joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4053b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x42b48c]
xor eax, ebp
mov dword [esp + 0x228], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ecx
xor eax, eax
test esi, esi
mov byte [esp + 0x20], 0
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], 0xffffffff
stosb byte es:[edi], al
je 0x40555c
mov eax, esi
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405410
sub eax, edi
cmp eax, 2
jb 0x40555c
cmp byte [esi + 1], 0x3a
jne 0x405454
lea eax, [esp + 0x20]
mov edx, esi
mov ecx, eax
mov edi, 0x104
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x40544a
mov byte [eax], cl
inc eax
dec edi
jne 0x405437
dec eax
mov byte [eax], 0
jmp 0x405493
test edi, edi
jne 0x40544f
dec eax
mov byte [eax], 0
jmp 0x405493
mov ebx, 0x104
lea esi, [esp + 0x20]
call fcn.00405160
mov ecx, ebx
mov eax, esi
cmp byte [eax], 0
je 0x405471
inc eax
dec ecx
jne 0x405466
jmp 0x405493
test ecx, ecx
je 0x405493
mov edx, dword [esp + 0x10]
mov eax, 0x104
sub eax, ecx
push edx
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x28]
push edx
call fcn.004033d0
mov edx, dword [esp + 0x14]
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x128], bl
mov ecx, 0x41
lea edi, [esp + 0x129]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push 0x104
lea ecx, [esp + 0x130]
push ecx
push 0x424a04
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [esp + 0x18], eax
cmp byte [esp + 0x128], bl
je 0x40555c
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.USER32.dll_CharUpperA]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x12c]
push 0x424a00
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call fcn.00416e96
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
ja 0x40555f
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x12c]
push str.0X_X
push edx
call fcn.00416e96
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, ebx
ja 0x40555f
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x12c]
push 0x4249f4
push ecx
call fcn.00416e96
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp eax, ebx
ja 0x40555f
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x234]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415d1a
mov esp, ebp
pop ebp
ret
Function at 0x405580
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x42b48c]
xor eax, ebp
mov dword [esp + 0x120], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
xor eax, eax
mov byte [esp + 0x20], 0
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
or ebx, 0xffffffff
test esi, esi
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x1c], esi
stosb byte es:[edi], al
je 0x40569b
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4055e2
sub eax, edi
cmp eax, 2
jb 0x40569b
cmp byte [esi + 1], 0x3a
jne 0x405624
lea eax, [esp + 0x20]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
mov cl, byte [esi + eax]
test cl, cl
je 0x40561a
mov byte [eax], cl
inc eax
dec edx
jne 0x405607
dec eax
mov byte [eax], 0
jmp 0x405663
test edx, edx
jne 0x40561f
dec eax
mov byte [eax], 0
jmp 0x405663
mov ebx, 0x104
lea esi, [esp + 0x20]
call fcn.00405160
mov ecx, ebx
mov eax, esi
cmp byte [eax], 0
je 0x405641
inc eax
dec ecx
jne 0x405636
jmp 0x405663
test ecx, ecx
je 0x405663
mov edx, dword [esp + 0x1c]
mov eax, 0x104
sub eax, ecx
push edx
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x28]
push edx
call fcn.004033d0
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, ebp
call fcn.00415d1a
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00415d1a
mov esp, ebp
pop ebp
ret
Function at 0x405750
Capabilities:
Delete file
Get file size
Move file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x42b48c]
xor eax, ebp
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x224], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0x10], eax
xor eax, eax
test ebx, ebx
mov ecx, 0x41
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
je 0x4057e8
cmp byte [ebx], 0
je 0x4057e8
push 0x5c
push ebx
call fcn.0041640d
add esp, 8
test eax, eax
jne 0x405834
push 0x105
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x18]
push 0x5c
push edx
call fcn.0041651b
add esp, 8
test eax, eax
je 0x4057cd
mov byte [eax + 1], 0
mov ecx, 0x105
lea eax, [esp + 0x18]
cmp byte [eax], 0
je 0x4057e1
inc eax
dec ecx
jne 0x4057d6
jmp 0x405830
test ecx, ecx
je 0x405830
push ebx
jmp 0x405817
push 0x105
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x105
lea eax, [esp + 0x18]
cmp byte [eax], 0
je 0x40580e
inc eax
dec ecx
jne 0x405803
jmp 0x405830
test ecx, ecx
je 0x405830
push str..log
mov eax, 0x105
sub eax, ecx
mov ecx, 0x105
sub ecx, eax
lea edx, [esp + eax + 0x1c]
push ecx
push edx
call fcn.004033d0
lea ebx, [esp + 0x18]
push 0
push 0x20
push 4
push 0
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40597f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0x10]
shl ecx, 0xa
cmp eax, ecx
jbe 0x405948
cmp eax, 0xffffffff
je 0x405948
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x105
push ebx
lea edx, [esp + 0x128]
xor eax, eax
mov byte [esp + 0x128], 0
mov ecx, 0x41
lea edi, [esp + 0x129]
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [esp + 0x120]
push 0x2e
push eax
call fcn.0041651b
add esp, 8
test eax, eax
je 0x4058c1
mov byte [eax], 0
mov ecx, 0x105
lea eax, [esp + 0x120]
lea ecx, [ecx]
cmp byte [eax], 0
je 0x4058db
inc eax
dec ecx
jne 0x4058d0
jmp 0x405900
test ecx, ecx
je 0x405900
mov eax, 0x105
sub eax, ecx
push str.2.log
mov ecx, 0x105
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x128]
push edx
call fcn.004033d0
push 0x80
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x120]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push 0x20
push 4
push 0
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x10]
push 0
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415d1a
mov esp, ebp
pop ebp
ret
Function at 0x408b70
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x422560
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
mov eax, dword [0x42c534]
mov ecx, 0x42c534
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov ecx, dword [esi + 0x454]
push ecx
lea edx, [esp + 0x10]
push str._s_rsmsginfo.ini
push edx
mov dword [esp + 0x24], 0
call fcn.00408960
mov eax, dword [0x42c534]
add esp, 0xc
mov ecx, 0x42c534
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 8], esi
mov ebp, dword [esi - 4]
mov eax, dword [esi - 8]
mov ecx, 1
mov byte [esp + 0x18], cl
sub ecx, ebp
sub eax, 0x104
or eax, ecx
jge 0x408c09
push 0x104
lea ecx, [esp + 0xc]
call fcn.00404e20
mov esi, dword [esp + 8]
mov ebp, dword [esp + 0xc]
push ebp
push 0x104
push esi
push 0x424a04
push str.sguid
push str.rsmsg
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test esi, esi
jne 0x408c31
xor eax, eax
jmp 0x408c41
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408c36
sub eax, edx
js 0x408cb7
cmp eax, dword [esi - 8]
jg 0x408cb7
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
push edi
add esi, 0xfffffff0
push esi
call fcn.00404e70
mov edi, dword [esp + 0x28]
add eax, 0x10
add esp, 4
mov dword [edi], eax
mov byte [esp + 0x1c], 0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408c7f
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
lea eax, [ebp - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408ca1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret 4
push 0x80070057
call fcn.004011d0
int3
Function at 0x40b360
Capabilities:
Access peb ldr_data
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4228d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
add ecx, 0x22c
push edi
push ecx
lea ecx, [esp + 0x14]
call fcn.00409be0
push 0xd
xor ebx, ebx
push str.RsMgrSvc.ini
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], ebx
call fcn.00405e10
mov eax, dword [esp + 0x10]
push eax
push ebx
push str.COUNT
push str.DELETEFILE
call fcn.0040d4f0
mov edx, dword [0x42c534]
add esp, 0x10
mov ecx, 0x42c534
mov dword [esp + 0x1c], eax
call dword [edx + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x18], edi
mov eax, dword [0x42c534]
mov ecx, 0x42c534
mov byte [esp + 0x28], 1
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x1c]
mov ebp, 1
cmp eax, ebp
mov byte [esp + 0x28], 2
jl 0x40b4ba
push ebp
lea ecx, [esp + 0x1c]
push str.ITEM_d
push ecx
call fcn.00408960
mov edi, dword [esi - 4]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, edi
mov edi, 0x208
sub eax, edi
add esp, 0xc
or eax, ecx
jge 0x40b43b
push edi
lea ecx, [esp + 0x18]
call fcn.00404e20
mov esi, dword [esp + 0x14]
cmp dword [esi - 8], edi
jl 0x40b543
mov dword [esi - 0xc], edi
mov byte [esi + 0x208], bl
mov edx, dword [esp + 0x10]
push edx
push edi
mov edi, dword [esp + 0x20]
push esi
push 0x424a04
push edi
push str.DELETEFILE
call fcn.0040d510
mov eax, esi
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b470
sub eax, edx
js 0x40b543
cmp eax, dword [esi - 8]
jg 0x40b543
mov dword [esi - 0xc], eax
mov byte [eax + esi], bl
cmp dword [esi - 0xc], ebx
je 0x40b4ad
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
push str.DeleteFile:__s.
push 0x80
call fcn.004062b0
add esp, 0xc
mov eax, dword [esp + 0x1c]
inc ebp
cmp ebp, eax
jle 0x40b402
mov eax, dword [esp + 0x10]
push eax
push ebx
push str.DELETEFILE
call fcn.0040d5c0
lea eax, [esi - 0x10]
add esp, 0xc
mov byte [esp + 0x28], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b4ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [edi - 0x10]
mov byte [esp + 0x28], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b50a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b530
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
push 0x80070057
call fcn.004011d0
int3
Function at 0x40d4f0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
ret

Function at 0x40d510
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret

Function at 0x40d870
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa8
mov eax, dword [0x42b48c]
xor eax, ebp
push esi
push edi
mov dword [esp + 0xac], eax
mov esi, ecx
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x9c
call edi
test eax, eax
jne 0x40d8db
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x94
call edi
test eax, eax
jne 0x40d8db
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, ebp
call fcn.00415d1a
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x18], 2
mov eax, 1
jne 0x40d914
mov ecx, dword [esp + 0xc]
cmp ecx, 5
mov dword [esi + 4], eax
jne 0x40d90f
mov ecx, dword [esp + 0x10]
test ecx, ecx
ja 0x40d911
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, ebp
call fcn.00415d1a
mov esp, ebp
pop ebp
ret
jbe 0x40d914
mov dword [esi + 8], eax
mov ecx, dword [esp + 0xac]
pop edi
xor ecx, ebp
pop esi
call fcn.00415d1a
mov esp, ebp
pop ebp
ret
Function at 0x40de20
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
mov eax, dword [0x42b48c]
push ebx
mov ebx, dword [ebp + 8]
xor eax, ebp
push esi
push edi
mov dword [esp + 0x264], eax
mov byte [esp + 0x158], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x159]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
mov dword [esp + 0x10], 1
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40df0e
test al, 0x10
je 0x40df0e
push 0x103
lea eax, [esp + 0x15c]
push ebx
push eax
call fcn.00416488
lea ecx, [esp + 0x164]
push 0x5c
push ecx
call fcn.0041651b
add esp, 0x14
lea edx, [esp + 0x158]
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0x158]
cmp esi, eax
je 0x40ded5
lea edi, [esp + 0x158]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40dec3
mov cx, word [0x424408]
mov word [edi], cx
lea edi, [esp + 0x158]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40dee0
mov edx, dword [0x42498c]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x15c]
push ecx
mov dword [edi], edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
jne 0x40df30
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.00415d1a
mov esp, ebp
pop ebp
ret
push 0x103
lea edx, [esp + 0x15c]
push ebx
push edx
call fcn.00416488
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0xc
lea eax, [esp + 0x44]
push eax
call esi
lea ecx, [esp + 0x158]
push ecx
mov dword [esp + 0x18], eax
call esi
mov ecx, dword [esp + 0x14]
add ecx, eax
cmp ecx, 0x103
ja 0x40dfbd
lea edi, [esp + 0x158]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40df77
mov dx, word [0x424408]
lea eax, [esp + 0x44]
mov word [edi], dx
mov edx, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40df90
lea edi, [esp + 0x158]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40dfa1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x10]
test byte [esp + 0x18], 0x10
je 0x40dfe1
cmp byte [esp + 0x44], 0x2e
jne 0x40dfe1
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40df30
jmp 0x40dfe9
mov dword [esp + 0xc], 0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x264]
mov eax, dword [esp + 0xc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415d1a
mov esp, ebp
pop ebp
ret
Function at 0x40fc40
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x42b48c]
xor eax, ebp
push ebx
mov dword [esp + 0x124], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0x1c], eax
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x20], bl
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.WININET.DLL
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
mov dword [esp + 0x10], ebx
je 0x40fd01
push 0x104
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x40fd01
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
jbe 0x40fd01
push edi
call fcn.00415ce4
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
push esi
push edi
push ecx
lea edx, [esp + 0x2c]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40fcf8
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x424408
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x40fd18
push esi
call fcn.00415d3e
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, ebp
call fcn.00415d1a
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
mov ecx, dword [esp + 0x1c]
push edx
push eax
push str.MSIE__d._d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
push esi
call fcn.00415d3e
mov ecx, dword [esp + 0x140]
add esp, 0x14
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00415d1a
mov esp, ebp
pop ebp
ret
Function at 0x40fd60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa8
mov eax, dword [0x42b48c]
xor eax, ebp
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0xac], eax
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x9c
call edi
test eax, eax
jne 0x40fdce
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x94
call edi
test eax, eax
jne 0x40fdce
mov byte [esi], al
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, ebp
call fcn.00415d1a
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
sub eax, 0
je 0x40fe4d
dec eax
je 0x40fdf8
dec eax
jne 0x40fe5c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
push str.Windows_NT__d._d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x40fe5c
cmp dword [esp + 0xc], 4
jne 0x40fe5c
mov eax, dword [esp + 0x10]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
jne 0x40fe21
push str.Windows_95
push esi
call edi
mov eax, dword [esp + 0x14]
add esp, 8
cmp eax, 4
jne 0x40fe5c
cmp dword [esp + 0x10], 0xa
jne 0x40fe3c
push str.Windows_98
push esi
call edi
mov eax, dword [esp + 0x14]
add esp, 8
cmp eax, 4
jne 0x40fe5c
cmp dword [esp + 0x10], 0x5a
jne 0x40fe5c
push str.Windows_Me
push esi
call edi
jmp 0x40fe59
push str.Windows
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov ecx, dword [esp + 0xac]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00415d1a
mov esp, ebp
pop ebp
ret
Function at 0x40fe80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x42b48c]
xor eax, ebp
mov dword [esp + 0x110], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
xor eax, eax
test esi, esi
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, 1
stosb byte es:[edi], al
je 0x40fee3
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
test eax, eax
jle 0x40fee3
push esi
call edi
cmp eax, 0x104
jbe 0x40fefa
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, ebp
call fcn.00415d1a
mov esp, ebp
pop ebp
ret
push 0x103
push esi
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp + 8]
test eax, eax
je 0x40ff1d
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathSkipRootA]
mov esi, eax
push esi
call edi
test eax, eax
jne 0x40ff4b
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, ebp
call fcn.00415d1a
mov esp, ebp
pop ebp
ret
push 0x5c
push esi
call fcn.0041640d
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
add esp, 8
test esi, esi
je 0x40ff9c
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov byte [esi], 0
call edi
and ebx, eax
jne 0x40ff87
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40ff87
mov ebx, 1
mov byte [esi], 0x5c
push 0x5c
inc esi
push esi
call fcn.0041640d
mov esi, eax
add esp, 8
test esi, esi
jne 0x40ff62
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
call edi
and ebx, eax
jne 0x40ffbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40ffbe
mov ebx, 1
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00415d1a
mov esp, ebp
pop ebp
ret