ebp + 8]
push 0x407722
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x431364], eax
leave
ret 4

Function at 0x409174
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
cmp dword [0x431310], 0
je 0x4091da
push dword [0x431310]
call fcn.0041adf3
mov dword [0x431310], 0
push 0x42bf3f
push 1
call fcn.004011f3
push 0x42bf3f
push 3
call fcn.004011f3
push 0x42bf3f
push 5
call fcn.004011f3
push 0x42bf3f
push 7
call fcn.004011f3
push 0
call fcn.004015db
push dword [0x431318]
call fcn.00412650
call sub.kernel32.dll_GetTickCount
mov dword [0x431519], eax
push 1
push dword [ebp + 0xc]
call fcn.0041ac60
mov dword [0x431310], eax
or eax, eax
jne 0x409214
mov dword [0x431310], 0
mov dword [0x43137c], 0
mov eax, 0
leave
ret 8
push dword [0x431310]
call fcn.0041b197
mov dword [ebp - 0x20], eax
push dword [0x431310]
call fcn.0041b10c
mov dword [0x42ec95], eax
push dword [0x431310]
call fcn.0041b175
cmp eax, 0xffffffff
je 0x40925c
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.00412220
lea eax, [ebp - 0x1c]
push eax
push 1
call fcn.004011f3
push 0x42b03c
push 0x42b02c
call fcn.00411bd0
push 0x42b271
push 0x42b03c
call fcn.00411ac0
push dword [0x42ec95]
push 0x42b03c
call fcn.00411ac0
push 0x42b03c
push dword [ebp + 8]
call sub.user32.dll_SetWindowTextA
mov dword [0x43137c], 2
push 0x43131c
push 0
push dword [ebp + 8]
push 0x4092ec
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x431364], eax
mov eax, 1
leave
ret 8
Function at 0x409cd9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
cmp dword [0x431314], 0
je 0x409d3f
push dword [0x431314]
call fcn.0041b593
mov dword [0x431314], 0
push 0x42bf3f
push 1
call fcn.004011f3
push 0x42bf3f
push 3
call fcn.004011f3
push 0x42bf3f
push 5
call fcn.004011f3
push 0x42bf3f
push 7
call fcn.004011f3
push 0
call fcn.004015db
push dword [0x431318]
call fcn.00412650
call sub.kernel32.dll_GetTickCount
mov dword [0x431525], eax
push 1
push dword [ebp + 0xc]
call fcn.0041b400
mov dword [0x431314], eax
or eax, eax
jne 0x409d79
mov dword [0x431314], 0
mov dword [0x43137c], 0
mov eax, 0
leave
ret 8
push dword [0x431314]
call fcn.0041ba84
mov dword [ebp - 0x20], eax
push dword [0x431314]
call fcn.0041b9f9
mov dword [0x42ecd3], eax
push dword [0x431314]
call fcn.0041ba62
cmp eax, 0xffffffff
je 0x409dc1
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.00412220
lea eax, [ebp - 0x1c]
push eax
push 1
call fcn.004011f3
push 0x42b03c
push 0x42b02c
call fcn.00411bd0
push 0x42b271
push 0x42b03c
call fcn.00411ac0
push dword [0x42ecd3]
push 0x42b03c
call fcn.00411ac0
push 0x42b03c
push dword [ebp + 8]
call sub.user32.dll_SetWindowTextA
mov dword [0x43137c], 3
push 0x43131c
push 0
push dword [ebp + 8]
push 0x409e51
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x431364], eax
mov eax, 1
leave
ret 8

Function at 0x40b07c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x40b0c6
push 1
push dword [0x431545]
call sub.user32.dll_EnableWindow
push 0
push dword [0x431549]
call sub.user32.dll_EnableWindow
push 1
push dword [0x431545]
call sub.user32.dll_ShowWindow
push 0
push dword [0x431549]
call sub.user32.dll_ShowWindow
push dword [0x431545]
call sub.user32.dll_SetFocus
jmp 0x40b105
push 1
push dword [0x431549]
call sub.user32.dll_EnableWindow
push 0
push dword [0x431545]
call sub.user32.dll_EnableWindow
push 1
push dword [0x431549]
call sub.user32.dll_ShowWindow
push 0
push dword [0x431545]
call sub.user32.dll_ShowWindow
push dword [0x431549]
call sub.user32.dll_SetFocus
leave
ret 4

Function at 0x40c3e9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x40c433
push 1
push dword [0x431561]
call sub.user32.dll_EnableWindow
push 0
push dword [0x431565]
call sub.user32.dll_EnableWindow
push 1
push dword [0x431561]
call sub.user32.dll_ShowWindow
push 0
push dword [0x431565]
call sub.user32.dll_ShowWindow
push dword [0x431561]
call sub.user32.dll_SetFocus
jmp 0x40c472
push 1
push dword [0x431565]
call sub.user32.dll_EnableWindow
push 0
push dword [0x431561]
call sub.user32.dll_EnableWindow
push 1
push dword [0x431565]
call sub.user32.dll_ShowWindow
push 0
push dword [0x431561]
call sub.user32.dll_ShowWindow
push dword [0x431565]
call sub.user32.dll_SetFocus
leave
ret 4
Function at 0x41044f
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push 2
push 0xffffffffffffffff
push 0x100c
push dword [0x431318]
call sub.user32.dll_SendMessageA
cmp eax, 0xffffffff
jne 0x410477
pop ebx
leave
ret 4
mov dword [ebp - 4], eax
push 0x80
lea eax, [ebp - 0x84]
push eax
push dword [0x42c30a]
push dword [ebp - 4]
push dword [0x431318]
call fcn.00412740
push 0x80
push 0x40
call sub.kernel32.dll_GlobalAlloc
or eax, eax
jne 0x4104af
pop ebx
leave
ret 4
mov dword [ebp - 0x88], eax
mov byte [eax], 0
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x88]
call fcn.00411ac0
push dword [ebp + 8]
call sub.user32.dll_OpenClipboard
or eax, eax
jne 0x4104db
pop ebx
leave
ret 4
call sub.user32.dll_EmptyClipboard
push dword [ebp - 0x88]
call fcn.00411c00
inc eax
mov dword [ebp - 0x94], eax
push dword [ebp - 0x94]
push 2
call sub.kernel32.dll_GlobalAlloc
or eax, eax
jne 0x410518
push dword [ebp - 0x88]
call sub.kernel32.dll_GlobalFree
call sub.user32.dll_CloseClipboard
pop ebx
leave
ret 4
mov dword [ebp - 0x8c], eax
push dword [ebp - 0x8c]
call sub.kernel32.dll_GlobalLock
or eax, eax
jne 0x41054d
push dword [ebp - 0x88]
call sub.kernel32.dll_GlobalFree
push dword [ebp - 0x8c]
call sub.kernel32.dll_GlobalFree
call sub.user32.dll_CloseClipboard
pop ebx
leave
ret 4
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x94]
dec eax
push eax
push dword [ebp - 0x88]
push dword [ebp - 0x90]
call sub.kernel32.dll_RtlMoveMemory
push dword [ebp - 0x8c]
call sub.kernel32.dll_GlobalUnlock
push dword [ebp - 0x8c]
push 7
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
push 4
call fcn.004015db
push str.Information_copied_to_clipboard.
push 7
call fcn.004011f3
push dword [ebp - 0x88]
call sub.kernel32.dll_GlobalFree
pop ebx
leave
ret 4
Function at 0x4110b9
Capabilities:
Get file size
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
lea eax, [ebp - 0x38]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4110f3
mov eax, 0xffffffff
leave
ret 4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x411122
cmp dword [ebp - 0x14], 0
jne 0x411122
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, 0xffffffff
leave
ret 4
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 4]
call sub.kernel32.dll_CreateFileMappingA
or eax, eax
jne 0x411149
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, 0xffffffff
leave
ret 4
mov dword [ebp - 8], eax
push 0
push dword [ebp - 0x3c]
push 0
push 0
push 4
push dword [ebp - 8]
call sub.kernel32.dll_MapViewOfFileEx
or eax, eax
jne 0x411192
push 0
push 0
push 0
push 0
push 4
push dword [ebp - 8]
call sub.kernel32.dll_MapViewOfFileEx
or eax, eax
jne 0x411192
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, 0xffffffff
leave
ret 4
mov dword [ebp - 0xc], eax
mov eax, dword [eax]
cmp eax, 0x20464942
je 0x4111ac
cmp eax, 0x43464942
je 0x4111ac
cmp eax, 0x46464942
jne 0x4111b5
mov dword [ebp - 0x40], 1
jmp 0x4111f1
cmp eax, 0x204d4952
jne 0x4111c5
mov dword [ebp - 0x40], 2
jmp 0x4111f1
cmp eax, 0x20465245
je 0x4111e1
cmp eax, 0x20444f4d
je 0x4111e1
cmp eax, 0x204b4148
je 0x4111e1
cmp eax, 0x204d574e
jne 0x4111ea
mov dword [ebp - 0x40], 3
jmp 0x4111f1
mov dword [ebp - 0x40], 0
push dword [ebp - 0xc]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x40]
leave
ret 4

Function at 0x4119d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add dword [ebp + 8], 1
call sub.kernel32.dll_GetCommandLineA
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
push eax
call fcn.00411ce0
cmp eax, 0
jb 0x411a05
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0
je 0x4119fe
mov eax, 1
jmp 0x411a0f
mov eax, 2
jmp 0x411a0f
cmp eax, 0xffffffff
jne 0x411a0f
mov eax, 3
leave
ret 8
Function at 0x411e30
Capabilities:
Check os version
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd4c
push 0x104
lea eax, [ebp - 0x198]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 0x198]
push eax
call sub.kernel32.dll_lstrlenA
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2ac], 0
lea esi, [ebp - 0x198]
add esi, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x2a8]
jmp 0x411e8f
movzx eax, byte [esi]
cmp al, 0x2e
jne 0x411e8d
mov dword [ebp - 0x2ac], ecx
jmp 0x411e94
dec esi
dec ecx
cmp ecx, 0
jae 0x411e7c
cmp dword [ebp - 0x2ac], 0
jne 0x411ea6
mov eax, 0
leave
ret 8
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x2b0], 0
lea esi, [ebp - 0x198]
add esi, dword [ebp - 0x2ac]
mov ecx, dword [ebp - 0x2ac]
jmp 0x411ef9
movzx eax, byte [esi]
cmp al, 0x5c
jne 0x411ef7
mov dword [ebp - 0x2b0], ecx
jmp 0x411efe
dec esi
dec ecx
cmp ecx, 0
jae 0x411ee6
cmp dword [ebp - 0x2b0], 0
jne 0x411f10
mov eax, 0
leave
ret 8
lea edi, [ebp - 0x29c]
lea esi, [ebp - 0x198]
add esi, dword [ebp - 0x2b0]
inc esi
mov ecx, dword [ebp - 0x2b0]
inc ecx
jmp 0x411f34
movzx eax, byte [esi]
mov byte [edi], al
inc esi
inc edi
inc ecx
cmp ecx, dword [ebp - 0x2ac]
jb 0x411f2c
mov byte [edi], 0
cmp dword [ebp - 0x2b4], 5
jbe 0x411fd9
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [ebp - 0x2a0], eax
lea eax, [ebp - 0x2a4]
push eax
push 0x1a
push dword [ebp - 0x2a0]
call sub.shell32.dll_SHGetSpecialFolderLocation
push dword [ebp + 8]
push dword [ebp - 0x2a4]
call sub.shell32.dll_SHGetPathFromIDListA
push 0x42fe80
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x29c]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
push dword [ebp + 8]
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0x10
je 0x411fae
push 0
push dword [ebp + 8]
call sub.kernel32.dll_CreateDirectoryA
push 0x42fe80
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x29c]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
push 0x42fe87
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x412001
inc dword [ebp - 0x2ac]
push dword [ebp - 0x2ac]
lea eax, [ebp - 0x198]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_lstrcpynA
push 0x42fe87
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
cmp dword [ebp + 0xc], 0
je 0x412016
lea eax, [ebp - 0x29c]
push eax
push dword [ebp + 0xc]
call sub.kernel32.dll_lstrcpyA
mov eax, 1
leave
ret 8
Function at 0x412180
Capabilities:
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push edi
push esi
push ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
cmp al, 0
je 0x4121df
cmp al, 0x2e
jne 0x4121b2
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
cmp al, 0x5c
jne 0x4121d9
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov byte [esi], 0
push dword [ebp + 8]
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0x10
je 0x4121d6
push 0
push dword [ebp + 8]
call sub.kernel32.dll_CreateDirectoryA
mov byte [esi], 0x5c
inc esi
inc dword [ebp - 0xc]
jmp 0x4121a1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jae 0x4121fe
push dword [ebp + 8]
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0x10
je 0x4121fe
push 0
push dword [ebp + 8]
call sub.kernel32.dll_CreateDirectoryA
mov eax, 1
pop ecx
pop esi
pop edi
leave
ret 4
Function at 0x416710
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
cmp dword [ebp + 0xc], 1
jne 0x416736
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
jmp 0x41674d
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x41675c
mov eax, 0
pop ebx
leave
ret 8
mov dword [ebp - 8], eax
push 0
push dword [ebp - 8]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], 1
jne 0x416786
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 8]
call sub.kernel32.dll_CreateFileMappingA
jmp 0x416798
push 0
push 0
push 0
push 4
push 0
push dword [ebp - 8]
call sub.kernel32.dll_CreateFileMappingA
or eax, eax
jne 0x4167a6
mov eax, 0
pop ebx
leave
ret 8
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0xc], 1
jne 0x4167c3
push 0
push 0
push 0
push 0
push 4
push dword [ebp - 0x14]
call sub.kernel32.dll_MapViewOfFileEx
jmp 0x4167d8
push 0
push 0
push 0
push 0
push 0xf001f
push dword [ebp - 0x14]
call sub.kernel32.dll_MapViewOfFileEx
or eax, eax
jne 0x4167e6
mov eax, 0
pop ebx
leave
ret 8
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
call fcn.0041857e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41681e
push dword [ebp - 0x18]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 0x14]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
mov eax, 0
pop ebx
leave
ret 8
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp + 8]
push dword [ebp - 0x18]
call fcn.00416ada
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41685a
push dword [ebp - 0x18]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 0x14]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
mov eax, 0
pop ebx
leave
ret 8
cmp dword [ebp + 0xc], 0
jne 0x41687a
push dword [ebp - 0x18]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 0x14]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
jmp 0x41688f
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x134], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x138], eax
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x10c], eax
mov eax, dword [ebp - 4]
pop ebx
leave
ret 8
Function at 0x418a32
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push edx
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
cmp dword [ebp + 0x18], 1
jne 0x418a64
push 0
push dword [ebp - 0x28]
push 0
push 0
push 4
push dword [ebp + 0xc]
call sub.kernel32.dll_MapViewOfFileEx
jmp 0x418a7a
push 0
push dword [ebp - 0x28]
push 0
push 0
push 0xf001f
push dword [ebp + 0xc]
call sub.kernel32.dll_MapViewOfFileEx
or eax, eax
jne 0x418a93
mov ebx, dword [ebp + 0x1c]
mov eax, 0
mov dword [ebx], eax
mov eax, 0
pop edx
pop ebx
leave
ret 0x18
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], eax
push dword [ebp - 0x2c]
call fcn.0041ab50
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
je 0x418ab4
cmp dword [ebp - 0x30], 4
jne 0x418ba1
mov ebx, dword [ebp - 0x34]
mov eax, dword [ebx + 8]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x30], 4
jne 0x418acc
mov dword [ebp - 0x3c], 0
jmp 0x418ad2
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x30], 4
jne 0x418ae8
mov ebx, 0x14
jmp 0x418aed
mov ebx, 0x10
mul ebx
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x30], 4
jne 0x418b01
mov dword [ebp - 0x44], 0
jmp 0x418b0e
mov eax, dword [ebp - 0x3c]
mov ebx, 0x14
mul ebx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov ebx, dword [ebp - 0x28]
div ebx
cmp edx, 0
jbe 0x418b37
mov ebx, dword [ebp - 0x4c]
sub ebx, edx
add ebx, dword [ebp - 0x28]
mov dword [ebp - 0x50], ebx
push dword [ebp - 0x2c]
call sub.kernel32.dll_UnmapViewOfFile
cmp dword [ebp + 0x18], 1
jne 0x418b5a
push 0
push dword [ebp - 0x50]
push 0
push 0
push 4
push dword [ebp + 0xc]
call sub.kernel32.dll_MapViewOfFileEx
jmp 0x418b70
push 0
push dword [ebp - 0x50]
push 0
push 0
push 0xf001f
push dword [ebp + 0xc]
call sub.kernel32.dll_MapViewOfFileEx
or eax, eax
jne 0x418b89
mov ebx, dword [ebp + 0x1c]
mov eax, 0
mov dword [ebx], eax
mov eax, 0
pop edx
pop ebx
leave
ret 0x18
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp + 0x1c]
mov eax, 1
mov dword [ebx], eax
mov eax, dword [ebp - 0x2c]
pop edx
pop ebx
leave
ret 0x18
push dword [ebp - 0x2c]
call sub.kernel32.dll_UnmapViewOfFile
mov ebx, dword [ebp + 0x1c]
mov eax, 0
mov dword [ebx], eax
mov eax, 0
pop edx
pop ebx
leave
ret 0x18
Function at 0x419c2f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x28]
jae 0x419c5a
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x28]
mov dword [ebx], eax
jmp 0x419c83
mov eax, dword [ebp + 8]
xor edx, edx
mov ebx, dword [ebp - 0x28]
div ebx
cmp edx, 0
jbe 0x419c7b
mov eax, dword [ebp + 8]
sub eax, edx
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x28]
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
jmp 0x419c83
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x28]
jae 0x419c9f
mov ebx, dword [ebp - 0x28]
sub ebx, eax
mov dword [ebp - 0x2c], ebx
mov eax, 0
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
jmp 0x419ccc
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ebx, dword [ebp - 0x28]
div ebx
cmp edx, 0
jbe 0x419cbd
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp + 0xc]
sub eax, edx
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
jmp 0x419ccc
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
pop ebx
leave
ret 0x10