joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409c82
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x450060]
xor eax, ebp
mov dword [ebp - 0xc], eax
and dword [ebp - 0x24], 0
and dword [ebp - 8], 0
push 0x10
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0042cd80
add esp, 0xc
mov byte [ebp - 1], 0
and dword [ebp - 0x20], 0
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x409d17
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
call fcn.00407c6d
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x409cec
mov dword [ebp - 0x24], 0x80004005
push dword [ebp - 0x24]
push 0x1d5
push 0x404cb4
call fcn.0040e33f
push 0x405140
push dword [ebp - 0x24]
call fcn.0040b4e0
pop ecx
pop ecx
jmp 0x409e3b
lea eax, [ebp - 0x1c]
push eax
push 0x10
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x409d76
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
call fcn.00407c6d
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x409d4b
mov dword [ebp - 0x24], 0x80004005
push dword [ebp - 0x24]
push 0x1db
push 0x404cb4
call fcn.0040e33f
push 0x405164
push dword [ebp - 0x24]
call fcn.0040b4e0
pop ecx
pop ecx
jmp 0x409e3b
movzx eax, byte [ebp - 0x1c]
and eax, 7
lea eax, [eax + eax + 0x12]
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
and dword [eax], 0
mov byte [ebp - 0x25], 0
jmp 0x409d99
movzx eax, byte [ebp - 0x25]
inc eax
inc eax
mov byte [ebp - 0x25], al
movzx eax, byte [ebp - 0x25]
movzx ecx, byte [ebp - 1]
cmp eax, ecx
jge 0x409e3b
and dword [ebp - 0x20], 0
movzx eax, byte [ebp - 0x25]
cdq
sub eax, edx
sar eax, 1
movzx eax, byte [ebp + eax - 0x1c]
push eax
push 0x405188
lea eax, [ebp - 0x20]
push eax
call fcn.0040c486
add esp, 0xc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x409de9
push 0x405198
push dword [ebp - 0x24]
call fcn.0040b4e0
pop ecx
pop ecx
jmp 0x409e3b
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x409dfb
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
jmp 0x409e32
push 0
push dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.0040c3a6
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x409e24
push 0x4051d8
push dword [ebp - 0x24]
call fcn.0040b4e0
pop ecx
pop ecx
jmp 0x409e3b
cmp dword [ebp - 0x20], 0
je 0x409e32
push dword [ebp - 0x20]
call fcn.0040c820
and dword [ebp - 0x20], 0
jmp 0x409d90
cmp dword [ebp - 8], 0
je 0x409e4c
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [ebp - 0x20], 0
je 0x409e5a
push dword [ebp - 0x20]
call fcn.0040c820
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0042cd6d
leave
ret 4
Function at 0x40ab40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x450060]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x218], 0
and dword [ebp - 0x214], 0
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0042cd80
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x40abf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x218], eax
push dword [ebp - 0x218]
call fcn.00407c6d
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x40abc8
mov dword [ebp - 0x218], 0x80004005
push dword [ebp - 0x218]
push 0x26
push 0x405b70
call fcn.0040e33f
push 0x405ba8
push dword [ebp - 0x218]
call fcn.0040b4e0
pop ecx
pop ecx
jmp 0x40ad1f
mov eax, dword [ebp - 0x214]
movzx eax, word [ebp + eax*2 - 0x212]
cmp eax, 0x5c
je 0x40ac5e
push 1
push 0x405bd4
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.0040aff0
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jge 0x40ac5e
push dword [ebp - 0x218]
push 0x2b
push 0x405b70
call fcn.0040e33f
push 0x405bd8
push dword [ebp - 0x218]
call fcn.0040b4e0
pop ecx
pop ecx
jmp 0x40ad1f
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.0040ae53
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jge 0x40acad
push dword [ebp - 0x218]
push 0x2f
push 0x405b70
call fcn.0040e33f
push dword [ebp + 8]
push 0x405c0c
push dword [ebp - 0x218]
call fcn.0040b4e0
add esp, 0xc
jmp 0x40ad1f
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x40ad1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x218], eax
push dword [ebp - 0x218]
call fcn.00407c6d
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x40acf7
mov dword [ebp - 0x218], 0x80004005
push dword [ebp - 0x218]
push 0x32
push 0x405b70
call fcn.0040e33f
push dword [ebp + 8]
push 0x405c40
push dword [ebp - 0x218]
call fcn.0040b4e0
add esp, 0xc
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042cd6d
leave
ret 8
Function at 0x40b654
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x450060]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x42c], 0
mov dword [ebp - 0x214], 0x104
and dword [ebp - 0x218], 0
and dword [ebp - 4], 0
and dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0x405cd8
cmp dword [0x4511c0], 0xffffffff
je 0x40b6a6
cmp dword [0x452234], 0
jne 0x40b6ba
mov dword [ebp - 0x42c], 1
jmp 0x40b833
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40b6e8
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0042cd80
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0040fd0f
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jge 0x40b719
and dword [ebp - 0x218], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x40b747
push 0x208
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.0042cd80
add esp, 0xc
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.0040c8b4
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jge 0x40b76e
jmp 0x40b833
push dword [ebp - 0x220]
push 0x405d5c
push 1
call fcn.0040b425
add esp, 0xc
mov eax, dword [ebp - 4]
and eax, 0xffff
push eax
mov eax, dword [ebp - 4]
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x218]
and eax, 0xffff
push eax
mov eax, dword [ebp - 0x218]
shr eax, 0x10
push eax
lea eax, [ebp - 0x210]
push eax
push 0x405d78
push 1
call fcn.0040b425
add esp, 0x1c
mov eax, dword [0x4511c4]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
je 0x40b814
cmp dword [ebp - 0x430], 1
je 0x40b7f0
cmp dword [ebp - 0x430], 2
je 0x40b7fc
cmp dword [ebp - 0x430], 3
je 0x40b808
jmp 0x40b81e
mov dword [ebp - 0x21c], 0x405ce0
jmp 0x40b81e
mov dword [ebp - 0x21c], 0x405cec
jmp 0x40b81e
mov dword [ebp - 0x21c], 0x405cf4
jmp 0x40b81e
mov dword [ebp - 0x21c], 0x405cfc
push dword [ebp - 0x21c]
push 0x405d04
push 1
call fcn.0040b425
add esp, 0xc
cmp dword [ebp - 0x220], 0
je 0x40b847
push dword [ebp - 0x220]
call fcn.0040c820
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042cd6d
leave
ret
Function at 0x40b8a6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
lea eax, [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x900
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40b91c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.00407c6d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x40b91c
push dword [ebp - 0x10]
push 0x272
push 0x405ca4
call fcn.0040e33f
jmp 0x40b9e1
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x40b98a
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
push eax
push dword [0x4511c0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40b97f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.00407c6d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x40b969
mov dword [ebp - 0x10], 0x80004005
push dword [ebp - 0x10]
push 0x27a
push 0x405ca4
call fcn.0040e33f
jmp 0x40b9e1
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
jmp 0x40b91c
cmp dword [ebp + 0x14], 0
je 0x40b9e1
push 0
lea eax, [ebp - 0x14]
push eax
push 2
push dword [0x4511c8]
push dword [0x4511c0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40b9e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.00407c6d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x40b9cf
mov dword [ebp - 0x10], 0x80004005
push dword [ebp - 0x10]
push 0x285
push 0x405ca4
call fcn.0040e33f
cmp dword [ebp - 0xc], 0
je 0x40b9f0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x10]
leave
ret 0x10
Function at 0x40b9f7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
and dword [ebp - 0x14], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0040c5dc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x40ba33
jmp 0x40bafd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jae 0x40baad
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
push eax
push dword [0x4511c0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40baa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.00407c6d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x40ba8c
mov dword [ebp - 0x10], 0x80004005
push dword [ebp - 0x10]
push 0x2aa
push 0x405ca4
call fcn.0040e33f
jmp 0x40bafd
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
jmp 0x40ba3f
cmp dword [ebp + 0x10], 0
je 0x40bafd
push 0
lea eax, [ebp - 0x14]
push eax
push 2
push dword [0x4511c8]
push dword [0x4511c0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40bafd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.00407c6d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x40bafd
push dword [ebp - 0x10]
push 0x2b5
push 0x405ca4
call fcn.0040e33f
cmp dword [ebp - 4], 0
je 0x40bb0b
push dword [ebp - 4]
call fcn.0040c820
mov eax, dword [ebp - 0x10]
leave
ret 0xc
Function at 0x40e580
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
push 0
push dword [ebp + 0xc]
push 0xa
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40e5ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push dword [ebp - 8]
call fcn.00407c6d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x40e5d0
mov dword [ebp - 8], 0x80004005
push dword [ebp - 8]
push 0xab
push 0x405e40
call fcn.0040e33f
jmp 0x40e6df
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40e63e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push dword [ebp - 8]
call fcn.00407c6d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x40e622
mov dword [ebp - 8], 0x80004005
push dword [ebp - 8]
push 0xae
push 0x405e40
call fcn.0040e33f
jmp 0x40e6df
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40e68a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push dword [ebp - 8]
call fcn.00407c6d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x40e674
mov dword [ebp - 8], 0x80004005
push dword [ebp - 8]
push 0xb3
push 0x405e40
call fcn.0040e33f
jmp 0x40e6df
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jne 0x40e6d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push dword [ebp - 8]
call fcn.00407c6d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x40e6c1
mov dword [ebp - 8], 0x80004005
push dword [ebp - 8]
push 0xb7
push 0x405e40
call fcn.0040e33f
jmp 0x40e6df
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
leave
ret 0x10
Function at 0x40e894
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 0x10], 0
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0040f58d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x40e8c5
jmp 0x40e9d6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x40e8e9
mov eax, dword [ebp - 8]
and eax, 0x10
je 0x40e8e9
jmp 0x40e9d6
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40e9d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xb7
jne 0x40e91d
and dword [ebp - 0x10], 0
jmp 0x40e9d6
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x40e931
mov eax, dword [ebp - 0x18]
inc eax
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
test eax, eax
je 0x40e94e
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
cmp eax, 0x5c
jne 0x40e94c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jmp 0x40e929
cmp dword [ebp - 0x14], 0
jne 0x40e971
push 3
call fcn.00407c6d
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0x57
push 0x405e74
call fcn.0040e33f
jmp 0x40e9d6
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov word [ecx], ax
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0040e894
mov dword [ebp - 0x10], eax
push 0x5c
pop eax
mov ecx, dword [ebp - 0x14]
mov word [ecx], ax
cmp dword [ebp - 0x10], 0
jge 0x40e99a
jmp 0x40e9d6
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40e9d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xb7
jne 0x40e9c5
mov dword [ebp - 0x10], 1
jmp 0x40e9d0
push dword [ebp - 0xc]
call fcn.00407c6d
mov dword [ebp - 0x10], eax
jmp 0x40e9d6
and dword [ebp - 0x10], 0
cmp dword [ebp - 4], 0
je 0x40e9e4
push dword [ebp - 4]
call fcn.0040c820
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x40ee59
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x40
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040bd4f
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40eed4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.00407c6d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x40eeb3
mov dword [ebp - 0x10], 0x80004005
push dword [ebp - 0x10]
push 0x107
push 0x405e74
call fcn.0040e33f
jmp 0x40ef75
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jae 0x40ef69
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040bd4f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x40eeff
jmp 0x40ef75
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40ef4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.00407c6d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x40ef35
mov dword [ebp - 0x10], 0x80004005
push dword [ebp - 0x10]
push 0x112
push 0x405e74
call fcn.0040e33f
jmp 0x40ef75
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jae 0x40ef69
push 0x7a
call fcn.00407c6d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x40ef69
jmp 0x40ef75
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
and dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x40ef83
push dword [ebp - 0xc]
call fcn.0040c820
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x40fd0f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 0x18], 0
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.0040f58d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x40fd50
jmp 0x40fe82
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40fda0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
call fcn.00407c6d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40fd87
mov dword [ebp - 0x18], 0x80004005
push dword [ebp - 0x18]
push 0x21
push 0x405f18
call fcn.0040e33f
jmp 0x40fe82
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40fdd4
mov dword [ebp - 0x18], 0x8007000e
push dword [ebp - 0x18]
push 0x25
push 0x405f18
call fcn.0040e33f
jmp 0x40fe82
push dword [ebp - 0x1c]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x40fe1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
call fcn.00407c6d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40fe0b
mov dword [ebp - 0x18], 0x80004005
push dword [ebp - 0x18]
push 0x29
push 0x405f18
call fcn.0040e33f
jmp 0x40fe82
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x405bd4
push dword [ebp - 0x1c]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x40fe6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
call fcn.00407c6d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40fe59
mov dword [ebp - 0x18], 0x80004005
push dword [ebp - 0x18]
push 0x2e
push 0x405f18
call fcn.0040e33f
jmp 0x40fe82
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0xc]
mov dword [eax], ecx
cmp dword [ebp - 0x1c], 0
je 0x40fe91
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0x14], 0
je 0x40fe9f
push dword [ebp - 0x14]
call fcn.0040c820
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x18]
leave
ret 0xc
Function at 0x410277
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jae 0x4102f4
and dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4102e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push dword [ebp - 8]
call fcn.00407c6d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x4102d3
mov dword [ebp - 8], 0x80004005
push dword [ebp - 8]
push 0x10f
push 0x405f18
call fcn.0040e33f
jmp 0x4102f4
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x410285
cmp dword [ebp + 0x14], 0
je 0x410302
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
leave
ret 0x10

Function at 0x410309
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0040f58d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x410330
jmp 0x41039e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x410341
jmp 0x41039e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
je 0x410356
cmp dword [ebp - 0xc], 3
jne 0x41035a
jmp 0x41039e
push 4
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x41039e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push dword [ebp - 8]
call fcn.00407c6d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x41038c
mov dword [ebp - 8], 0x80004005
push dword [ebp - 8]
push 0x13d
push 0x405f18
call fcn.0040e33f
cmp dword [ebp - 4], 0
je 0x4103ac
push dword [ebp - 4]
call fcn.0040c820
and dword [ebp - 4], 0
mov eax, dword [ebp - 8]
leave
ret 4