joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62b8e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00407578
mov eax, dword [ebp - 8]
call fcn.00407578
xor eax, eax
push ebp
push 0x62b9bf
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x62b93b
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x62b93b
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00408720
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.004082fc
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x62b9a4
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004082fc
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x62b99b
cmp dword [ebp - 0x14], 4
jne 0x62b99b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62b9c6
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret

Function at 0x62b9d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00407578
xor eax, eax
push ebp
push 0x62bab6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407494
cmp dword [ebp - 4], 0
je 0x62ba21
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x62ba21
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00408720
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.004082fc
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x62baa0
mov eax, ebx
mov edx, 0x400
call fcn.00408490
mov eax, dword [ebx]
test eax, eax
je 0x62ba56
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.004082fc
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x62ba90
mov eax, dword [ebx]
call fcn.004082fc
mov edx, eax
mov eax, ebx
call fcn.00408364
jmp 0x62ba97
mov eax, ebx
call fcn.00407494
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62babd
lea eax, [ebp - 4]
call fcn.00407494
ret

Function at 0x630294
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
mov esi, edx
imul ebx, dword [eax], 0x8088405
inc ebx
mov dword [eax], ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, esi
xor edx, edx
call fcn.00409348
mov eax, edx
xor edx, edx
pop esi
pop ebx
ret
Function at 0x630914
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x630995
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00408490
mov eax, dword [ebx]
mov esi, eax
test esi, esi
je 0x630946
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebx]
call fcn.004082fc
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, dword [ebx]
call fcn.004082fc
mov edx, eax
lea eax, [ebp - 8]
call fcn.00408364
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004249f4
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00407874
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63099c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret

Function at 0x6309a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x630a25
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00408490
mov eax, dword [ebx]
mov esi, eax
test esi, esi
je 0x6309d6
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebx]
call fcn.004082fc
push eax
push esi
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebx]
call fcn.004082fc
mov edx, eax
lea eax, [ebp - 8]
call fcn.00408364
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004249f4
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00407874
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x630a2c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret

Function at 0x630a34
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407578
mov eax, dword [ebp - 8]
call fcn.00407578
xor eax, eax
push ebp
push 0x630ab9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00408490
mov eax, dword [ebx]
call fcn.004082fc
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004082fc
push eax
mov eax, dword [ebp - 4]
call fcn.004082fc
push eax
call sub.kernel32.dll_GetTempFileNameW
mov eax, dword [ebx]
call fcn.004082fc
mov edx, eax
mov eax, ebx
call fcn.00408364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x630ac0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret
Function at 0x631b34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00407588
xor eax, eax
push ebp
push 0x631bbe
push dword fs:[eax]
mov dword fs:[eax], esp
cmp esi, 1
jl 0x631ba8
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00631a58
mov ebx, esi
dec ebx
test ebx, ebx
jl 0x631b7e
inc ebx
lea eax, [ebp - 0x18]
call fcn.0062b7d0
dec ebx
jne 0x631b73
mov ebx, esi
dec ebx
test ebx, ebx
jl 0x631ba8
inc ebx
xor esi, esi
mov eax, dword [ebp - 8]
movzx edi, byte [eax + esi]
lea eax, [ebp - 0x18]
call fcn.0062b7d0
movzx eax, al
xor edi, eax
mov eax, edi
mov edx, dword [ebp - 8]
mov byte [edx + esi], al
inc esi
dec ebx
jne 0x631b88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x631bc5
lea eax, [ebp - 4]
call fcn.004074b8
ret

Function at 0x6320ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407578
xor eax, eax
push ebp
push 0x6321ed
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x632208
call fcn.00408568
mov eax, dword [ebp - 8]
call fcn.006306d4
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x632220
call fcn.004088e8
dec eax
jne 0x632151
movzx eax, byte [0x632230]
push eax
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x632240
mov edx, 0x632254
mov eax, dword [ebp - 4]
call fcn.00424c7c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004078bc
movzx eax, byte [0x632258]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x632268
mov edx, 0x632288
mov eax, dword [ebp - 4]
call fcn.00424c7c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.004078bc
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004082fc
mov ebx, eax
push ebx
push 0x63229c
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x1f
ja 0x6321d2
push 5
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x6322b4
call fcn.0041dee8
mov eax, dword [ebp - 0x14]
call fcn.004082fc
push eax
push 0x6322f4
push 0x63229c
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x1f
ja 0x6321d2
call fcn.006359cc
test al, al
je 0x6321d2
push 5
push 0
push ebx
push 0x632310
push 0x63229c
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6321f4
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004074f4
ret
Function at 0x632868
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
xor esi, esi
cmp ebx, 0xffffffff
je 0x6328fe
mov eax, esp
xor ecx, ecx
mov edx, 3
call fcn.004053b0
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [esp + 8]
push eax
push 3
lea eax, [esp + 0xc]
push eax
push ebx
call sub.kernel32.dll_ReadFile
cmp byte [esp], 0xff
jne 0x6328bc
cmp byte [esp + 1], 0xfe
jne 0x6328bc
mov esi, 1
jmp 0x6328e9
cmp byte [esp], 0xfe
jne 0x6328d0
cmp byte [esp + 1], 0xff
jne 0x6328d0
mov esi, 2
jmp 0x6328e9
cmp byte [esp], 0xef
jne 0x6328e9
cmp byte [esp + 1], 0xbb
jne 0x6328e9
cmp byte [esp + 2], 0xbf
jne 0x6328e9
mov esi, 3
mov edx, esi
mov eax, ebx
call fcn.00632908
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov eax, esi
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x632ba4
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
push 0
push 0x8000080
push 2
push 0
push 0
push 0x40000000
mov eax, ebx
call fcn.004082fc
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x632c02
mov esi, edi
test esi, esi
je 0x632bde
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [esp + 4]
push eax
push esi
mov eax, edi
call fcn.00407edc
push eax
push ebp
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
push ebp
call sub.kernel32.dll_CloseHandle_1
jmp 0x632c04
xor ebx, ebx
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x632c0c
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov esi, eax
mov ebx, edi
mov eax, ebx
test eax, eax
je 0x632c22
sub eax, 4
mov eax, dword [eax]
dec eax
jge 0x632c29
mov bl, 1
jmp 0x632c8c
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
mov eax, esi
call fcn.004082fc
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x632c8a
push 2
push 0
push 0
push ebp
call sub.kernel32.dll_SetFilePointer
mov esi, ebx
test esi, esi
je 0x632c66
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [esp + 4]
push eax
push esi
mov eax, edi
call fcn.00407edc
push eax
push ebp
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
push ebp
call sub.kernel32.dll_CloseHandle_1
jmp 0x632c8c
xor ebx, ebx
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x632c94
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 9], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x632e32
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
test eax, eax
je 0x632cc5
sub eax, 4
mov eax, dword [eax]
dec eax
jge 0x632cd1
mov byte [ebp - 0xa], 1
jmp 0x632e14
mov byte [ebp - 0xa], 0
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
mov eax, ebx
call fcn.004082fc
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x632e14
mov eax, ebx
call fcn.00632868
mov esi, eax
push 2
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
push ebx
call sub.kernel32.dll_GetFileSize
test eax, eax
jne 0x632d94
cmp byte [ebp - 9], 0
je 0x632d5c
lea eax, [ebp - 8]
mov edx, 0x632e50
call fcn.00407958
mov esi, dword [ebp - 8]
test esi, esi
je 0x632d3f
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x10]
push eax
push esi
mov eax, dword [ebp - 8]
call fcn.00407edc
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
mov esi, 3
jmp 0x632d94
lea eax, [ebp - 4]
mov edx, 0x632e60
call fcn.004078bc
mov esi, dword [ebp - 4]
test esi, esi
je 0x632d75
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 4]
call fcn.004082fc
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
mov esi, 1
cmp esi, 1
je 0x632d9e
cmp esi, 2
jne 0x632de2
lea eax, [ebp - 4]
mov edx, edi
call fcn.004078bc
cmp esi, 2
jne 0x632dba
mov eax, dword [ebp - 4]
call fcn.004082fc
call fcn.006301dc
mov esi, dword [ebp - 4]
test esi, esi
je 0x632dc6
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 4]
call fcn.004082fc
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
jmp 0x632e0e
lea edx, [ebp - 8]
mov eax, edi
call fcn.0040b388
mov esi, dword [ebp - 8]
test esi, esi
je 0x632df8
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x10]
push eax
push esi
mov eax, dword [ebp - 8]
call fcn.00407edc
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x632e39
lea eax, [ebp - 8]
call fcn.004074b8
lea eax, [ebp - 4]
call fcn.00407494
ret
Function at 0x632f7c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407578
mov eax, dword [ebp - 8]
call fcn.00407578
xor eax, eax
push ebp
push 0x6330e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.00407494
mov eax, dword [ebp - 8]
test eax, eax
je 0x632fce
sub eax, 4
mov eax, dword [eax]
dec eax
jge 0x632fde
lea eax, [ebp - 8]
mov edx, 0x633100
call fcn.004078bc
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.004082fc
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jbe 0x6330be
mov eax, ebx
call fcn.006301b4
mov esi, eax
push esi
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x6330b5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x633118
push esi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x6330b5
push 0x633158
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov edx, 4
call fcn.0041cc58
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.0041cc58
push dword [ebp - 0x24]
push 0x633188
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.0041c1a4
push dword [ebp - 0x28]
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.004085f0
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004082fc
push eax
push esi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x6330b5
cmp dword [ebp - 0x18], 1
jbe 0x6330b5
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00408364
mov edx, ebx
mov eax, esi
call fcn.00404d74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6330ed
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004074f4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004074f4
ret
Function at 0x63318c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x633195
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x633373
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00407494
mov eax, edi
call fcn.00407494
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
mov eax, ebx
call fcn.004082fc
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x63334b
mov eax, dword [ebp - 0xc]
call fcn.006301b4
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x633344
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, ebx
call fcn.004082fc
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x63332b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x633384
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x63332b
push 0x6333c4
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov edx, 4
call fcn.0041cc58
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.0041cc58
push dword [ebp - 0x24]
push 0x6333f4
lea eax, [ebp - 4]
mov edx, 4
call fcn.004085f0
push 0x6333c4
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov edx, 4
call fcn.0041cc58
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.0041cc58
push dword [ebp - 0x2c]
push 0x633424
lea eax, [ebp - 8]
mov edx, 4
call fcn.004085f0
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.004082fc
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x6332f8
cmp dword [ebp - 0x14], 1
jbe 0x6332f8
mov eax, esi
mov edx, dword [ebp - 0x1c]
call fcn.00408364
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
call fcn.004082fc
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x63332b
cmp dword [ebp - 0x14], 1
jbe 0x63332b
mov eax, edi
mov edx, dword [ebp - 0x1c]
call fcn.00408364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63334b
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.00404d74
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63337a
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.004074f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret
Function at 0x633440
Capabilities:
Get memory capacity

Disassembly:
push ebx
push esi
add esp, 0xffffffc0
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x40
call fcn.004053b0
mov dword [esp], 0x40
push esp
call sub.kernel32.dll_GlobalMemoryStatusEx
mov eax, dword [esp + 8]
mov dword [ebx], eax
mov eax, dword [esp + 0xc]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
add esp, 0x40
pop esi
pop ebx
ret

Function at 0x6340a8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x6340d5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6340e1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x634230
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov byte [ebp - 9], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x634396
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4c88fc]
call fcn.004994b0
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x63434c
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00424a3c
lea eax, [ebp - 0x18]
mov ecx, 0x6343b0
mov edx, dword [ebp - 4]
call fcn.00408568
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov edx, 0x1ff
call fcn.006340ec
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x634331
inc ebx
mov dword [ebp - 0x14], 0
push dword [ebp - 4]
push 0x6343c8
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004085f0
mov eax, dword [ebp - 8]
call fcn.004082fc
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x6342fe
test al, 0x10
je 0x6342fe
movzx edx, byte [ebp - 9]
mov eax, dword [ebp - 8]
call fcn.00634230
jmp 0x63432b
cmp byte [ebp - 9], 0
je 0x634310
mov eax, dword [ebp - 8]
call fcn.00633fa0
test al, al
je 0x63432b
push 0x80
mov eax, dword [ebp - 8]
call fcn.004082fc
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 8]
call fcn.0041d578
inc dword [ebp - 0x14]
dec ebx
jne 0x6342b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x634353
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x10], edx
call fcn.004058a8
ret
Function at 0x6343d4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x63448d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00407494
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
xor ebx, ebx
mov ecx, ebx
mov eax, esi
shr eax, cl
test eax, esi
jbe 0x634463
lea edi, [ebx + 0x41]
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00408324
lea eax, [ebp - 0x10]
mov edx, 0x6344a8
call fcn.00408510
mov eax, dword [ebp - 0x10]
call fcn.004082fc
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, dword [ebp - 4]
jne 0x634463
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00408324
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00408510
mov eax, dword [ebp - 8]
inc ebx
cmp ebx, 0x1a
jne 0x634414
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x634494
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004074f4
ret