joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40abc2
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x40ac92
mov eax, dword [ebp + 8]
mov dword [ebp + 8], edi
mov edx, dword [eax]
mov esi, dword [edx - 8]
add esi, edx
cmp edx, esi
jae 0x40aca1
xor eax, eax
xor ebx, ebx
cmp edx, esi
jae 0x40ac50
mov cl, byte [edx]
inc edx
cmp cl, 9
jl 0x40ac07
cmp cl, 0xa
jle 0x40ac4b
cmp cl, 0xd
je 0x40ac4b
cmp cl, 0x20
je 0x40ac4b
shl ebx, 6
cmp cl, 0x60
jle 0x40ac19
movsx ecx, cl
sub ecx, 0x47
or ebx, ecx
jmp 0x40ac4a
cmp cl, 0x40
jle 0x40ac26
movsx ecx, cl
sub ecx, 0x41
jmp 0x40ac15
cmp cl, 0x3d
jne 0x40ac2e
inc edi
jmp 0x40ac4a
cmp cl, 0x2f
jle 0x40ac3b
movsx ecx, cl
add ecx, 4
jmp 0x40ac15
jne 0x40ac42
or ebx, 0x3f
jmp 0x40ac4a
cmp cl, 0x2b
jne 0x40ac4a
or ebx, 0x3e
inc eax
cmp eax, 4
jb 0x40abec
cmp eax, 4
jne 0x40ac96
mov eax, dword [ebp + 8]
add eax, 3
mov ecx, eax
sub ecx, edi
cmp ecx, dword [ebp + 0x10]
ja 0x40ac92
cmp eax, dword [ebp + 8]
je 0x40ac85
dec eax
test edi, edi
je 0x40ac7a
mov ecx, dword [ebp + 8]
sub ecx, edi
add ecx, 3
cmp eax, ecx
jae 0x40ac80
mov ecx, dword [ebp + 0xc]
mov byte [eax + ecx], bl
shr ebx, 8
jmp 0x40ac64
push 3
pop eax
sub eax, edi
add dword [ebp + 8], eax
jmp 0x40abe0
xor eax, eax
jmp 0x40aca4
neg eax
sbb eax, eax
not eax
and eax, dword [ebp + 8]
jmp 0x40aca4
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40acab
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
push edi
je 0x40ad9c
cmp dword [ebp + 0x10], esi
je 0x40ad9c
mov ecx, dword [ebp + 0xc]
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], esi
lea edi, [eax + ecx]
cmp eax, edi
jae 0x40ad8e
xor eax, eax
xor edx, edx
cmp dword [ebp + 8], edi
jae 0x40ad4b
mov ecx, dword [ebp + 8]
inc dword [ebp + 8]
mov cl, byte [ecx]
cmp cl, 9
jl 0x40ad00
cmp cl, 0xa
jle 0x40ad46
cmp cl, 0xd
je 0x40ad46
cmp cl, 0x20
je 0x40ad46
shl edx, 6
cmp cl, 0x60
jle 0x40ad12
movsx ecx, cl
sub ecx, 0x47
or edx, ecx
jmp 0x40ad45
cmp cl, 0x40
jle 0x40ad1f
movsx ecx, cl
sub ecx, 0x41
jmp 0x40ad0e
cmp cl, 0x3d
jne 0x40ad29
inc dword [ebp + 0xc]
jmp 0x40ad45
cmp cl, 0x2f
jle 0x40ad36
movsx ecx, cl
add ecx, 4
jmp 0x40ad0e
jne 0x40ad3d
or edx, 0x3f
jmp 0x40ad45
cmp cl, 0x2b
jne 0x40ad45
or edx, 0x3e
inc eax
cmp eax, 4
jb 0x40acdf
cmp eax, 4
jne 0x40ad92
mov ecx, dword [ebp + 0xc]
lea eax, [esi + 3]
mov ebx, eax
sub ebx, ecx
cmp ebx, dword [ebp + 0x14]
ja 0x40ad9c
cmp eax, esi
je 0x40ad7e
dec eax
test ecx, ecx
je 0x40ad73
mov ebx, esi
sub ebx, ecx
add ebx, 3
cmp eax, ebx
jae 0x40ad79
mov ebx, dword [ebp + 0x10]
mov byte [eax + ebx], dl
shr edx, 8
jmp 0x40ad5f
push 3
pop eax
sub eax, ecx
add esi, eax
cmp dword [ebp + 8], edi
jb 0x40acdb
mov eax, esi
jmp 0x40ad9e
neg eax
sbb eax, eax
not eax
and eax, esi
jmp 0x40ad9e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x40ada5
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4d910f
call fcn.004b0604
push ecx
mov eax, dword [str.pRdR]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
mov dword [ebx], eax
mov eax, dword [str.pRdR]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 8], eax
mov eax, dword [str.pRdR]
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 2
call fcn.0040911b
push 0xa
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 3
call fcn.004c58e6
mov ecx, ebx
mov byte [ebp - 4], 4
mov dword [esi], vtable.CIRCopyFiles.0
call fcn.004c74f5
lea ecx, [esi + 8]
call fcn.004c74f5
lea ecx, [esi + 0x38]
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], 1
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x20], edi
call fcn.004c74f5
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], 0x32
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40c3e4
Capabilities:
Delete directory

Disassembly:
mov eax, 0x4d93fc
call fcn.004b0604
sub esp, 0xc
push esi
mov eax, dword [str.pRdR]
and dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
lea esi, [ecx + 4]
push 0x5c
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.004c3f52
cmp eax, 0xffffffff
je 0x40c448
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.004c3eda
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004c76a3
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.004c756a
push 0x511870
lea ecx, [ebp - 0x14]
call fcn.004c430d
push 0x5c
lea ecx, [ebp + 8]
call fcn.004c3f52
cmp eax, 0xffffffff
pop esi
je 0x40c4a8
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 8]
call fcn.004c3eda
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.004c76a3
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.004c756a
push 0
push dword [ebp - 0x10]
call fcn.004b2235
pop ecx
test eax, eax
pop ecx
jne 0x40c4a8
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004b10d5
pop ecx
test eax, eax
pop ecx
je 0x40c4a8
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004c756a
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004c756a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004c756a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40c99a
Capabilities:
Create directory
Get common file path
Set current directory

Disassembly:
mov eax, 0x4d94fc
call fcn.004b0604
sub esp, 0x210
push ebx
push esi
push edi
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
call fcn.004c4499
lea ecx, [ebp + 8]
call fcn.004c43a2
push 0x5c
lea ecx, [ebp + 8]
call fcn.004c4360
lea ecx, [ebp + 8]
call fcn.004c43a2
push 0x5c
lea ecx, [ebp + 8]
call fcn.004c796d
lea eax, [ebp - 0x21c]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp + 8]
push esi
push ebx
mov edi, dword [eax - 8]
lea eax, [ebp - 0x118]
push eax
call fcn.004b0720
add esp, 0xc
cmp edi, 2
jle 0x40cb0d
mov eax, dword [ebp + 8]
cmp byte [eax + 1], 0x3a
jne 0x40ca76
xor esi, esi
cmp edi, ebx
jle 0x40cb10
cmp dword [ebp - 0x10], ebx
je 0x40cb10
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x5c
mov byte [ebp + esi - 0x118], al
jne 0x40ca6c
cmp esi, 2
je 0x40ca6c
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x40ca6c
lea eax, [ebp - 0x118]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x10], eax
inc esi
cmp esi, edi
jl 0x40ca2b
jmp 0x40cb10
lea eax, [ebp - 0x14]
push 2
push eax
lea ecx, [ebp + 8]
call fcn.004c3eda
mov eax, dword [eax]
push 0x5118dc
push eax
call fcn.004b0c2e
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x14]
inc bl
call fcn.004c756a
test bl, bl
je 0x40cb07
push 2
push 0x511870
lea ecx, [ebp + 8]
call fcn.004c3f82
xor esi, esi
mov ebx, eax
test edi, edi
jle 0x40cb10
cmp dword [ebp - 0x10], 0
je 0x40cb10
cmp ebx, 0xffffffff
je 0x40cb10
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x5c
mov byte [ebp + esi - 0x118], al
jne 0x40cb00
cmp esi, ebx
jle 0x40cb00
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x40cb00
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x10], eax
inc esi
cmp esi, edi
jl 0x40cabe
jmp 0x40cb10
and dword [ebp - 0x10], 0
jmp 0x40cb10
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004c756a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40d699
Capabilities:
Delete directory

Disassembly:
mov eax, 0x4d9678
call fcn.004b0604
sub esp, 0xc
push esi
mov eax, dword [str.pRdR]
and dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
lea esi, [ecx + 4]
push 0x5c
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.004c3f52
cmp eax, 0xffffffff
je 0x40d6fd
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.004c3eda
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004c76a3
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.004c756a
push 0x511870
lea ecx, [ebp - 0x14]
call fcn.004c430d
push 0x5c
lea ecx, [ebp + 8]
call fcn.004c3f52
cmp eax, 0xffffffff
pop esi
je 0x40d75d
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 8]
call fcn.004c3eda
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.004c76a3
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.004c756a
push 0
push dword [ebp - 0x10]
call fcn.004b2235
pop ecx
test eax, eax
pop ecx
jne 0x40d75d
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004b10d5
pop ecx
test eax, eax
pop ecx
je 0x40d75d
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004c756a
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004c756a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004c756a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40d78f
Capabilities:
Delete directory

Disassembly:
mov eax, 0x4d96ac
call fcn.004b0604
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [str.pRdR]
and dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x14]
push eax
push ecx
lea eax, [esi + 4]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.004c72df
mov ecx, esi
call fcn.0040d306
lea eax, [ebp + 8]
lea ecx, [ebp - 0x10]
push eax
call fcn.004c76a3
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call esi
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.004c3f52
cmp eax, 0xffffffff
je 0x40d835
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
call fcn.004c3eda
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.004c76a3
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.004c756a
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004b10d5
pop ecx
test eax, eax
pop ecx
je 0x40d7ea
push dword [ebp - 0x10]
jmp 0x40d7e8
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.004c756a
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004c756a
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004c756a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004c756a
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40dedb
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor esi, esi
cmp eax, esi
je 0x40df28
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x40df28
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x28]
push ecx
push dword [ebp + 8]
call eax
test eax, eax
je 0x40df62
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
jmp 0x40df5e
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x40df62
mov eax, dword [ebp - 4]
push esi
mul dword [ebp - 8]
push dword [ebp - 0xc]
push edx
push eax
call fcn.004b0d60
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
xor eax, eax
jmp 0x40df6d
mov eax, dword [ebp + 0xc]
push 1
mov dword [eax], esi
mov dword [eax + 4], esi
pop eax
pop esi
leave
ret
Function at 0x40e4d7
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4d9868
call fcn.004b0604
sub esp, 0x26c
mov eax, dword [str.pRdR]
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x24], eax
push 0x44
lea eax, [ebp - 0x84]
pop edi
mov dword [ebx], esi
push edi
push esi
push eax
call fcn.004b0720
push 0x10
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.004b0720
mov edx, dword [ebp + 0x18]
add esp, 0x18
mov eax, edx
mov dword [ebp - 0x84], edi
push 1
sub eax, esi
pop ecx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x50], esi
mov word [ebp - 0x52], si
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x58], ecx
je 0x40e562
dec eax
je 0x40e55a
dec eax
je 0x40e552
dec eax
je 0x40e54c
mov word [ebp - 0x54], dx
jmp 0x40e566
mov word [ebp - 0x54], si
jmp 0x40e566
mov word [ebp - 0x54], 3
jmp 0x40e566
mov word [ebp - 0x54], 6
jmp 0x40e566
mov word [ebp - 0x54], cx
push dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call edi
test eax, eax
jne 0x40e587
push dword [ebp + 8]
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40e5a2
push dword [ebp + 0xc]
lea eax, [ebp - 0x278]
push dword [ebp + 8]
push 0x511e08
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push dword [ebp + 0x10]
call edi
test eax, eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x84]
push eax
jne 0x40e5b9
push esi
jmp 0x40e5bc
push dword [ebp + 0x10]
push esi
push 0x20
push esi
push esi
lea eax, [ebp - 0x278]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, esi
jne 0x40e5e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x40e67c
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 0x14], esi
mov dword [ebx], eax
je 0x40e66c
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov ebx, 0xff
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push esi
push eax
push 1
call edi
cmp eax, 1
jne 0x40e65b
push 1
push esi
push esi
lea eax, [ebp - 0x40]
push esi
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jle 0x40e64f
cmp dword [ebp - 0x3c], 0x200
je 0x40e60b
cmp dword [ebp - 0x3c], 0x201
je 0x40e60b
cmp dword [ebp - 0x3c], 0x202
je 0x40e60b
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40e60b
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push esi
push eax
push 1
jmp 0x40e604
cmp dword [ebp + 0x20], esi
je 0x40e66c
push dword [ebp + 0x20]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004c756a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x1c
Function at 0x40e70c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4d989c
call fcn.004b0604
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [edi + 0x2c]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.004c77ff
push eax
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
call fcn.004c76a3
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.004c756a
mov eax, dword [edi]
push 1
push ebx
push ebx
mov dword [esi + 8], eax
push dword [edi + 0x1c]
call fcn.004b0d60
mov ecx, dword [edi + 0x20]
add eax, ecx
lea ecx, [ebp + 8]
adc edx, ebx
and dword [esi + 0x30], ebx
and dword [esi + 0x2c], ebx
mov dword [esi + 0x10], eax
or ebx, 0xffffffff
lea eax, [edi + 4]
push ebx
push eax
mov dword [esi + 0x14], edx
call fcn.004c45ef
mov eax, dword [ebp + 8]
push ebx
mov dword [esi + 0x18], eax
lea eax, [edi + 0xc]
push eax
lea ecx, [ebp + 8]
call fcn.004c45ef
mov eax, dword [ebp + 8]
add edi, 0x14
push ebx
push edi
lea ecx, [ebp + 8]
mov dword [esi + 0x1c], eax
call fcn.004c45ef
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
mov dword [ebp - 4], ebx
call fcn.004c756a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x40fb48
Capabilities:
Check if file exists
Get file attributes
Get file version info

Disassembly:
mov eax, 0x4d9a8f
call fcn.004b0604
sub esp, 0x148
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
push 1
lea ecx, [ebp - 0x10]
pop ebx
push 0x524a50
mov dword [ebp - 4], ebx
call fcn.004c75d8
push dword [ebp + 0xc]
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40fc24
push dword [ebp + 0xc]
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x154]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jbe 0x40fc24
push esi
call fcn.004b0861
mov edi, eax
pop ecx
test edi, edi
je 0x40fc24
push edi
push esi
push dword [ebp - 0x1c]
lea eax, [ebp - 0x154]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x511870
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40fc1d
push 0x34
lea eax, [ebp - 0x54]
push dword [ebp - 0x18]
push eax
call fcn.004b0da0
movzx esi, word [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
movzx edx, word [ebp - 0x4c]
add esp, 0xc
shr ecx, 0x10
push esi
push ecx
shr eax, 0x10
push edx
push eax
lea eax, [ebp - 0x10]
push str._d._d._d._d
push eax
call fcn.004c42fa
add esp, 0x18
push edi
call fcn.004b0778
pop ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004c72df
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004c756a
and byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.004c756a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40ffc6
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4d9b63
call fcn.004b0604
mov eax, 0x2008
call fcn.004b0ce0
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, ecx
push 1
pop ebx
mov dword [ebp - 4], ebx
mov eax, dword [str.pRdR]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.004c74f5
push dword [esi + 4]
lea eax, [ebp - 0x2014]
push 0x2000
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x2014]
lea ecx, [ebp - 0x10]
push eax
call fcn.004c76f3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004c72df
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.004c756a
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.004c756a
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], bl
call fcn.004c756a
and byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.004c756a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x410e07
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push esi
xor esi, esi
push eax
push 0x2001f
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x410e77
and dword [ebp - 4], eax
push 4
pop esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push esi
push eax
inc dword [ebp - 4]
push esi
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop esi
lea ecx, [ebp + 8]
call fcn.004c756a
mov eax, esi
pop esi
leave
ret 4

Function at 0x4123ce
Capabilities:
Check os version

Disassembly:
mov eax, 0x4da1b7
call fcn.004b0604
sub esp, 0x98
mov eax, dword [str.pRdR]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ebx, [esi + 0x30]
mov dword [ebx], eax
push 1
xor eax, eax
pop edi
mov ecx, ebx
push str.Unknown_OS
mov dword [ebp - 4], eax
mov dword [esi], vtable.CIROSVersionInfo.0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
call fcn.004c76f3
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x412518
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp - 0xa0]
mov edx, dword [ebp - 0x9c]
mov dword [esi + 0x20], ecx
dec ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], edx
je 0x4124d9
dec ecx
jne 0x41251b
mov ecx, dword [ebp - 0x98]
cmp eax, 3
mov dword [esi + 0x2c], ecx
jne 0x41248c
push str.Windows_NT_3
mov ecx, ebx
call fcn.004c76f3
mov dword [esi + 0x10], edi
cmp dword [esi + 0x24], 4
jne 0x4124a1
push str.Windows_NT_4
mov ecx, ebx
call fcn.004c76f3
mov dword [esi + 0x14], edi
cmp dword [esi + 0x24], 5
jne 0x41251b
cmp dword [esi + 0x28], 0
jne 0x4124bc
push str.Windows_2000
mov ecx, ebx
call fcn.004c76f3
mov dword [esi + 0x18], edi
cmp dword [esi + 0x24], 5
jne 0x41251b
cmp dword [esi + 0x28], 0
jbe 0x41251b
push str.Windows_XP
mov ecx, ebx
call fcn.004c76f3
mov dword [esi + 0x1c], edi
jmp 0x41251b
movzx ecx, word [ebp - 0x98]
cmp eax, 4
mov dword [esi + 0x2c], ecx
ja 0x4124f8
jne 0x4124ee
test edx, edx
ja 0x4124f8
mov dword [esi + 4], edi
push str.Windows_95
jmp 0x412505
cmp edx, 0xa
ja 0x41250e
mov dword [esi + 8], edi
push str.Windows_98
mov ecx, ebx
call fcn.004c76f3
jmp 0x41251b
mov dword [esi + 0xc], edi
push str.Windows_ME
jmp 0x412505
mov dword [esi + 4], edi
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x414a37
Capabilities:
Delete file

Disassembly:
mov eax, 0x4da834
call fcn.004b0604
push ecx
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [str.pRdR]
xor esi, esi
mov dword [ebp - 0x10], eax
push 0x511870
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.004c430d
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push str._s_s.lnk
push eax
call fcn.004c42fa
push ebx
push dword [ebp - 0x10]
call fcn.004b2235
add esp, 0x18
test eax, eax
je 0x414ad0
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push str._s_s.pif
push eax
call fcn.004c42fa
push ebx
push dword [ebp - 0x10]
call fcn.004b2235
add esp, 0x18
test eax, eax
je 0x414ad0
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push str._s_s.url
push eax
call fcn.004c42fa
push ebx
push dword [ebp - 0x10]
call fcn.004b2235
add esp, 0x18
test eax, eax
jne 0x414ae0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x414ae0
push 1
pop esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004c756a
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.004c756a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004c756a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8