joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402b96
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 0x10]
xor ebx, ebx
mov dword [esi + 8], ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
jne 0x402bbf
push ebx
push ebx
call fcn.0043bd2a
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp + 0x10], eax
jne 0x402bd7
push ebx
push ebx
call fcn.0043bd2a
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x402bef
push ebx
push ebx
call fcn.0043bd2a
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [esi], eax
jne 0x402c05
push ebx
push ebx
call fcn.0043bd2a
push dword [esi + 4]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [esi]
call fcn.0043b5e0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40423e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
mov byte [ebp - 0x1c], 0x49
cmp byte [ebp + 0xc], al
mov dword [ebp - 4], eax
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x19], 0x74
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x53
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], al
je 0x4042a4
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x57
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], al
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xf]
push 1
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00401717
mov eax, dword [ebp + 8]
leave
ret 8
Function at 0x4046c3
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x45f222
call fcn.0043b5c0
sub esp, 0x224
push ebx
push esi
lea eax, [ebp - 0x230]
push edi
xor ebx, ebx
push eax
push 0x104
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x404707
lea ecx, [ebp - 0x58]
call fcn.004048a7
lea eax, [ebp - 0x58]
push 0x46a2a8
push eax
call fcn.0043bd2a
push 0x24
xor eax, eax
pop ecx
lea edi, [ebp - 0x128]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
mov edi, 0x467578
mov esi, 0x467570
je 0x404846
cmp dword [ebp - 0x11c], 1
jne 0x404846
lea eax, [ebp - 0xe]
push ebx
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
call fcn.00405529
push 0x4763fc
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.00404c8a
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea ecx, [ebp - 0x3c]
call fcn.004058df
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x404825
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.00404a29
pop ecx
pop ecx
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 2
push ecx
mov ecx, eax
call fcn.00404b66
push dword [0x467558]
mov ecx, eax
add eax, 4
mov byte [ebp - 4], 3
neg ecx
sbb ecx, ecx
push ebx
and ecx, eax
push ecx
lea ecx, [ebp - 0x38]
call fcn.00402392
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 2
call fcn.0040127e
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.0040127e
push 0x4763f0
lea ecx, [ebp - 0x3c]
call fcn.00404c8a
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401b1a
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c]
jmp 0x404890
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x3c]
call fcn.004058df
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
call fcn.0040127e
lea eax, [ebp - 0xd]
push ebx
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x44], esi
call fcn.00405529
push 0x4763ec
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 4
call fcn.00404c8a
mov ecx, dword [ebp + 8]
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401b1a
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x64]
call fcn.0040127e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x404a29
Capabilities:
Get common file path

Disassembly:
mov eax, 0x45f28f
call fcn.0043b5c0
sub esp, 0x15c
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
push 1
mov esi, 0x104
pop ebx
cmp dword [ebp + 0xc], ebx
jne 0x404ad4
push 0x47642c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x404ad4
push 0x476410
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x47640c], eax
je 0x404ad4
lea ecx, [ebp - 0x168]
push esi
push ecx
call eax
test eax, eax
je 0x404ad4
lea eax, [ebp + 0xf]
push 0
push eax
lea eax, [ebp - 0x168]
mov edi, 0x467578
mov esi, 0x467570
push eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x44], esi
call fcn.00405529
push 0x4763ec
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], ebx
call fcn.00404c8a
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401b1a
mov dword [ebp - 0x14], ebx
and byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
jmp 0x404b4f
lea eax, [ebp - 0x168]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x404afc
lea ecx, [ebp - 0x30]
call fcn.004048a7
lea eax, [ebp - 0x30]
push 0x46a2a8
push eax
call fcn.0043bd2a
lea eax, [ebp - 0xd]
push 0
push eax
lea eax, [ebp - 0x168]
mov edi, 0x467578
mov esi, 0x467570
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
call fcn.00405529
push 0x4763ec
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 2
call fcn.00404c8a
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401b1a
and byte [ebp - 4], 0
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x3c]
call fcn.0040127e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4070a3
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
mov esi, ecx
mov eax, dword [esi]
movzx ecx, word [eax + 0x48]
cmp ecx, dword [ebp + 8]
jne 0x4070c1
mov ax, word [eax + 0x4e]
cmp ax, 0xffff
jne 0x407102
lea eax, [ebp - 0x14]
push 0x14
push eax
push 0x1004
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jle 0x4070fc
lea eax, [ebp - 0x14]
push eax
call fcn.0043c5ca
pop ecx
lea ecx, [ebp - 0x34]
push 2
push ecx
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
test eax, eax
je 0x4070fc
mov eax, dword [esi]
mov cx, word [ebp - 0x34]
mov word [eax + 0x4e], cx
mov eax, dword [esi]
mov ax, word [eax + 0x4e]
pop esi
leave
ret 4
Function at 0x40a1cf
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x45fc6f
call fcn.0043b5c0
mov eax, 0x10a0
call fcn.0043b1a0
push ebx
push esi
xor esi, esi
push edi
lea eax, [ebp - 0x21]
mov ebx, 0x4675b0
mov edi, 0x4675a8
push esi
push eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x34], edi
call fcn.0040b2c0
or dword [ebp - 0x20], 0xffffffff
push 1
pop eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push esi
push 0x80
push 3
push esi
push eax
push SysReAllocStringLen
mov byte [ebp - 4], 2
call fcn.0040bc78
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x28], eax
je 0x40a2ff
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xac]
push eax
call fcn.00436681
pop ecx
lea eax, [ebp + 0xc]
push esi
push eax
lea eax, [ebp - 0x10ac]
push 0x1000
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a28c
push dword [ebp + 0xc]
lea eax, [ebp - 0x10ac]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.004366a9
add esp, 0xc
cmp dword [ebp + 0xc], esi
ja 0x40a250
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00436747
movzx eax, byte [ebp - 0xd]
pop ecx
pop ecx
push eax
movzx eax, byte [ebp - 0xe]
push eax
movzx eax, byte [ebp - 0xf]
push eax
movzx eax, byte [ebp - 0x10]
push eax
movzx eax, byte [ebp - 0x11]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
movzx eax, byte [ebp - 0x15]
push eax
movzx eax, byte [ebp - 0x16]
push eax
movzx eax, byte [ebp - 0x17]
push eax
movzx eax, byte [ebp - 0x18]
push eax
movzx eax, byte [ebp - 0x19]
push eax
movzx eax, byte [ebp - 0x1a]
push eax
movzx eax, byte [ebp - 0x1b]
push eax
movzx eax, byte [ebp - 0x1c]
push eax
lea eax, [ebp - 0x54]
push 0x476b64
push eax
call fcn.0040aff7
add esp, 0x48
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x54]
push 0
push eax
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 0x20], edi
call fcn.0040b335
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 0x20], 0xffffffff
je 0x40a32f
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40a32f
push dword [ebp - 0x20]
call eax
and byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.00406320
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x413e7e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0
je 0x413ec3
mov eax, dword [ebp + 8]
test eax, eax
je 0x413e98
and dword [eax], 0
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov edi, eax
cmp edi, 0xffffffff
jne 0x413f1f
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.00413d79
lea eax, [ebp - 0x4c]
push 0x46c7d0
push eax
call fcn.0043bd2a
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x413f1f
cmp dword [ebp + 8], 0
jne 0x413ef8
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.00413a39
lea eax, [ebp - 0x48]
push 0x46c698
push eax
call fcn.0043bd2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x413f1f
push 1
add esi, 0xc
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.00413cb2
lea eax, [ebp - 0x48]
push 0x46c698
push eax
call fcn.0043bd2a
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x41732e
Capabilities:
Get disk information

Disassembly:
mov eax, 0x461820
call fcn.0043b5c0
sub esp, 0x50
push esi
mov esi, ecx
lea eax, [ebp - 0x5c]
push edi
lea ecx, [esi + 4]
push eax
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, eax
call fcn.00403711
and dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
push 0
push ecx
mov ecx, eax
call fcn.00401dc1
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00401f43
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0040127e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.0040127e
cmp edi, 2
je 0x4173be
cmp edi, 5
je 0x4173be
cmp edi, 3
je 0x4173ba
cmp edi, 4
je 0x4173ba
cmp edi, 6
je 0x4173ba
mov ecx, esi
call fcn.00417197
dec ax
neg ax
sbb eax, eax
neg eax
jmp 0x4173c0
xor al, al
jmp 0x4173c0
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x419083
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
mov eax, 0x461c2c
call fcn.0043b5c0
sub esp, 0x4c
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov esi, dword [edi + 0xa8]
cmp esi, eax
je 0x41918e
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4190cc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
push edi
push 0x477e78
call fcn.004191de
pop ecx
test eax, eax
pop ecx
je 0x4190f8
cmp dword [eax + 0xc], esi
jne 0x4190f8
mov ecx, dword [eax + 0x14]
mov edx, dword [edi + 0xac]
mov dword [ebp + 0xc], edx
mov edi, ecx
lea eax, [ecx + ebx]
mov dword [ebp + 0x10], edx
jmp 0x41914b
push edi
push 0x477e70
call fcn.004191de
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x41911e
push edi
push 0x477e68
call fcn.004191de
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x41918e
mov edi, dword [edi + 0xac]
push 0x1c
mov dword [ebp + 0x10], edi
mov eax, edi
xor edx, edx
pop edi
div edi
test eax, eax
mov dword [ebp + 0xc], eax
je 0x41918e
sub esi, dword [ecx + 0xc]
mov eax, dword [ecx + 0x14]
lea ecx, [eax + esi]
mov edi, ecx
lea eax, [ecx + ebx]
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0x10], ecx
mov ecx, eax
sub ecx, ebx
cmp ecx, dword [ebp - 0x18]
jbe 0x419199
cmp dword [ebp + 8], 0
je 0x419199
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, edi
xor edx, edx
div dword [ebp - 0x3c]
xor edx, edx
mov esi, eax
mov eax, edi
div dword [ebp - 0x3c]
imul esi, dword [ebp - 0x3c]
add edx, dword [ebp + 0x10]
push edx
push esi
push 0
push 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x419192
xor eax, eax
jmp 0x4191cf
mov dword [ebp - 0x10], eax
sub eax, esi
add eax, edi
mov edx, dword [ebp + 0xc]
test edx, edx
jbe 0x4191b8
add eax, 0x10
mov ecx, dword [eax]
mov esi, dword [eax + 8]
add esi, ecx
cmp esi, dword [ebp + 0x14]
jbe 0x4191b2
add dword [ebp - 0x14], ecx
add eax, 0x1c
dec edx
jne 0x4191a3
cmp dword [ebp - 0x10], 0
je 0x4191cc
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x4191cc
push dword [ebp - 0x10]
call eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x419224
Capabilities:
Create directory

Disassembly:
mov eax, 0x461c48
call fcn.0043b5c0
sub esp, 0x3c
push ebx
push esi
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.0041a346
mov ecx, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 0x2c]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004192f3
mov eax, dword [eax + 0x10]
cmp eax, ebx
jne 0x41925b
xor esi, esi
jmp 0x419264
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov esi, eax
lea ecx, [ebp - 0x2c]
call fcn.0041a128
push 0x5c
inc esi
pop edi
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp + 8]
push esi
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.0041a9ec
cmp dword [0x467f90], eax
je 0x4192d6
lea esi, [eax + 1]
push ebx
push esi
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x20], 0x467f78
mov dword [ebp - 0x18], 0x467f70
call fcn.00419e74
mov dword [ebp - 0x2c], 0x467f84
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0041ac6c
push ebx
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.0041a128
mov dword [ebp - 0x10], edi
jmp 0x419273
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.0041a3cb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x41b5f1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x41b605
push 1
pop eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41b639
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.00437ef7
test al, al
jne 0x41b66c
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.00413d79
lea eax, [ebp - 0x4c]
push 0x46c7d0
push eax
call fcn.0043bd2a
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41b66c
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.00413a39
lea eax, [ebp - 0x48]
push 0x46c698
push eax
call fcn.0043bd2a
mov eax, dword [ebp + 8]
pop esi
leave
ret 8

Function at 0x41b674
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x41b688
push 0x26
pop eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41b6bc
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.00437ef7
test al, al
jne 0x41b6ef
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.00413d79
lea eax, [ebp - 0x4c]
push 0x46c7d0
push eax
call fcn.0043bd2a
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41b6ef
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.00413a39
lea eax, [ebp - 0x48]
push 0x46c698
push eax
call fcn.0043bd2a
mov eax, dword [ebp + 8]
pop esi
leave
ret 8
Function at 0x41b6f7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x41b70b
push 6
pop eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41b73f
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.00437ef7
test al, al
jne 0x41b772
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.00413d79
lea eax, [ebp - 0x4c]
push 0x46c7d0
push eax
call fcn.0043bd2a
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41b772
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.00413a39
lea eax, [ebp - 0x48]
push 0x46c698
push eax
call fcn.0043bd2a
mov eax, dword [ebp + 8]
pop esi
leave
ret 8
Function at 0x41fdf0
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x4627d8
call fcn.0043b5c0
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
lea eax, [ebp - 0xd]
push 0
push eax
mov dword [esi], 0x467548
mov dword [esi + 0x20], 0x467550
call fcn.00401aa5
lea eax, [ebp - 0x20]
push 0x105
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0040179e
mov edi, eax
mov ecx, dword [edi]
mov byte [ebp - 4], 2
call fcn.00401f43
push eax
push 0x104
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.004019f3
lea ecx, [ebp + 8]
call fcn.00401f43
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040127e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0x28

Function at 0x41fe89
Capabilities:
Set current directory

Disassembly:
mov eax, 0x4627ec
call fcn.0043b5c0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
cmp dword [esi + 0xc], 0
je 0x41feb0
call fcn.00401f43
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040127e
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4243e5
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x462f73
call fcn.0043b5c0
sub esp, 0x138
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
and byte [ebp - 0x144], bl
xor eax, eax
lea edi, [ebp - 0x143]
mov dword [ebp - 0x14], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x10], ebx
test byte [ebp + 0xf], 0x80
push 1
mov eax, 0x20019
pop esi
mov dword [ebp - 4], esi
je 0x424430
and byte [ebp + 0xf], 0x7f
mov eax, 0x20119
lea ecx, [ebp - 0x10]
push ecx
push eax
push ebx
push 0x4792a8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x424477
cmp dword [ebp + 0xc], esi
mov dword [ebp - 0x18], 0x104
mov eax, 0x479298
je 0x424460
mov eax, 0x479288
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x144]
push ecx
push ebx
push ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0xf]
push ebx
push eax
lea eax, [ebp - 0x144]
mov edi, 0x4680a4
mov esi, 0x46809c
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x20], esi
call fcn.00401717
push 0x4763ec
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004244f6
mov ebx, dword [ebp + 8]
push 0
push eax
mov ecx, ebx
mov dword [ebx], edi
mov dword [ebx + 0x20], esi
call fcn.00401b1a
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.0040127e
cmp dword [ebp - 0x10], 0
je 0x4244e5
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4244e5
push dword [ebp - 0x10]
call eax
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x424b1d
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
mov eax, 0x46308c
call fcn.0043b5c0
sub esp, 0x144
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 0
je 0x424b99
or dword [ebp - 0x10], 0xffffffff
and dword [ebp - 4], 0
lea eax, [ebp - 0x150]
push eax
call fcn.0040bc78
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x424b99
push ebx
mov ecx, esi
mov dword [ebp - 0x10], edi
call fcn.0040bc78
mov ecx, esi
mov ebx, eax
call fcn.0040bc78
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, esi
call fcn.0040bc78
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
test eax, eax
je 0x424b99
push edi
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x424ef2
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov dword [ebx], esi
mov dword [eax], esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, esi
je 0x424f8b
push edi
call fcn.0043cf96
push edi
push esi
push eax
mov dword [ebp + 0xc], eax
call fcn.0043c750
add esp, 0x10
push dword [ebp + 0xc]
push edi
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x424f82
lea eax, [ebp - 0x3c]
push 0x34
mov dword [ebp + 8], eax
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.0043c750
add esp, 0xc
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp + 8]
push eax
push 0x476c60
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x424f82
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebx], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
push dword [ebp + 0xc]
call fcn.0043cead
pop ecx
pop edi
pop esi
mov al, 1
pop ebx
leave
ret 0xc