joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b26c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
mov ebx, 0x94
push 0x4812a4
mov dword [0x481758], esi
mov dword [0x48175c], esi
mov dword [0x481764], 2
mov dword [0x481588], esi
mov byte [0x48163c], 1
mov dword [0x481244], eax
mov dword [0x48124c], esi
mov dword [0x481248], esi
mov dword [0x481240], esi
mov dword [0x4812a4], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x38
push esi
push 0x481360
mov dword [0x48197c], esi
call fcn.00426f90
push 0x4c
push esi
push 0x4811e0
call fcn.00426f90
push 0x28
push esi
push 0x481890
call fcn.00426f90
push 0x38
push esi
push 0x4813c8
call fcn.00426f90
mov edi, 0x104
mov dword [0x4813dc], 0x426cf7
push edi
mov dword [0x4813c8], 0x426ccb
mov dword [0x4813cc], 0x426d23
mov dword [0x4813d4], 0x426da4
mov dword [0x4813d0], 0x426e38
mov dword [0x4813d8], 0x426ed8
mov dword [0x4813f4], 0x41fd46
mov dword [0x4813fc], 0x41fc49
mov dword [0x4813f0], 0x41f975
mov dword [0x4813f8], 0x41f619
mov dword [0x4813ec], 0x481258
call fcn.00427869
add esp, 0x34
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x41b39b
mov ecx, 0x481a44
call fcn.0041f120
push eax
call fcn.0041fd97
pop ecx
push edi
push esi
push dword [ebp + 8]
call fcn.00426f90
add esp, 0xc
push edi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp + 8]
mov ecx, 0x4817d0
call fcn.0041e314
push dword [ebp + 8]
call fcn.0042785e
cmp dword [0x481800], esi
pop ecx
jne 0x41b3e0
push 0x4817d0
mov ecx, 0x481800
call fcn.0041e382
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0xc]
call fcn.0041e237
lea ecx, [ebp - 0xc]
call fcn.0041f16a
push 1
push esi
push str._SILENT
lea ecx, [ebp - 0xc]
call fcn.0041ead2
or edi, 0xffffffff
cmp eax, edi
je 0x41b415
mov byte [0x48239c], 1
push 1
push esi
push str._REVERT
lea ecx, [ebp - 0xc]
call fcn.0041ead2
cmp eax, edi
je 0x41b430
mov byte [0x4823ed], 1
push ebx
lea eax, [ebp - 0xa0]
push esi
push eax
mov dword [0x4817e0], edi
mov dword [0x4817e4], edi
mov dword [0x4817e8], edi
mov dword [0x4817ec], edi
mov dword [0x4817f0], edi
mov dword [0x4817f4], edi
mov dword [0x4817f8], edi
mov dword [0x4817fc], edi
call fcn.00426f90
add esp, 0xc
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 2
jne 0x41b499
mov dword [0x481264], 1
jmp 0x41b4b8
mov eax, dword [ebp - 0x94]
mov dword [0x481264], esi
and eax, 0xffff
cmp eax, 0x3e8
ja 0x41b4b8
mov byte [0x481361], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push str._InstallerCommandLine_
call fcn.0041f619
lea ecx, [ebp - 0xc]
call fcn.0041e2fd
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41bd92
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
mov esi, 0x4813b8
push edi
push 0x2c
mov ecx, esi
call fcn.0041ecff
push 0x28
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.0041ecff
xor edi, edi
mov dword [ebp - 0x18], eax
cmp eax, edi
mov dword [ebp - 8], edi
jle 0x41beff
mov esi, 0x481668
mov ebx, 0x42ea8c
lea ecx, [ebp - 0x14]
call fcn.0041e1c7
push 4
mov ecx, 0x481800
push dword [ebp - 4]
call fcn.0041f120
push eax
lea ecx, [ebp - 0x14]
call fcn.0041eec7
add dword [ebp - 4], 4
lea eax, [ebp - 0x11c]
push str..TTF
push eax
call fcn.004200c8
pop ecx
pop ecx
push 1
pop eax
mov dword [0x48233c], eax
mov dword [0x481358], eax
mov eax, dword [0x4823ac]
cmp eax, edi
je 0x41be26
push eax
call fcn.0042785e
pop ecx
push 4
call fcn.00427869
pop ecx
mov dword [0x4823ac], eax
push edi
lea ecx, [ebp - 0x14]
call fcn.0041ecff
add eax, dword [ebp - 4]
mov ecx, dword [0x4823ac]
push edi
mov dword [ecx], eax
lea ecx, [ebp - 0x14]
call fcn.0041ecff
push eax
lea eax, [ebp - 0x11c]
push dword [ebp - 4]
mov ecx, 0x481800
push eax
call fcn.0041f120
push eax
call fcn.00401ac0
add esp, 0x10
test eax, eax
jne 0x41bf06
push edi
lea ecx, [ebp - 0x14]
call fcn.0041ecff
add dword [ebp - 4], eax
lea eax, [ebp - 0x220]
push str..FOT
push eax
call fcn.004200c8
pop ecx
lea eax, [ebp - 0x11c]
pop ecx
push edi
push eax
lea eax, [ebp - 0x220]
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateScalableFontResourceA]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceA]
lea eax, [ebp - 0x220]
push edi
push eax
mov ecx, esi
call fcn.0041e449
push edi
push ebx
mov ecx, esi
call fcn.0041e449
lea eax, [ebp - 0x11c]
push edi
push eax
mov ecx, esi
call fcn.0041e449
push edi
push ebx
mov ecx, esi
call fcn.0041e449
lea ecx, [ebp - 0x14]
call fcn.0041e2fd
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jl 0x41bdd2
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x14]
call fcn.0041e2fd
xor al, al
jmp 0x41bf01

Function at 0x41bf1f
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0x481430
lea ecx, [ebp - 0xc]
call fcn.0041e29b
xor ebx, ebx
lea ecx, [ebp - 0xc]
push ebx
push str._inst_m
call fcn.0041e449
lea ecx, [ebp - 0xc]
call fcn.0041f120
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41bf9c
mov ecx, 0x481980
call fcn.0041f120
push eax
push str.AstrumInstaller
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
cmp esi, ebx
je 0x41bf9a
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x41bf93
push 3
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov bl, 1
lea ecx, [ebp - 0xc]
call fcn.0041e2fd
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x41c061
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
push ebx
xor ebx, ebx
cmp dword [0x48171c], ebx
push esi
je 0x41c0e3
lea eax, [ebp - 4]
mov ecx, 0x481684
push eax
push 0x20019
push ebx
mov dword [ebp - 4], ebx
call fcn.0041f120
push eax
push dword [0x481680]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41c0e3
push edi
push 0x4d
pop ecx
lea edi, [ebp - 0x19f]
mov byte [ebp - 0x1a0], bl
mov dword [ebp - 0x14], 0x136
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1a0]
push eax
push ebx
push ebx
push str.AutorunCommand
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
pop edi
je 0x41c0ea
xor al, al
jmp 0x41c176
lea eax, [ebp - 0x1a0]
lea ecx, [ebp - 0x10]
push eax
call fcn.0041e237
push ebx
lea ecx, [ebp - 0x10]
call fcn.0041e3e5
cmp al, 0x22
je 0x41c11b
push ebx
push 0x22
lea ecx, [ebp - 0x10]
call fcn.0041ee03
push 0x22
lea ecx, [ebp - 0x10]
call fcn.0041e3fa
push 0x44
lea eax, [ebp - 0x68]
pop esi
push esi
push ebx
push eax
call fcn.00426f90
push 0x10
lea eax, [ebp - 0x24]
push ebx
push eax
mov dword [ebp - 0x68], esi
call fcn.00426f90
add esp, 0x18
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x10]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
call fcn.0041f120
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x41c16c
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea ecx, [ebp - 0x10]
call fcn.0041e2fd
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x41d3e9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x481718], edi
mov esi, ecx
mov ebx, 0x42eb7c
je 0x41d461
and byte [ebp - 0x110], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add esi, 0x124
lea eax, [ebp - 0x110]
push eax
mov ecx, esi
call fcn.0041e314
mov eax, dword [esi]
mov ecx, esi
dec eax
push eax
call fcn.0041e3e5
cmp al, 0x5c
jne 0x41d48f
mov eax, dword [esi]
push 1
dec eax
mov ecx, esi
push eax
call fcn.0041e7ab
jmp 0x41d48f
add esi, 0x124
push 0x4817d0
mov ecx, esi
call fcn.0041e382
push 1
push edi
push ebx
mov ecx, esi
call fcn.0041ebdd
push eax
push edi
mov ecx, esi
call fcn.0041f097
push eax
mov ecx, esi
call fcn.0041e382
cmp dword [0x481718], 0
je 0x41d52d
and byte [ebp - 0x110], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
lea ecx, [ebp - 0xc]
push eax
call fcn.0041e237
push 1
push esi
push ebx
lea ecx, [ebp - 0xc]
call fcn.0041ebdd
cmp eax, 0xffffffff
je 0x41d525
mov ecx, dword [ebp - 0xc]
sub ecx, eax
push ecx
push eax
lea ecx, [ebp - 0xc]
call fcn.0041e7ab
push 1
push esi
push ebx
lea ecx, [ebp - 0xc]
call fcn.0041ebdd
cmp eax, 0xffffffff
je 0x41d525
mov ecx, dword [ebp - 0xc]
sub ecx, eax
push ecx
push eax
lea ecx, [ebp - 0xc]
call fcn.0041e7ab
lea eax, [ebp - 0xc]
mov ecx, 0x48172c
push eax
call fcn.0041e382
lea ecx, [ebp - 0xc]
jmp 0x41d5eb
and byte [ebp - 0x110], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [ebp - 0x110], 0
je 0x41d5f0
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x111], 0x5c
je 0x41d588
lea eax, [ebp - 0x110]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea ecx, [ebp - 0xc]
and esi, 0x7fffffff
call fcn.0041e1c7
push 0x431188
lea ecx, [ebp - 0xc]
call fcn.0041e314
mov eax, esi
inc esi
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0xc]
push str._sinst_d
push eax
call fcn.0041e869
add esp, 0x10
lea ecx, [ebp - 0xc]
call fcn.0041f120
push eax
call fcn.0040efbd
test al, al
pop ecx
jne 0x41d59e
lea eax, [ebp - 0xc]
mov ecx, 0x48172c
push eax
call fcn.0041e382
lea ecx, [ebp - 0xc]
call fcn.0041e2fd
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41d841
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea esi, [ecx + 0x158]
xor ebx, ebx
push edi
mov ecx, dword [esi]
cmp ecx, ebx
je 0x41d85e
push ebx
call fcn.00407d9b
mov dword [esi], ebx
push dword [0x48124c]
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [0x481880], ebx
je 0x41d8a1
cmp byte [0x4823a9], 0
je 0x41d885
push ebx
call dword [0x481824]
pop ecx
cmp byte [0x4823a8], 0
je 0x41d897
push 1
call dword [0x481824]
pop ecx
mov ecx, 0x481820
call fcn.00420ff2
mov ecx, 0x481398
call fcn.0041e12f
cmp byte [ebp + 8], 0
je 0x41d8c7
mov eax, dword [0x48238c]
cmp eax, ebx
je 0x41d8c7
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x48238c], ebx
cmp dword [0x481894], ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp + 8], ebx
jle 0x41d900
xor edi, edi
mov eax, dword [0x481890]
cmp dword [edi + eax], ebx
lea ecx, [edi + eax]
jbe 0x41d8ef
call fcn.0041f120
push eax
call esi
inc dword [ebp + 8]
add edi, 0xc
mov eax, dword [ebp + 8]
cmp eax, dword [0x481894]
jl 0x41d8da
cmp dword [0x481624], ebx
mov dword [ebp + 8], ebx
mov edi, 0x481618
jle 0x41d94a
push dword [ebp + 8]
mov ecx, edi
call fcn.004211d1
mov ebx, eax
lea ecx, [ebx + 4]
call fcn.0041f120
push eax
call esi
test ebx, ebx
je 0x41d93a
lea ecx, [ebx + 4]
call fcn.0041e2fd
push ebx
call fcn.0042785e
pop ecx
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [0x481624]
jl 0x41d910
xor ebx, ebx
mov ecx, edi
call fcn.00421292
lea ecx, [ebp - 0x10]
call fcn.0041e1c7
mov dword [ebp - 4], ebx
push ebx
mov edi, 0x481668
mov ecx, edi
call fcn.0041edd4
test al, al
je 0x41d9a1
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
inc ebx
call fcn.0041ed31
test bl, 1
je 0x41d991
lea ecx, [ebp - 0x10]
call fcn.0041f120
push eax
call dword [sym.imp.GDI32.dll_RemoveFontResourceA]
lea ecx, [ebp - 0x10]
call fcn.0041f120
push eax
call esi
push dword [ebp - 4]
jmp 0x41d962
push 0x431188
mov ecx, edi
call fcn.0041e314
mov ecx, 0x481064
call fcn.0041f120
push eax
call esi
mov ecx, 0x481070
call fcn.0041f120
push eax
call esi
mov ecx, 0x481058
call fcn.0041f120
push eax
call esi
mov ecx, 0x4818b8
call fcn.0041f120
push eax
call esi
push dword [0x481248]
call dword [sym.imp.GDI32.dll_DeleteObject]
lea ecx, [ebp - 0x10]
call fcn.0041e2fd
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41d9ff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x14]
call fcn.0041e1c7
push str.___Internal_InstallationNotFound___
call fcn.0041f975
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x41da2c
mov esi, str.The__s_installation_couldnt_be_found._Try_re_installing_the_application_before_running_the_update.
mov ecx, 0x481424
call fcn.0041f120
push eax
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0041e869
add esp, 0xc
lea eax, [ebp - 4]
mov ecx, 0x481684
push eax
push 0x20019
push ebx
call fcn.0041f120
push eax
push dword [0x481680]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41dad0
cmp dword [0x481690], ebx
jne 0x41da87
cmp dword [0x48169c], ebx
jne 0x41da87
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41db12
mov eax, 0x104
mov dword [ebp - 8], eax
push eax
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.00426f90
add esp, 0xc
lea eax, [ebp - 8]
mov ecx, 0x481690
push eax
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
call fcn.0041f120
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41db0a
cmp dword [0x4817c4], ebx
je 0x41daf3
and dword [0x481254], 0xffffffbf
push ebx
push str._IsUpdate_
call fcn.0041fc49
mov ecx, edi
call fcn.00417cde
jmp 0x41db12
push ebx
lea ecx, [ebp - 0x14]
call fcn.0041f120
push eax
push ebx
mov ecx, 0x481080
call fcn.0041d5f5
jmp 0x41db36
cmp dword [0x48169c], ebx
jne 0x41db16
mov bl, 1
jmp 0x41db36
test byte [0x481259], 0x20
lea eax, [ebp - 0x118]
mov ecx, edi
push eax
je 0x41db2f
call fcn.0041db45
jmp 0x41db34
call fcn.0041dcec
mov bl, al
lea ecx, [ebp - 0x14]
call fcn.0041e2fd
pop edi
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x41eec7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x41eefd
push 0xfffffffffffffffd
pop eax
jmp 0x41efc4
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [ebp - 4]
push 2
push ecx
push ebx
push eax
mov dword [ebp - 4], ebx
call edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push ebx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call edi
mov ecx, dword [ebp - 0xc]
cmp dword [ebp + 0xc], ecx
jbe 0x41ef2e
mov dword [ebp + 0xc], ecx
sub ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
cmp ecx, eax
jb 0x41ef3e
cmp eax, ebx
ja 0x41ef40
mov dword [esi], ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esi]
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi], ebx
mov dword [esi + 8], eax
jne 0x41ef7a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x41efc4
cmp dword [esi + 4], ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x41ef9b
push dword [ebp + 8]
call edi
mov ecx, 0x481a44
call fcn.0041f120
push eax
call fcn.0041fd97
pop ecx
lea eax, [ebp - 8]
push ebx
push eax
mov dword [ebp - 8], ebx
push dword [esi]
push dword [esi + 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 8]
call edi
mov ecx, dword [ebp - 8]
xor eax, eax
cmp ecx, dword [esi]
sete al
dec eax
and al, 0xfe
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x41f210
Capabilities:
Check if file exists
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41f22d
xor ebx, ebx
xor esi, esi
test bl, 2
je 0x41f237
push 2
pop esi
test bl, 0x20
je 0x41f23f
or esi, 0x20
test esi, esi
jne 0x41f248
mov esi, 0x80
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test bl, 1
je 0x41f25d
mov eax, ebx
and al, 0xfe
push eax
push dword [ebp + 8]
call edi
xor eax, eax
push eax
push esi
push 2
push eax
push eax
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41f27e
push 0xfffffffffffffffd
jmp 0x41f2b8
lea eax, [ebp - 4]
push 0
push eax
mov eax, dword [ebp - 8]
and dword [ebp - 4], 0
push dword [eax]
push dword [eax + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp eax, dword [ecx]
je 0x41f2ac
push 0xfffffffffffffffe
jmp 0x41f2b8
test ebx, ebx
je 0x41f2b6
push ebx
push dword [ebp + 8]
call edi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41fe27
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
push 0x431188
call fcn.0041e314
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, 0xfffffc00
mov ecx, edx
and eax, esi
test ecx, ecx
ja 0x41fe7a
jb 0x41fe59
cmp eax, 0x100000
jae 0x41fe7a
mov eax, dword [ebp + 8]
push 0xa
pop ecx
call fcn.00427c60
push eax
push str._d_KB
push dword [ebp + 0x10]
call fcn.0041e869
add esp, 0xc
jmp 0x41ffab
mov eax, dword [ebp + 8]
push 0xa
pop ecx
call fcn.00427c60
and byte [ebp - 0xc], 0
mov ebx, eax
xor eax, eax
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
push 0xa
push eax
push 0xe
push 0x400
mov dword [ebp + 0xc], edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x41febc
lea eax, [ebp - 0xc]
push 0x42ef58
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [ebp + 0xc]
mov eax, ebx
mov ecx, edi
and eax, esi
test ecx, ecx
ja 0x41ff0b
jb 0x41fed2
cmp eax, 0x100000
jae 0x41ff0b
push 0xa
mov eax, ebx
pop ecx
mov edx, edi
call fcn.00427c60
mov esi, eax
xor ecx, ecx
shl eax, 0xa
sub ebx, eax
push ecx
sbb edi, ecx
push 0x64
push edi
push ebx
call fcn.00427de0
cmp eax, 0xa
jb 0x41fefb
push 9
pop eax
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str._d_s_d_MB
jmp 0x41ffa0
push 0xa
mov eax, ebx
pop ecx
mov edx, edi
call fcn.00427c60
mov edi, eax
mov ebx, edx
and eax, esi
test ebx, ebx
ja 0x41ff60
jb 0x41ff2a
cmp eax, 0x100000
jae 0x41ff60
push 0xa
mov eax, edi
pop ecx
mov edx, ebx
call fcn.00427c60
mov esi, eax
xor ecx, ecx
shl eax, 0xa
sub edi, eax
push ecx
sbb ebx, ecx
push 0x64
push ebx
push edi
call fcn.00427de0
cmp eax, 0xa
jb 0x41ff53
push 9
pop eax
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str._d_s_d_GB
jmp 0x41ffa0
push 0xa
mov eax, edi
pop ecx
mov edx, ebx
call fcn.00427c60
push 0xa
mov esi, eax
pop ecx
mov edi, edx
call fcn.00427c60
mov ebx, eax
xor ecx, ecx
shl eax, 0xa
sub esi, eax
push ecx
sbb edi, ecx
push 0x64
push edi
push esi
call fcn.00427de0
cmp eax, 0xa
jb 0x41ff95
push 9
pop eax
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str._d_s_d_TB
push dword [ebp + 0x10]
call fcn.0041e869
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41ffb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
xor esi, esi
cmp eax, esi
push edi
jne 0x41ffc7
or eax, 0xffffffff
jmp 0x420068
mov dword [eax], esi
lea eax, [ebp + 8]
push eax
push 1
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x420065
lea eax, [ebp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], esi
push dword [ebp + 8]
call edi
test eax, eax
jne 0x420061
mov eax, dword [ebp + 0xc]
inc eax
push eax
call fcn.00427869
mov ebx, eax
pop ecx
cmp ebx, esi
jne 0x420022
mov ecx, 0x481a44
call fcn.0041f120
push eax
call fcn.0041fd97
pop ecx
mov eax, dword [ebp + 0xc]
inc eax
push eax
push esi
push ebx
call fcn.00426f90
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x420056
mov eax, dword [ebp + 0x14]
push dword [ebp + 8]
mov dword [eax], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
jmp 0x420067
push ebx
call fcn.0042785e
pop ecx
push 0xfffffffffffffffe
jmp 0x420067
push 0xfffffffffffffffd
jmp 0x420067
push 0xfffffffffffffffc
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4200c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, 0x104
push edi
push esi
push 0
push dword [ebp + 8]
call fcn.00426f90
push esi
call fcn.00427869
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x420101
mov ecx, 0x481a44
call fcn.0041f120
push eax
call fcn.0041fd97
pop ecx
push esi
push 0
push edi
call fcn.00426f90
add esp, 0xc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
jne 0x420129
push 0x430648
push edi
call esi
jmp 0x420138
add eax, edi
cmp byte [eax - 1], 0x5c
je 0x420138
mov byte [eax], 0x5c
and byte [eax + 1], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
lea ebx, [eax + edi]
mov eax, dword [ebp - 4]
and byte [ebx], 0
inc dword [ebp - 4]
lea ecx, [ebp - 0x14]
push 0xa
push ecx
push eax
call fcn.00428d35
add esp, 0xc
push 0x430644
push edi
call esi
lea eax, [ebp - 0x14]
push eax
push edi
call esi
push dword [ebp + 0xc]
push edi
call esi
push edi
call fcn.0040efbd
test al, al
pop ecx
jne 0x42014c
push edi
push dword [ebp + 8]
call esi
push edi
call fcn.0042785e
mov eax, dword [ebp + 8]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x420af3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push esi
push str.GetSystemWindowsDirectoryA
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x420b22
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x420b80
push edi
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0x90]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x84], 2
pop edi
push dword [ebp + 0xc]
push dword [ebp + 8]
jne 0x420b7a
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
test esi, esi
je 0x420b80
push 0x5c
push dword [ebp + 8]
call fcn.004277b0
pop ecx
test eax, eax
pop ecx
je 0x420b76
and byte [eax], 0
mov eax, esi
jmp 0x420b80
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
pop esi
leave
ret