joyce8/EMBER2024-capa huggingface dataset:
Function at 0x617134
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00408f40
mov eax, dword [ebp - 8]
call fcn.00408f40
xor eax, eax
push ebp
push 0x6171cd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [esi], eax
push 0x20019
lea eax, [ebp - 0xc]
push eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.006168b0
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x6171b2
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 8]
call fcn.00409c50
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6171d4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ebc
ret

Function at 0x617498
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
call fcn.00408f40
mov eax, dword [ebp - 8]
call fcn.00408f40
xor eax, eax
push ebp
push 0x6175f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00616ea0
test al, al
jne 0x6174ef
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00616804
push 0x20006
lea eax, [ebp - 0xc]
push eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.006168b0
test eax, eax
je 0x617534
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x617610
call fcn.00420f7c
mov eax, dword [ebp - 0x10]
call fcn.0061b7c0
jmp 0x6175c6
xor eax, eax
push ebp
push 0x6175bf
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x61754b
xor eax, eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
push eax
push esi
movzx eax, bl
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00409c50
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x6175a8
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0x11
movzx eax, bl
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x34]
mov ecx, 2
mov eax, 0x61767c
call fcn.00420f7c
mov eax, dword [ebp - 0x1c]
call fcn.0061b7c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6175c6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6175f8
lea eax, [ebp - 0x1c]
call fcn.00408e5c
lea eax, [ebp - 0x10]
call fcn.00408e5c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ebc
ret
Function at 0x617864
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6178d6
push dword fs:[eax]
mov dword fs:[eax], esp
inc ecx
mov dword [ebp - 8], ecx
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00409de4
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00409c50
push eax
push esi
push ebx
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.00409c50
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.00409cb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6178dd
lea eax, [ebp - 4]
call fcn.00408e5c
ret

Function at 0x617b74
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00408f40
mov eax, dword [ebp - 8]
call fcn.00408f40
xor eax, eax
push ebp
push 0x617bf7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 2
lea eax, [ebp - 0xc]
push eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.006168b0
test eax, eax
jne 0x617bdc
mov eax, dword [ebp - 8]
call fcn.00409c50
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x617bfe
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ebc
ret

Function at 0x617eb4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00408f40
mov eax, dword [ebp - 8]
call fcn.00408f40
xor eax, eax
push ebp
push 0x617fa9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00408e5c
cmp dword [ebp - 4], 0
je 0x617f0d
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x617f0d
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040a074
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00409c50
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x617f8e
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00409c50
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x617f85
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00409de4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.00409c50
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov eax, dword [ebx]
call fcn.00409c50
mov edx, eax
mov eax, ebx
call fcn.00409cb8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x617fb0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ebc
ret
Function at 0x617fb8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00408f40
mov eax, dword [ebp - 8]
call fcn.00408f40
xor eax, eax
push ebp
push 0x61808f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x61800b
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x61800b
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040a074
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00409c50
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x618074
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00409c50
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x61806b
cmp dword [ebp - 0x14], 4
jne 0x61806b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x618096
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ebc
ret

Function at 0x6180a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00408f40
xor eax, eax
push ebp
push 0x618186
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00408e5c
cmp dword [ebp - 4], 0
je 0x6180f1
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x6180f1
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040a074
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00409c50
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x618170
mov eax, ebx
mov edx, 0x400
call fcn.00409de4
mov eax, dword [ebx]
test eax, eax
je 0x618126
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.00409c50
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x618160
mov eax, dword [ebx]
call fcn.00409c50
mov edx, eax
mov eax, ebx
call fcn.00409cb8
jmp 0x618167
mov eax, ebx
call fcn.00408e5c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61818d
lea eax, [ebp - 4]
call fcn.00408e5c
ret

Function at 0x61b2e8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
mov esi, edx
imul ebx, dword [eax], 0x8088405
inc ebx
mov dword [eax], ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, esi
xor edx, edx
call fcn.0040abcc
mov eax, edx
xor edx, edx
pop esi
pop ebx
ret
Function at 0x61ba00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x61ba81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00409de4
mov eax, dword [ebx]
mov esi, eax
test esi, esi
je 0x61ba32
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebx]
call fcn.00409c50
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, dword [ebx]
call fcn.00409c50
mov edx, eax
lea eax, [ebp - 8]
call fcn.00409cb8
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00427cec
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040923c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61ba88
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ebc
ret

Function at 0x61ba90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x61bb11
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00409de4
mov eax, dword [ebx]
mov esi, eax
test esi, esi
je 0x61bac2
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebx]
call fcn.00409c50
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, dword [ebx]
call fcn.00409c50
mov edx, eax
lea eax, [ebp - 8]
call fcn.00409cb8
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00427cec
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040923c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61bb18
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ebc
ret

Function at 0x61bb20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x61bba1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00409de4
mov eax, dword [ebx]
mov esi, eax
test esi, esi
je 0x61bb52
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebx]
call fcn.00409c50
push eax
push esi
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebx]
call fcn.00409c50
mov edx, eax
lea eax, [ebp - 8]
call fcn.00409cb8
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00427cec
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040923c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61bba8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ebc
ret

Function at 0x61bbb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00408f40
mov eax, dword [ebp - 8]
call fcn.00408f40
xor eax, eax
push ebp
push 0x61bc35
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00409de4
mov eax, dword [ebx]
call fcn.00409c50
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00409c50
push eax
mov eax, dword [ebp - 4]
call fcn.00409c50
push eax
call sub.kernel32.dll_GetTempFileNameW
mov eax, dword [ebx]
call fcn.00409c50
mov edx, eax
mov eax, ebx
call fcn.00409cb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61bc3c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ebc
ret
Function at 0x61cefc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00408f50
xor eax, eax
push ebp
push 0x61cf86
push dword fs:[eax]
mov dword fs:[eax], esp
cmp esi, 1
jl 0x61cf70
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0061ce20
mov ebx, esi
dec ebx
test ebx, ebx
jl 0x61cf46
inc ebx
lea eax, [ebp - 0x18]
call fcn.00617ea0
dec ebx
jne 0x61cf3b
mov ebx, esi
dec ebx
test ebx, ebx
jl 0x61cf70
inc ebx
xor esi, esi
mov eax, dword [ebp - 8]
movzx edi, byte [eax + esi]
lea eax, [ebp - 0x18]
call fcn.00617ea0
movzx eax, al
xor edi, eax
mov eax, edi
mov edx, dword [ebp - 8]
mov byte [edx + esi], al
inc esi
dec ebx
jne 0x61cf50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61cf8d
lea eax, [ebp - 4]
call fcn.00408e80
ret

Function at 0x61d474
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00408f40
xor eax, eax
push ebp
push 0x61d5b5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x61d5d0
call fcn.00409ebc
mov eax, dword [ebp - 8]
call fcn.0061b7c0
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x61d5e8
call fcn.0040a23c
dec eax
jne 0x61d519
movzx eax, byte [0x61d5f8]
push eax
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x61d608
mov edx, 0x61d61c
mov eax, dword [ebp - 4]
call fcn.00427f68
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00409284
movzx eax, byte [0x61d620]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x61d630
mov edx, 0x61d650
mov eax, dword [ebp - 4]
call fcn.00427f68
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00409284
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00409c50
mov ebx, eax
push ebx
push 0x61d664
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x1f
ja 0x61d59a
push 5
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x61d67c
call fcn.00420f7c
mov eax, dword [ebp - 0x14]
call fcn.00409c50
push eax
push 0x61d6bc
push 0x61d664
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x1f
ja 0x61d59a
call fcn.006203bc
test al, al
je 0x61d59a
push 5
push 0
push ebx
push 0x61d6d8
push 0x61d664
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61d5bc
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00408ebc
ret
Function at 0x61dbf4
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
xor esi, esi
cmp ebx, 0xffffffff
je 0x61dc8a
mov eax, esp
xor ecx, ecx
mov edx, 3
call fcn.00406d94
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [esp + 8]
push eax
push 3
lea eax, [esp + 0xc]
push eax
push ebx
call sub.kernel32.dll_ReadFile
cmp byte [esp], 0xff
jne 0x61dc48
cmp byte [esp + 1], 0xfe
jne 0x61dc48
mov esi, 1
jmp 0x61dc75
cmp byte [esp], 0xfe
jne 0x61dc5c
cmp byte [esp + 1], 0xff
jne 0x61dc5c
mov esi, 2
jmp 0x61dc75
cmp byte [esp], 0xef
jne 0x61dc75
cmp byte [esp + 1], 0xbb
jne 0x61dc75
cmp byte [esp + 2], 0xbf
jne 0x61dc75
mov esi, 3
mov edx, esi
mov eax, ebx
call fcn.0061dc94
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov eax, esi
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x61df30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00408f40
mov eax, dword [ebp - 8]
call fcn.00408f40
xor eax, eax
push ebp
push 0x61e042
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x61df98
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.0040cbd8
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 0x61e060
call fcn.004096d8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0061e074
mov ebx, eax
jmp 0x61e017
xor ebx, ebx
push 0
push 0x8000080
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.00409c50
push eax
call sub.kernel32.dll_CreateFileW
mov edi, eax
cmp edi, 0xffffffff
je 0x61e017
lea eax, [ebp - 0xc]
mov edx, 0x61e070
call fcn.00409284
push 0
lea eax, [ebp - 0x14]
push eax
push 2
mov eax, dword [ebp - 0xc]
call fcn.00409c50
push eax
push edi
call sub.kernel32.dll_WriteFile_1
mov esi, dword [ebp - 8]
test esi, esi
je 0x61dff1
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.00409c50
push eax
push edi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
push edi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61e049
lea eax, [ebp - 0x18]
call fcn.00408e80
lea eax, [ebp - 0x10]
call fcn.00408e80
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00408ebc
ret

Function at 0x61e074
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
push 0
push 0x8000080
push 2
push 0
push 0
push 0x40000000
mov eax, ebx
call fcn.00409c50
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x61e0d2
mov esi, edi
test esi, esi
je 0x61e0ae
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [esp + 4]
push eax
push esi
mov eax, edi
call fcn.004098a4
push eax
push ebp
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
push ebp
call sub.kernel32.dll_CloseHandle_1
jmp 0x61e0d4
xor ebx, ebx
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x61e0dc
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov esi, eax
mov ebx, edi
mov eax, ebx
test eax, eax
je 0x61e0f2
sub eax, 4
mov eax, dword [eax]
dec eax
jge 0x61e0f9
mov bl, 1
jmp 0x61e15c
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
mov eax, esi
call fcn.00409c50
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x61e15a
push 2
push 0
push 0
push ebp
call sub.kernel32.dll_SetFilePointer
mov esi, ebx
test esi, esi
je 0x61e136
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [esp + 4]
push eax
push esi
mov eax, edi
call fcn.004098a4
push eax
push ebp
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
push ebp
call sub.kernel32.dll_CloseHandle_1
jmp 0x61e15c
xor ebx, ebx
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x61e164
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 9], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x61e302
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
test eax, eax
je 0x61e195
sub eax, 4
mov eax, dword [eax]
dec eax
jge 0x61e1a1
mov byte [ebp - 0xa], 1
jmp 0x61e2e4
mov byte [ebp - 0xa], 0
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
mov eax, ebx
call fcn.00409c50
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x61e2e4
mov eax, ebx
call fcn.0061dbf4
mov esi, eax
push 2
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
push ebx
call sub.kernel32.dll_GetFileSize
test eax, eax
jne 0x61e264
cmp byte [ebp - 9], 0
je 0x61e22c
lea eax, [ebp - 8]
mov edx, 0x61e320
call fcn.00409320
mov esi, dword [ebp - 8]
test esi, esi
je 0x61e20f
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x10]
push eax
push esi
mov eax, dword [ebp - 8]
call fcn.004098a4
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
mov esi, 3
jmp 0x61e264
lea eax, [ebp - 4]
mov edx, 0x61e330
call fcn.00409284
mov esi, dword [ebp - 4]
test esi, esi
je 0x61e245
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 4]
call fcn.00409c50
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
mov esi, 1
cmp esi, 1
je 0x61e26e
cmp esi, 2
jne 0x61e2b2
lea eax, [ebp - 4]
mov edx, edi
call fcn.00409284
cmp esi, 2
jne 0x61e28a
mov eax, dword [ebp - 4]
call fcn.00409c50
call fcn.0061b2c4
mov esi, dword [ebp - 4]
test esi, esi
je 0x61e296
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 4]
call fcn.00409c50
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
jmp 0x61e2de
lea edx, [ebp - 8]
mov eax, edi
call fcn.0040cbd8
mov esi, dword [ebp - 8]
test esi, esi
je 0x61e2c8
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x10]
push eax
push esi
mov eax, dword [ebp - 8]
call fcn.004098a4
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61e309
lea eax, [ebp - 8]
call fcn.00408e80
lea eax, [ebp - 4]
call fcn.00408e5c
ret
Function at 0x61e44c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00408f40
mov eax, dword [ebp - 8]
call fcn.00408f40
xor eax, eax
push ebp
push 0x61e5b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.00408e5c
mov eax, dword [ebp - 8]
test eax, eax
je 0x61e49e
sub eax, 4
mov eax, dword [eax]
dec eax
jge 0x61e4ae
lea eax, [ebp - 8]
mov edx, 0x61e5d0
call fcn.00409284
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00409c50
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jbe 0x61e58e
mov eax, ebx
call fcn.0061b29c
mov esi, eax
push esi
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x61e585
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x61e5e8
push esi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x61e585
push 0x61e628
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov edx, 4
call fcn.0041fd78
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.0041fd78
push dword [ebp - 0x24]
push 0x61e658
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.0041f2c4
push dword [ebp - 0x28]
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00409f44
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00409c50
push eax
push esi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x61e585
cmp dword [ebp - 0x18], 1
jbe 0x61e585
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00409cb8
mov edx, ebx
mov eax, esi
call fcn.00406758
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61e5bd
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00408ebc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00408ebc
ret