joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ca00
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x564
xor eax, eax
push ebx
push esi
push edi
xor ebx, ebx
mov word [esp + 0x368], bx
mov ecx, 0x81
lea edi, [esp + 0x36a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov byte [esp + 0x158], bl
mov ecx, 0x40
lea edi, [esp + 0x159]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x50], bl
mov ecx, 0x40
lea edi, [esp + 0x51]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x260], bl
mov ecx, 0x40
lea edi, [esp + 0x261]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x43e5ac
stosb byte es:[edi], al
lea eax, [esp + 0x36c]
push 0x102
push eax
call fcn.0040c970
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push ebx
push ebx
push 0x104
lea ecx, [esp + 0x5c]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x37c]
push edx
push 0x200
push ebx
call esi
lea eax, [esp + 0x50]
push eax
push 0x104
lea ecx, [esp + 0x160]
push ecx
call fcn.00401710
lea edx, [esp + 0x10]
push edx
push 0x104
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x1c], ebx
call fcn.004017c0
cmp eax, ebx
jl 0x40cb9d
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40caf4
mov byte [esp + eax + 0x4f], bl
push ebx
push ebx
mov ecx, 0x102
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x164]
mov eax, dword [ebp + 8]
push edx
push 0xffffffffffffffff
push eax
push 0x200
push ebx
call esi
mov edx, dword [ebp + 0xc]
push ebx
push ebx
push 0x104
lea ecx, [esp + 0x26c]
push ecx
push 0xffffffffffffffff
push edx
push 0x200
push ebx
call esi
lea eax, [esp + 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40cba4
xor eax, eax
mov ecx, 0xe
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x158]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x260]
lea eax, [esp + 0x50]
push ecx
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x40caf4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40cc50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push edi
xor eax, eax
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.compsver.inf
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.0040cbb0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push esi
push ebx
push 0x43d994
push 0x43e5b8
push str.UPDATE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40ccc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push edi
xor eax, eax
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.compsver.inf
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.0040cbb0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push esi
push ebx
push 0x43d994
push str.Time
push str.UPDATE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40d780
Capabilities:
Read .ini file

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x40d7aa
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop ecx
ret
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
xor ebp, ebp
xor esi, esi
cmp eax, ebp
push edi
mov dword [esp + 0x10], ebp
je 0x40d7fe
push eax
call fcn.0042a3e2
lea ebx, [eax + eax + 2]
push ebx
call fcn.00429bd8
add esp, 8
mov esi, eax
push ebp
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
push ebp
mov edi, esi
rep stosd dword es:[edi], eax
push ebx
mov ecx, edx
push esi
and ecx, 3
push 0xffffffffffffffff
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
push eax
push 0x200
push ebp
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40d849
push eax
call fcn.0042a3e2
lea ebx, [eax + eax + 2]
push ebx
call fcn.00429bd8
add esp, 8
mov ebp, eax
push 0
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
push 0
mov edi, ebp
rep stosd dword es:[edi], eax
push ebx
mov ecx, edx
push ebp
and ecx, 3
push 0xffffffffffffffff
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x30]
push eax
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40d89a
push eax
call fcn.0042a3e2
lea ebx, [eax + eax + 2]
push ebx
call fcn.00429bd8
mov edi, eax
add esp, 8
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
mov dword [esp + 0x10], edi
rep stosd dword es:[edi], eax
push 0
push 0
mov ecx, edx
and ecx, 3
push ebx
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
push eax
push 0xffffffffffffffff
push ecx
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
push ebx
push edx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test esi, esi
mov edi, eax
je 0x40d8bb
push esi
call fcn.0042969a
add esp, 4
test ebp, ebp
je 0x40d8c8
push ebp
call fcn.0042969a
add esp, 4
test ebx, ebx
je 0x40d8d5
push ebx
call fcn.0042969a
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40db60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
push edi
xor eax, eax
mov word [esp + 0x218], 0
mov ecx, 0x81
lea edi, [esp + 0x21a]
rep stosd dword es:[edi], eax
push str.CompsVer.inf
stosw word es:[edi], ax
lea eax, [esp + 0x21c]
push 0x208
push eax
call fcn.0040c970
add esp, 0xc
push 0
push 0
mov byte [esp + 0x118], 0
xor eax, eax
push 0x104
mov ecx, 0x40
lea edi, [esp + 0x11d]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x11c]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x22c]
push edx
stosw word es:[edi], ax
push 0x200
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x110]
push eax
push 0x104
lea ecx, [esp + 0x10]
push ecx
push 0x43d994
push 0x43e5b8
push str.UPDATE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 8]
test al, al
jne 0x40dc33
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x40ee50
Capabilities:
Delete file
Get file size
Move file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor eax, eax
test ebx, ebx
mov ecx, 0x41
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
je 0x40eed4
cmp byte [ebx], 0
je 0x40eed4
push 0x5c
push ebx
call fcn.00429fe0
add esp, 8
test eax, eax
jne 0x40ef1e
push 0x105
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call fcn.004299c4
add esp, 8
test eax, eax
je 0x40eeb9
mov byte [eax + 1], 0
mov ecx, 0x105
lea eax, [esp + 0x10]
cmp byte [eax], 0
je 0x40eecd
inc eax
dec ecx
jne 0x40eec2
jmp 0x40ef1a
test ecx, ecx
je 0x40ef1a
push ebx
jmp 0x40ef04
push 0x105
lea ecx, [esp + 0x14]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x105
lea eax, [esp + 0x10]
nop
cmp byte [eax], 0
je 0x40eefb
inc eax
dec ecx
jne 0x40eef0
jmp 0x40ef1a
test ecx, ecx
je 0x40ef1a
push str..log
mov eax, 0x105
mov edx, eax
sub eax, ecx
sub edx, eax
lea eax, [esp + eax + 0x14]
push edx
push eax
call fcn.00401710
lea ebx, [esp + 0x10]
push 0
push 0x20
push 4
push 0
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40f065
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0x10]
shl ecx, 0xa
cmp eax, ecx
jbe 0x40f02f
cmp eax, 0xffffffff
je 0x40f02f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x105
push ebx
lea edx, [esp + 0x120]
xor eax, eax
mov byte [esp + 0x120], 0
mov ecx, 0x41
lea edi, [esp + 0x121]
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [esp + 0x118]
push 0x2e
push eax
call fcn.004299c4
add esp, 8
test eax, eax
je 0x40efab
mov byte [eax], 0
mov ecx, 0x105
lea eax, [esp + 0x118]
cmp byte [eax], 0
je 0x40efc2
inc eax
dec ecx
jne 0x40efb7
jmp 0x40efe7
test ecx, ecx
je 0x40efe7
mov eax, 0x105
sub eax, ecx
push str.2.log
mov ecx, 0x105
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x120]
push edx
call fcn.00401710
push 0x80
lea eax, [esp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x118]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push 0x20
push 4
push 0
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [ebp + 8]
push 0
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415660
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, ecx
mov dword [edi], 0
mov eax, dword [esi + 0xa8]
cmp eax, 0x12
je 0x415693
cmp eax, 0x79
jne 0x41568a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x415693
cmp dword [esi + 0xa8], 0x20
jne 0x415707
cmp dword [esp + 0x10], 0xf100
jne 0x415707
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 4]
jne 0x4156c4
mov ecx, esi
call fcn.004155d0
mov eax, dword [esi + 4]
push 0
push 0xffffffffffffffff
push 0x448
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x415707
mov eax, dword [esi + 0xa8]
cmp eax, 0x20
je 0x415707
test byte [esi + 0x84], 0x40
jne 0x4156fc
mov al, byte [esi + 0x85]
test al, 2
je 0x4156f3
test al, 4
jne 0x4156f3
test al, 8
je 0x4156f3
push 1
mov ecx, esi
call fcn.00414990
mov ecx, esi
call fcn.004155a0
jmp 0x415701
cmp eax, 0x20
je 0x415707
mov dword [edi], 1
and byte [esi + 0x84], 0xbf
pop edi
xor eax, eax
pop esi
ret 0x10

Function at 0x418217
Capabilities:
Capture webcam image

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx]
push esi
mov esi, ecx
cmp eax, dword [esi + 4]
je 0x418233
mov ecx, dword [esp + 0x14]
pop esi
mov dword [ecx], 0
mov eax, 1
pop ebx
ret 0xc
push edi
mov edi, dword [sym.imp.USER32.dll_GetFocus]
call edi
cmp eax, dword [esi + 4]
je 0x418263
test byte [esi + 0x58], 4
je 0x418259
mov eax, dword [esi + 0xac]
test eax, eax
jne 0x418259
call edi
mov dword [esi + 0xac], eax
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebx + 0xc]
push 0
push eax
mov eax, dword [esi + 4]
push 0x419
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov bl, byte [esi + 0x84]
push 1
and bl, 0xcf
push eax
mov ecx, esi
mov byte [esi + 0x84], bl
call fcn.00417f60
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x4185a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x2f0]
test eax, eax
jne 0x418619
mov eax, dword [esi + 0x2f4]
test eax, eax
jne 0x418619
mov eax, dword [0x447fe8]
cmp dword [eax], 0
je 0x418619
mov eax, dword [esi + 0x104]
test eax, eax
je 0x4185d3
mov ecx, esi
pop esi
jmp fcn.004136a0
mov ecx, dword [esi + 4]
push edi
push 0x3ec
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 1
push 0x130c
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea edi, [esi + 0xec]
push 0xffffffffffffffff
mov ecx, edi
call fcn.0040ea80
mov ecx, edi
call fcn.00409610
mov edx, dword [esi + 0x1f4]
push eax
push edx
mov ecx, edi
call fcn.00409370
pop edi
pop esi
ret
Function at 0x418bd0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x43b929
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
lea ecx, [esi + 0xb4]
mov dword [esp + 0x1c], ebx
call fcn.0040b120
mov dword [esi + 0x20], 0x43e0c8
mov dword [esi + 0x24], 0x43e0cc
or eax, 0xffffffff
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
mov byte [esi + 0xe8], bl
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], eax
mov dword [esi + 0xe4], eax
lea ebp, [esi + 0x28]
mov ecx, ebp
call fcn.0040fae0
push 0x408700
push 0x405380
push 0xc
push 0xc
lea eax, [esi + 0xf0]
push eax
mov byte [esp + 0x30], 3
mov dword [esi + 0xec], ebx
call fcn.0042ab66
mov ecx, 0xc
xor eax, eax
lea edi, [esi + 0x180]
rep stosd dword es:[edi], eax
mov dword [esi + 0xac], 0x43e100
mov dword [esi + 0xb0], ebx
lea edi, [esi + 0x1b0]
mov ecx, edi
mov byte [esp + 0x1c], 5
mov dword [esi], 0x43ec90
mov dword [esi + 0x20], 0x43ec8c
mov dword [esi + 0x24], 0x43ec88
mov dword [ebp], 0x43ec5c
mov dword [esi + 0x60], 0x43ec44
mov dword [esi + 0x64], 0x43ec1c
mov dword [esi + 0x78], 0x43ebd8
mov dword [esi + 0x88], 0x43ebbc
mov dword [esi + 0xac], 0x43ebb8
call fcn.004121b0
mov dword [edi], 0x43eba8
lea ecx, [esi + 0x264]
mov byte [esp + 0x1c], 6
call fcn.00418b40
xor ecx, ecx
lea edx, [esi + 0x2c]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
push str.Rav.exe
mov dword [edx + 0xc], ecx
push 0x18
lea eax, [esi + 0x44]
mov dword [edx + 0x10], ecx
push eax
mov dword [edx + 0x14], ecx
call fcn.00401710
mov dword [esi + 0x8c], 1
mov ecx, dword [esp + 0x14]
pop edi
mov dword [esi + 0x2f8], ebx
mov dword [esi + 0x2f0], ebx
mov dword [esi + 0x2f4], ebx
mov dword [esi + 0x2ec], 0x4001
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4198d0
Capabilities:
Hide graphical window

Disassembly:
test ecx, ecx
push esi
push edi
je 0x4198de
lea edi, [ecx - 0xcc]
jmp 0x4198e0
xor edi, edi
mov al, byte [ecx + 0x1c]
test al, al
mov esi, dword [esp + 0x10]
je 0x419919
mov eax, dword [edi + 4]
push 0xe801
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp esi, 2
jne 0x41990a
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41991e
test esi, esi
jne 0x419919
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41991e
cmp esi, 1
je 0x41993a
mov eax, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x10
movsx edx, cx
movsx eax, ax
push edx
push eax
lea ecx, [edi + 0xcc]
call fcn.00408ef0
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x41a360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
push esi
push edi
push 0
push 0x83
mov esi, ecx
call fcn.00419f70
add esp, 8
test eax, eax
jne 0x41a486
test esi, esi
je 0x41a393
add esi, 0xffffff14
jmp 0x41a395
xor esi, esi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.Language_
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x10]
push eax
call fcn.00401710
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41a3c5
sub eax, edx
mov edx, dword [esi + 0x64]
lea ecx, [esi + 0x64]
push 0x64
lea eax, [esp + eax + 0xc]
push eax
call dword [edx + 0x24]
lea ecx, [esp + 8]
push 0x2e
push ecx
call fcn.0042b250
add esp, 8
test eax, eax
je 0x41a3f4
mov byte [eax], 0
push str..chm
push 0x104
lea edx, [esp + 0x10]
push edx
call fcn.00401ac0
xor eax, eax
mov byte [esp + 0x110], 0
mov ecx, 0x40
lea edi, [esp + 0x111]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x114]
push 0x104
push ecx
call fcn.0040cbb0
add esp, 0xc
lea edx, [esp + 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41a486
push str.hhctrl.ocx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x41a486
push str.HtmlHelpA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x41a486
push 0
push 0
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41a570
Capabilities:
Set current directory

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x41a589
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
ret
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
test ebp, ebp
push edi
je 0x41a5d7
push ebx
push ebp
call fcn.0042a3e2
lea ebx, [eax + eax + 2]
push ebx
call fcn.00429bd8
add esp, 8
push 0
push 0
push ebx
mov esi, eax
mov ecx, ebx
mov edx, ecx
shr ecx, 2
push esi
xor eax, eax
push 0xffffffffffffffff
mov edi, esi
rep stosd dword es:[edi], eax
push ebp
mov ecx, edx
push 0x200
and ecx, 3
push 0
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test esi, esi
mov edi, eax
je 0x41a5ed
push esi
call fcn.00429695
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x41a600
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x108
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x41a646
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetTempPathW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41a646
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push 0xffffffffffffffff
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41a690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x41a6c9
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
test eax, eax
je 0x41a72e
push eax
call fcn.0042a3e2
lea edi, [eax + eax + 2]
push edi
mov dword [esp + 0x14], edi
call fcn.00429bd8
mov ebx, eax
mov ecx, edi
mov edx, ecx
shr ecx, 2
add esp, 8
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
push esi
mov ecx, edx
push esi
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
mov eax, edx
push eax
push ebx
push 0xffffffffffffffff
push ecx
push 0x200
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41a77d
push eax
call fcn.0042a3e2
lea edi, [eax + eax + 2]
push edi
mov dword [esp + 0x14], edi
call fcn.00429bd8
mov esi, eax
mov ecx, edi
mov edx, ecx
shr ecx, 2
add esp, 8
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
push 0
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0xc]
mov eax, edx
push eax
push esi
push 0xffffffffffffffff
push ecx
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp + 0x10]
lea edx, [esp + 0x10]
push edx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test esi, esi
mov edi, eax
je 0x41a79d
push esi
call fcn.00429695
add esp, 4
test ebx, ebx
je 0x41a7aa
push ebx
call fcn.00429695
add esp, 4
mov ecx, dword [ebp + 0x14]
push 0x104
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x1c]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ae20
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push ecx
push 0x448468
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_wvsprintfA]
push 0
lea edx, [esp + 4]
push edx
push 0x448468
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [esp + 0x14]
push 0x448468
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ecx
ret

Function at 0x41be10
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe0
push esi
mov esi, dword [ebp + 8]
push edi
push str.System_Information_:_r_n
push esi
call fcn.0041ae20
xor eax, eax
mov ecx, 0x24
lea edi, [esp + 0x5c]
rep stosd dword es:[edi], eax
add esp, 8
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x54], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x41be75
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push eax
push ecx
push str.System_Version_Major__d_Minor__d_Build__d_PlatformId__d__r_n
push esi
call fcn.0041ae20
add esp, 0x18
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
push eax
push ecx
push str.CPU_Number_s___d___Type__d._r_n
push esi
call fcn.0041ae20
add esp, 0x10
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x10]
push eax
push str.Memory_in_use__d__._r_n
push esi
call fcn.0041ae20
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
add ecx, 0xfffff
shr ecx, 0x14
push ecx
add edx, 0xfffff
shr edx, 0x14
push edx
push str.Physical_memory__d__d_MBytes._r_n
push esi
call fcn.0041ae20
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
add eax, 0xfffff
shr eax, 0x14
push eax
add ecx, 0xfffff
shr ecx, 0x14
push ecx
push str.Paging_file__d__d_MBytes._r_n
push esi
call fcn.0041ae20
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
add edx, 0xfffff
shr edx, 0x14
push edx
add eax, 0xfffff
shr eax, 0x14
push eax
push str.User_address_space__d__d_MBytes._r_n
push esi
call fcn.0041ae20
push 0x43f144
push esi
call fcn.0041ae20
add esp, 0x44
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret