joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408cf0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes

Disassembly:
sub esp, 0x22c
mov eax, dword [0x451aa8]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
mov ebx, dword [esp + 0x234]
push ebp
push esi
push edi
push 0
mov edi, ecx
call fcn.00407cb0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [edi + 0x26c]
lea ecx, [edi + 0x26c]
mov dword [esp + 0x10], eax
lea eax, [edi + 0x2a4]
push 0
push eax
call dword [edx + 0x20]
push eax
mov eax, dword [edi + 0x274]
lea ecx, [edi + 0x274]
call dword [eax + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CreatePipe]
push eax
call esi
test eax, eax
je 0x408ed9
push 0
lea eax, [edi + 0x2a4]
lea ecx, [edi + 0x27c]
push eax
mov eax, dword [ecx]
call dword [eax + 0x20]
push eax
mov eax, dword [edi + 0x28c]
lea ecx, [edi + 0x28c]
call dword [eax + 0x20]
push eax
call esi
test eax, eax
je 0x408ed9
mov eax, dword [edi + 0x284]
lea ecx, [edi + 0x284]
mov esi, dword [edi + 0x290]
push 2
push 0
push 0
call dword [eax + 0x20]
push eax
mov eax, dword [esp + 0x20]
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x408ed9
mov eax, dword [edi + 0x28c]
lea ecx, [edi + 0x28c]
call dword [eax + 4]
push 0x44
lea esi, [edi + 0x2b0]
push 0
push esi
call fcn.00423da0
mov eax, dword [edi + 0x14]
add esp, 0xc
shr eax, 9
and al, 1
mov dword [esi], 0x44
movzx eax, al
mov word [edi + 0x2e0], ax
mov eax, dword [edi + 0x280]
mov dword [edi + 0x2ec], eax
mov dword [edi + 0x2f0], eax
mov eax, dword [edi + 0x278]
mov dword [edi + 0x2e8], eax
mov eax, dword [edi + 0x1c]
mov dword [edi + 0x2dc], 0x101
cmp word [eax], 0
je 0x408ec9
push dword [edi + 0x24]
lea ecx, [edi + 0x3c]
push eax
call fcn.00413140
mov eax, dword [edi + 0x2c]
cmp word [eax], 0
je 0x408e6d
lea ecx, [esp + 0x14]
call fcn.004045f0
push 0
push dword [edi + 0x2c]
lea ecx, [esp + 0x1c]
call fcn.00413760
test al, al
je 0x408e64
mov eax, dword [esp + 0x24]
mov dword [edi + 0x260], eax
lea ecx, [esp + 0x14]
call fcn.00405c10
mov eax, dword [edi + 0x14]
shr eax, 0xa
test al, 1
je 0x408e80
mov ecx, edi
call fcn.0040a300
jmp 0x408eac
lea eax, [edi + 0x294]
push eax
push esi
push dword [edi + 0x260]
push 0
push dword [edi + 0x268]
push 1
push 0
push 0
push dword [edi + 0x4c]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
test al, al
jne 0x408ec2
push dword [edi + 0x4c]
mov ecx, ebx
call fcn.0040fc00
test al, al
jne 0x408ec2
xor eax, eax
jmp 0x408edb
mov eax, 1
jmp 0x408edb
mov eax, dword [ebx]
mov ecx, ebx
push str.Invalid_application
mov eax, dword [eax + 4]
call eax
jmp 0x408edb
xor al, al
mov ecx, dword [esp + 0x238]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00422b84
add esp, 0x22c
ret 4
Function at 0x409130
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
mov ebx, ecx
cmp byte [ebx + 0x260], 0
je 0x40916b
call fcn.0040ae00
movzx eax, al
mov dword [ebx + 0x128], eax
test eax, eax
jne 0x40915d
mov ecx, dword [esp + 8]
push dword [ebx + 0xe0]
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebx + 0x128], 0
pop ebx
setne al
ret 4
push esi
mov esi, dword [ebx + 0x1bc]
lea eax, [ebx + 0x25c]
push edi
push eax
push 4
push ebx
push 0x4149b0
push dword [ebx + 0x258]
push 0
call fcn.00422739
add esp, 0x18
lea ecx, [ebx + 0x1bc]
push eax
call dword [esi + 8]
mov eax, dword [ebx + 0x1bc]
lea ecx, [ebx + 0x1bc]
mov eax, dword [eax + 0x10]
call eax
pop edi
pop esi
test al, al
je 0x4091ef
mov eax, dword [ebx + 0x254]
cmp eax, 3
jge 0x4091d1
push dword [eax*4 + 0x43fa2c]
push dword [ebx + 0x1c0]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebx + 0x14]
shr eax, 0xb
not al
test al, 1
je 0x4091e9
push dword [ebx + 0x1c0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
pop ebx
ret 4
mov ecx, dword [esp + 8]
pop ebx
mov dword [esp + 4], str.Cannot_create_thread
mov eax, dword [ecx]
mov eax, dword [eax + 4]
jmp eax

Function at 0x4095c0
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x35c]
or dword [eax + 0x268], 3
mov edx, dword [esi + 0x35c]
lea eax, [edx + 0x294]
push eax
lea eax, [edx + 0x2b0]
push eax
push dword [edx + 0x260]
push 0
push dword [edx + 0x268]
push 1
push 0
push 0
push dword [edx + 0x4c]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne bl
cmp byte [0x4d4c48], 0
je 0x40963d
cmp byte [0x4d4c90], 0
je 0x40963d
mov eax, dword [esi + 0x35c]
push dword [eax + 0x294]
push str.CreateProcess:_Info.hProcess__p
push 0
push 8
push 0x454bf0
call fcn.00417130
add esp, 0x14
push dword [esi + 0x350]
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
mov al, bl
pop ebx
ret

Function at 0x4095c1
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x35c]
or dword [eax + 0x268], 3
mov edx, dword [esi + 0x35c]
lea eax, [edx + 0x294]
push eax
lea eax, [edx + 0x2b0]
push eax
push dword [edx + 0x260]
push 0
push dword [edx + 0x268]
push 1
push 0
push 0
push dword [edx + 0x4c]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne bl
cmp byte [0x4d4c48], 0
je 0x40963d
cmp byte [0x4d4c90], 0
je 0x40963d
mov eax, dword [esi + 0x35c]
push dword [eax + 0x294]
push str.CreateProcess:_Info.hProcess__p
push 0
push 8
push 0x454bf0
call fcn.00417130
add esp, 0x14
push dword [esi + 0x350]
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
mov al, bl
pop ebx
ret
Function at 0x40a3f0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x2f4]
test eax, eax
je 0x40a4cc
mov eax, dword [eax + 0x35c]
or edx, 0xffffffff
test eax, eax
je 0x40a432
mov eax, dword [eax + 0x29c]
test eax, eax
je 0x40a432
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, eax
test edx, edx
jne 0x40a432
or edx, 0xffffffff
or eax, 0xffffffff
mov dword [esp + 4], vtable.HandleClass.0
test edx, edx
cmovne eax, edx
mov dword [esp + 8], eax
cmp eax, 0xffffffff
je 0x40a454
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov edi, dword [esi + 0x2f4]
mov eax, dword [edi + 0x1bc]
lea ecx, [edi + 0x1bc]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x40a486
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x84]
mov eax, dword [edi]
mov ecx, edi
push 0xffffffffffffffff
call dword [eax + 0x90]
mov ecx, dword [esi + 0x2f4]
pop edi
test ecx, ecx
je 0x40a497
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [esp + 4]
mov dword [esi + 0x2f4], 0
mov dword [esp + 4], vtable.HandleClass.0
call dword [0x43aff0]
test al, al
je 0x40a4cc
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 4]
lea ecx, [esp + 4]
call dword [eax + 0x1c]
mov al, 1
pop esi
add esp, 8
ret

Function at 0x40a690
Capabilities:
Delete registry value

Disassembly:
sub esp, 8
push ebx
push esi
push dword [esp + 0x18]
mov esi, ecx
mov dword [esp + 0xc], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
mov eax, dword [esi + 0xc]
or eax, 0xf003f
push eax
push dword [esi + 4]
push dword [esi]
call fcn.00410720
test al, al
je 0x40a6ef
push dword [esp + 0x14]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x40a6eb
mov ecx, dword [esp + 0x18]
push 0
push dword [esi + 4]
push eax
call fcn.004147b0
test al, al
je 0x40a6ef
mov bl, 1
jmp 0x40a6f1
xor bl, bl
mov eax, dword [esp + 8]
test eax, eax
je 0x40a700
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
add esp, 8
ret 8
Function at 0x40a8a0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0x358]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x5c]
cmp dword [eax], 0
je 0x40aa23
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
push edi
lea edi, [esi + 0x2e8]
push 0x1f4
push edi
call ebp
test eax, eax
je 0x40a991
mov eax, dword [edi]
dec eax
cmp eax, 8
ja case.default.0x40a8ec
jmp dword [eax*4 + 0x40aa28]
cmp dword [esi + 0x344], 0
je 0x40a9a2
mov ecx, dword [esi + 0x2f4]
mov eax, 0x80010001
cmp ecx, 0x80000003
mov edx, 0x10002
cmove eax, edx
mov dword [esi + 0x360], eax
cmp ecx, 0xc0000409
je 0x40a937
cmp ecx, 0xc0000374
je 0x40a937
cmp ecx, 0xc000041d
jne case.default.0x40a8ec
mov ecx, esi
call fcn.00414980
jmp case.default.0x40a8ec
mov ecx, esi
call fcn.0040a270
jmp case.default.0x40a8ec
mov ecx, esi
call fcn.0040a1d0
jmp case.default.0x40a8ec
mov ecx, esi
call fcn.0040b0e0
jmp case.default.0x40a8ec
mov ecx, esi
call fcn.0040fd20
jmp case.default.0x40a8ec
mov ecx, esi
call fcn.00414e90
jmp case.default.0x40a8ec
mov ecx, esi
call fcn.00410960
jmp case.default.0x40a8ec
mov ecx, esi
call fcn.00412c30
push dword [esi + 0x360]
push dword [esi + 0x2f0]
push dword [esi + 0x2ec]
call ebx
mov eax, dword [esi + 0x5c]
cmp dword [eax], 0
jne 0x40a8d0
pop edi
pop ebp
pop ebx
pop esi
ret
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x40a9e1
cmp byte [0x4d4c48], 0
je 0x40a9e1
cmp byte [0x4d4c90], 0
je 0x40a9e1
push dword [esi + 0x364]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_EXCEPTION_DEBUG_EVENT__FirstChance_Exception___Crash._n
push 0
push 8
push 0x454bf0
call fcn.00417130
add esp, 0x18
mov ecx, esi
call fcn.00409bf0
push 1
push dword [esi + 0x348]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop ebp
pop ebx
mov dword [esi + 0x348], 0xffffffff
pop esi
ret
mov ecx, esi
call fcn.0040b070
push dword [esi + 0x360]
push dword [esi + 0x2f0]
push dword [esi + 0x2ec]
call ebx
pop edi
pop ebp
pop ebx
pop esi
ret
Function at 0x40aad0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x24]
test bl, 2
je 0x40aafc
push edi
push esi
call fcn.00415360
add esp, 8
test al, al
jne 0x40aafc
pop edi
pop esi
pop ebx
add esp, 0x10
ret
test bl, 4
je 0x40abee
test esi, esi
je 0x40abe5
cmp word [esi], 0
je 0x40abe5
and bl, 1
mov dword [esp + 0xc], vtable.ErrorClass.0
lea eax, [esp + 0xc]
mov byte [esp + 0x28], bl
mov ebx, dword [esp + 0x28]
mov ecx, 0x454a38
push eax
push ebx
push esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], vtable.TextErrorClass.0
mov dword [esp + 0x20], 0x439c50
mov dword [esp + 0x24], 0
call fcn.00413f90
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x40ab7a
lea eax, [esp + 0xc]
mov ecx, 0x454a38
push eax
push ebx
push esi
call fcn.00413cd0
xor ecx, ecx
test al, al
setne cl
dec ecx
je 0x40aba0
dec ecx
je 0x40abd4
push edi
push esi
call fcn.00412530
add esp, 8
test al, al
je 0x40abc6
mov eax, dword [0x454b44]
test eax, eax
je 0x40aba0
push 0
push esi
push 5
push 4
call eax
mov bl, 1
cmp dword [esp + 0x18], 0
mov dword [esp + 0xc], vtable.TextErrorClass.0
je 0x40abbd
push dword [esp + 0x14]
call fcn.00421e19
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
sete bl
jmp 0x40aba2
mov eax, dword [edi]
mov ecx, edi
push dword [esp + 0x14]
mov eax, dword [eax + 4]
call eax
mov bl, al
jmp 0x40aba2
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x10
ret
push edi
push esi
call fcn.00412530
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x40ae90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x228
mov eax, dword [0x451aa8]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x22c]
test eax, eax
je 0x40af34
cmp word [eax], 0
je 0x40af34
lea ecx, [esp + 0x14]
mov dword [esp], 0
mov dword [esp + 0x10], ecx
xor ecx, ecx
push 0x44f518
mov word [esp + 0x18], cx
lea ecx, [esp + 4]
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0x14], 0x108
call fcn.00413810
test al, al
je 0x40af2c
push ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea ecx, [esp + 4]
setne bl
call fcn.0040ba00
mov al, bl
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00422b84
add esp, 0x228
ret
lea ecx, [esp]
call fcn.0040ba00
mov ecx, dword [esp + 0x224]
xor al, al
xor ecx, esp
call fcn.00422b84
add esp, 0x228
ret
Function at 0x40af50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x260
mov eax, dword [0x451aa8]
xor eax, esp
mov dword [esp + 0x25c], eax
mov eax, dword [esp + 0x264]
test eax, eax
je 0x40b050
cmp word [eax], 0
je 0x40b050
lea ecx, [esp + 0x4c]
mov dword [esp + 0x38], 0
mov dword [esp + 0x48], ecx
xor ecx, ecx
push 0x44f518
mov word [esp + 0x50], cx
lea ecx, [esp + 0x3c]
push eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 2
mov dword [esp + 0x4c], 0x108
call fcn.00413810
test al, al
je 0x40b047
push ebx
push 0x34
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push 0
push eax
call fcn.00423da0
add esp, 0xc
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40b024
lea eax, [esp + 4]
push eax
push dword [esp + 0x50]
call fcn.004222c4
add esp, 8
test eax, eax
je 0x40b024
lea ecx, [esp + 0x3c]
xor bl, bl
call fcn.0040ba00
mov al, bl
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.00422b84
add esp, 0x260
ret
lea ecx, [esp + 0x3c]
mov bl, 1
call fcn.0040ba00
mov al, bl
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.00422b84
add esp, 0x260
ret
lea ecx, [esp + 0x38]
call fcn.0040ba00
mov ecx, dword [esp + 0x25c]
xor al, al
xor ecx, esp
call fcn.00422b84
add esp, 0x260
ret

Function at 0x40b120
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x18
mov eax, dword [0x451aa8]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
push 0
mov ebp, dword [esi + 0x28]
push ebp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 0x10], eax
lea edi, [eax + eax]
cmp edi, 0x10
jbe 0x40b1a0
push edi
call fcn.00421e51
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40b1a6
mov edx, dword [0x4d6eb0]
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx + edx*4]
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x40b187
mov ecx, dword [ecx + 0x104]
test ecx, ecx
je 0x40b187
mov eax, dword [ecx]
push edi
call dword [eax + 0x14]
test ebx, ebx
jne 0x40b1a6
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00422b84
add esp, 0x18
ret
lea ebx, [esp + 0x14]
jmp 0x40b1aa
mov eax, dword [esp + 0x10]
push eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, dword [esi + 0x28]
lea ebp, [esi + 0x2c]
cmp ecx, ebp
je 0x40b1d2
mov eax, dword [esi + 0x14]
shr eax, 0xa
not al
test al, 1
je 0x40b1d2
push ecx
call fcn.00421e19
add esp, 4
mov dword [esi + 0x1c], 0
mov dword [esi + 0x28], ebp
mov dword [ebp], 0
cmp edi, 0x10
jbe 0x40b1ed
mov dword [esi + 0x28], ebx
jmp 0x40b1fc
push edi
lea eax, [esp + 0x18]
push eax
push ebp
call fcn.00423750
add esp, 0xc
mov ecx, dword [esp + 0x24]
mov al, 1
mov dword [esi + 0x1c], edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00422b84
add esp, 0x18
ret
Function at 0x40cf90
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push esi
mov esi, ecx
push edi
push dword [esi + 0xc]
push dword [esi + 0x10]
call ebx
test eax, eax
je 0x40cfee
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jb 0x40d005
lea edi, [eax + eax]
cmp edi, ecx
jbe 0x40cfdf
mov eax, dword [esi]
shr eax, 0xa
test al, 1
jne 0x40cfee
cmp dword [esi + 0x10], 0
je 0x40cfcb
mov ecx, esi
call fcn.0040ba00
push 0
push edi
mov ecx, esi
call fcn.00410790
mov dword [esi + 0x10], eax
test eax, eax
je 0x40cff6
mov dword [esi + 0xc], edi
mov dword [esi + 4], edi
push dword [esi + 0xc]
push dword [esi + 0x10]
call ebx
test eax, eax
jne 0x40cfa7
pop edi
pop esi
xor al, al
pop ebx
ret 4
pop edi
mov dword [esi + 0xc], 0
xor al, al
pop esi
pop ebx
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40d021
push eax
mov ecx, esi
call fcn.00406ed0
test al, al
jne 0x40d021
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
ret 4

Function at 0x40d200
Capabilities:
Get common file path

Disassembly:
sub esp, 0x228
mov eax, dword [0x451aa8]
xor eax, esp
mov dword [esp + 0x224], eax
lea eax, [esp + 0x14]
mov dword [esp], 0
mov dword [esp + 0x10], eax
xor eax, eax
push ebx
push esi
mov word [esp + 0x1c], ax
mov esi, ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], 0
push eax
push 0x108
mov dword [esp + 0x18], 2
mov dword [esp + 0x1c], 0x108
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40d2b7
mov eax, dword [0x454a4c]
push edi
mov edi, dword [esp + 0x1c]
test eax, eax
je 0x40d275
push dword [esi + 0xc]
push dword [esi + 0x10]
push edi
call eax
test eax, eax
jne 0x40d27f
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.00412f40
mov edx, dword [esi + 0x10]
pop edi
test edx, edx
je 0x40d2a4
mov ecx, edx
lea esi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d290
sub ecx, esi
sar ecx, 1
je 0x40d2a6
dec ecx
jmp 0x40d2a6
xor ecx, ecx
cmp word [edx + ecx*2], 0x5c
jne 0x40d2b3
xor eax, eax
mov word [edx + ecx*2], ax
mov bl, 1
jmp 0x40d2b9
xor bl, bl
lea ecx, [esp + 8]
call fcn.0040ba00
mov ecx, dword [esp + 0x22c]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.00422b84
add esp, 0x228
ret
Function at 0x40e210
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0xc]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x40e22e
mov eax, dword [esi + 0x10]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 4], ecx
mov eax, dword [esp + 8]
test eax, eax
je 0x40e246
push eax
mov ecx, esi
call fcn.00406ed0
test al, al
jne 0x40e246
pop esi
ret 4
mov al, 1
pop esi
ret 4

Function at 0x40ebf0
Capabilities:
Check os version
Get common file path
Get geographical location
Get system information on windows

Disassembly:
push esi
push edi
push 0x2e8
call fcn.00421e51
mov esi, dword [0x4d6eb0]
add esp, 4
mov edi, dword fs:[0x2c]
test eax, eax
jne 0x40ec43
mov eax, dword [edi + esi*4]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x40ec31
mov ecx, dword [ecx + 0x104]
test ecx, ecx
je 0x40ec31
mov eax, dword [ecx]
push 0x2e8
call dword [eax + 0x14]
mov ecx, dword [edi + esi*4]
xor eax, eax
pop edi
pop esi
mov dword [ecx + 8], eax
jmp fcn.0040d8f0
push 0x1000
push 0x444e4746
push str.Foreground
push 0
mov ecx, eax
call fcn.00405110
mov ecx, dword [edi + esi*4]
pop edi
pop esi
mov dword [ecx + 8], eax
jmp fcn.0040d8f0

Function at 0x40f8c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x228
mov eax, dword [0x451aa8]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x22c]
lea ecx, [esp + 0x14]
push ebx
mov dword [esp + 0x14], ecx
xor ecx, ecx
push 0x44f518
mov word [esp + 0x1c], cx
lea ecx, [esp + 8]
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 0x108
call fcn.00413810
test al, al
je 0x40f935
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f935
test al, 1
je 0x40f935
mov bl, 1
jmp 0x40f937
xor bl, bl
lea ecx, [esp + 4]
call fcn.0040ba00
mov ecx, dword [esp + 0x228]
mov al, bl
pop ebx
xor ecx, esp
call fcn.00422b84
add esp, 0x228
ret

Function at 0x40fb40
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x451aa8]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.00423da0
add esp, 0xc
mov dword [esp], 0x114
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jb 0x40fb9e
cmp dword [esp + 8], 2
jb 0x40fb9e
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00422b84
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor al, al
xor ecx, esp
call fcn.00422b84
add esp, 0x118
ret
Function at 0x410d40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
movdqu xmmword [esp + 4], xmm0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
push ebx
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x14], eax
lea eax, [esp + 4]
push eax
push 0
push dword [esp + 0x30]
mov dword [esp + 0x10], 0
push dword [esp + 0x30]
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
sete bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test bl, bl
pop ebx
je 0x410da9
cmp eax, 0x3e5
jne 0x410dd1
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x410dad
test eax, eax
jne 0x410dd1
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov eax, dword [esp]
test eax, eax
je 0x410dc9
cmp eax, 0x103
je 0x410dc9
test ecx, ecx
je 0x410dd1
mov al, 1
add esp, 0x14
ret 0x14
xor al, al
add esp, 0x14
ret 0x14

Function at 0x411420
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
push dword [esp + 0x20]
mov esi, ecx
mov dword [esp + 0xc], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
mov eax, dword [esi + 0xc]
or eax, 0x20019
push eax
push dword [esi + 4]
push dword [esi]
call fcn.00410720
test al, al
je 0x411497
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x24]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x411493
mov ecx, dword [esp + 0x20]
push 0
push dword [esi + 4]
push eax
call fcn.004147b0
test al, al
je 0x411497
mov bl, 1
jmp 0x411499
xor bl, bl
mov eax, dword [esp + 8]
test eax, eax
je 0x4114a8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
add esp, 8
ret 0x10
Function at 0x4117b0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x20
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x284]
lea ecx, [ebx + 0x284]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x4118cd
push 0
push dword [ebx + 0x288]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 4], eax
test eax, eax
je 0x4118cd
push ebp
push esi
push edi
xor esi, esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov edi, 0x439c50
mov dword [esp + 0x14], edi
mov ebp, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], esi
test eax, eax
je 0x411846
push esi
push eax
lea ecx, [esp + 0x24]
call fcn.00410790
mov esi, eax
mov dword [esp + 0x2c], esi
test esi, esi
je 0x41189a
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], ebp
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], ebp
push ecx
push eax
push esi
push dword [ebx + 0x288]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x411865
mov byte [esi], al
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
inc eax
push eax
call fcn.00412a10
test eax, eax
je 0x4118a4
mov ecx, dword [esp + 0x10]
push ecx
push esi
inc ecx
push ecx
push eax
call fcn.0040ba60
mov edi, dword [esp + 0x24]
lea ecx, [ebx + 0x34]
add esp, 0x10
push edi
call fcn.00406b10
mov bl, al
jmp 0x4118aa
mov dword [esp + 0x28], 0
jmp 0x4118a8
mov edi, dword [esp + 0x14]
xor bl, bl
lea ecx, [esp + 0x1c]
call fcn.0040ba00
cmp dword [esp + 0x18], 0
je 0x4118c3
push edi
call fcn.00421e19
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x20
ret
mov al, 1
pop ebx
add esp, 0x20
ret