joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412260
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov word [rbp + 0x36], dx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
nop
lea rcx, [0x008eec90]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
cmp word [0x008eecb8], ax
jne 0x4122cb
mov rcx, qword [rbp + 0x28]
lea rdx, [0x008eecba]
mov r8d, 0x55
call fcn.0040f770
lea rcx, [0x008eec90]
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x4123d7
lea rcx, [0x008eec90]
call sub.kernel32.dll_LeaveCriticalSection
mov rcx, qword [rbp + 0x28]
call fcn.0040e060
movzx rcx, word [rbp + 0x36]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x412390
cmp byte [0x008eec88], 0
je 0x412324
mov rcx, rbp
lea rdx, [rbp + 0x48]
movzx r8, word [rbp + 0x36]
call fcn.004120f0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x48]
call fcn.0040e6b0
jmp 0x412390
mov rcx, rbp
lea rdx, [rbp + 0x40]
movzx r8, word [rbp + 0x36]
call fcn.00411e20
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040e6b0
call sub.kernel32.dll_GetSystemDefaultUILanguage
movzx rcx, word [rbp + 0x36]
cmp cx, ax
mov word [rbp + 0x36], cx
je 0x412390
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
je 0x41236f
mov rcx, qword [rbp + 0x28]
lea rdx, [0x00412424]
call fcn.0040f9e0
call sub.kernel32.dll_GetSystemDefaultUILanguage
mov rcx, rbp
lea rdx, [rbp + 0x38]
mov r8d, eax
call fcn.00411e20
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.0040f9e0
lea rcx, [0x008eec90]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
mov word [0x008eecb8], ax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
call fcn.0040f670
lea rcx, [0x008eecba]
mov rdx, rax
mov r8d, 0xaa
call sub.kernel32.dll_lstrcpynW
lea rcx, [0x008eec90]
call sub.kernel32.dll_LeaveCriticalSection
nop
lea rcx, [rbp + 0x38]
mov edx, 3
call fcn.0040e140
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x412de0
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x70], r8
mov rcx, qword [rbp + 0x70]
call fcn.0040e1f0
nop
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx ecx, ax
mov edx, 3
lea r8, [rbp + 0x48]
mov r9d, 4
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040f770
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x38]
call fcn.0040fad0
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.00412c00
test al, al
jne 0x412eae
mov word [rbp + 0x4c], 0
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040f770
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x30]
call fcn.0040fad0
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.00412c00
test al, al
jne 0x412eae
mov rcx, qword [rbp + 0x20]
call fcn.0040e060
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040e140
lea rcx, [rbp + 0x70]
call fcn.0040e060
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x412f20
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.0040e1f0
mov rcx, qword [rbp + 0x90]
call fcn.0040e1f0
nop
mov rcx, qword [rbp + 0x28]
call fcn.0040e060
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
call fcn.0040e730
xor rax, rax
cmp qword [rbp + 0x90], 0
je 0x412fc3
mov rax, qword [rbp + 0x90]
mov eax, dword [rax - 4]
cmp eax, 1
jl 0x412ffd
mov rcx, qword [rbp + 0x90]
movsxd rdx, eax
cmp word [rcx + rdx*2 - 2], 0x2e
jne 0x412ff6
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
mov r8d, 1
movsxd r9, eax
call fcn.0040fce0
jmp 0x412ffd
sub eax, 1
test eax, eax
jne 0x412fc8
nop
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
call fcn.00412af0
cmp qword [rbp + 0x68], 0
je 0x41303b
mov rcx, rbp
lea rdx, [rbp + 0x58]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x68]
call fcn.00412ca0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x58]
call fcn.0040e6b0
jmp 0x4130d7
call sub.kernel32.dll_GetUserDefaultUILanguage
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.00412260
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x48]
call fcn.00412ca0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
call fcn.0040e6b0
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x4130b0
cmp byte [0x008eec88], 0
jne 0x4130b0
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.00412260
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x38]
call fcn.00412ca0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040e6b0
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x4130d7
mov rcx, rbp
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x60]
call fcn.00412de0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.0040e6b0
nop
lea rcx, [rbp + 0x30]
mov edx, 8
call fcn.0040e140
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.0040e140
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x413e10
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x413e30
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call sub.kernel32.dll_GetVersion
mov ecx, eax
and ecx, 0xff
and eax, 0xff00
shr eax, 8
cmp ecx, 5
jne 0x413e54
cmp eax, 1
jae 0x413e59
cmp ecx, 5
jbe 0x413e65
mov dword [0x008ea9b0], 0x7f
jmp 0x413e6f
mov dword [0x008ea9b0], 0x409
add rsp, 0x28
ret
Function at 0x415610
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.00415600
mov ebx, eax
test ebx, ebx
je 0x41565b
cmp dword [0x0088f730], 0xffffffff
jne 0x415634
mov ecx, 0xe2
call fcn.0040dd60
mov ecx, ebx
call fcn.004155e0
test rax, rax
jne 0x41564d
mov ecx, 0xe2
call fcn.0040dd60
jmp 0x41565b
mov ecx, dword [0x0088f730]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x415670
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x008eed64], 0
je 0x4156ab
mov ecx, dword [0x0088f730]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x4156bf
call fcn.00415610
mov ecx, dword [0x0088f730]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x4156bf
mov rax, qword [0x008eed98]
jmp 0x4156bf
mov rax, qword gs:[0x58]
movsxd rcx, dword [0x0088f730]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x430b60
Capabilities:
Get disk information

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
mov rbp, rsp
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], r8
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
nop
mov ecx, 0x104
lea rdx, [rbp + 0x254]
call sub.kernel32.dll_GetLogicalDriveStringsW
mov esi, eax
test esi, esi
jle 0x430c82
lea rbx, [rbp + 0x254]
mov word [rbx + 4], 0
mov rcx, rbx
lea rdx, [rbp + 0x48]
mov r8d, 0x104
call sub.kernel32.dll_QueryDosDeviceW
mov esi, eax
test esi, esi
jle 0x430c68
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0x48]
mov r8d, 0x106
call fcn.0040f770
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x28]
mov r8d, 1
call fcn.0040ff70
test eax, eax
jle 0x430c68
xor rsi, rsi
cmp qword [rbp + 0x40], 0
je 0x430c12
mov rax, qword [rbp + 0x40]
mov esi, dword [rax - 4]
xor rdi, rdi
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x430c25
mov rax, qword [rbp + 0x28]
mov edi, dword [rax - 4]
lea rcx, [rbp + 0x38]
mov rdx, rbx
call fcn.0040f710
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
mov r8d, esi
add r8d, 1
movsxd r8, r8d
mov r9d, edi
sub r9d, esi
movsxd r9, r9d
call fcn.0040fce0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
call fcn.0040fad0
jmp 0x430c81
add rbx, 2
cmp word [rbx], 0
jne 0x430c64
add rbx, 4
test rbx, rbx
je 0x430c81
cmp word [rbx], 0
jne 0x430bb2
nop
nop
lea rcx, [rbp + 0x30]
mov edx, 3
call fcn.0040e140
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x468]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x430e20
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbp
sub rsp, 0x2a0
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0x2b0], rcx
mov qword [rbp + 0x2b8], rdx
mov qword [rbp + 0x2c0], r8
mov dword [rbp + 0x2c8], r9d
nop
mov byte [rbp + 0x28f], 0
mov rcx, qword [rbp + 0x2c0]
call fcn.0040e060
mov dword [rbp + 0x288], 0
mov rcx, qword [rbp + 0x2b8]
lea rdx, [rbp + 0x288]
call sub.kernel32.dll_GetFileSize
mov dword [rbp + 0x284], eax
cmp dword [rbp + 0x284], 0
jne 0x430f38
cmp dword [rbp + 0x288], 0
jne 0x430f38
mov ecx, 6
xor rdx, rdx
call fcn.0043f6e0
test al, al
je 0x430f38
mov rcx, qword [rbp + 0x2b8]
lea rdx, [rbp + 0x78]
mov r8d, 0x104
mov r9d, 2
call sub.kernel32.dll_GetFinalPathNameByHandleW
test eax, eax
jbe 0x430f38
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x78]
mov r8d, 0x106
call fcn.0040f770
mov rcx, rbp
lea rdx, [rbp + 0x60]
mov r8, qword [rbp + 0x58]
call fcn.00430b60
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x60]
call fcn.0040e6b0
mov byte [rbp + 0x28f], 1
jmp 0x4310a3
cmp dword [rbp + 0x284], 0
jne 0x430f4e
cmp dword [rbp + 0x288], 0
je 0x43103c
mov rcx, qword [rbp + 0x2b8]
xor rdx, rdx
mov r8d, 2
xor r9, r9
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x28], 0
call sub.kernel32.dll_CreateFileMappingW
mov qword [rbp + 0x290], rax
cmp qword [rbp + 0x290], 0x3ee
je 0x43103c
nop
mov rcx, qword [rbp + 0x290]
mov edx, 4
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 1
call sub.kernel32.dll_MapViewOfFile
mov qword [rbp + 0x298], rax
cmp qword [rbp + 0x298], 0
je 0x43102f
nop
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, qword [rbp + 0x298]
lea r8, [rbp + 0x78]
mov r9d, 0x104
call fcn.0041de60
test eax, eax
jbe 0x431022
lea rcx, [rbp + 0x48]
lea rdx, [rbp + 0x78]
mov r8d, 0x106
call fcn.0040f770
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x48]
call fcn.00430b60
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x50]
call fcn.0040e6b0
mov byte [rbp + 0x28f], 1
nop
mov rcx, qword [rbp + 0x298]
call sub.kernel32.dll_UnmapViewOfFile
nop
mov rcx, qword [rbp + 0x290]
call sub.kernel32.dll_CloseHandle_1
cmp byte [rbp + 0x28f], 0
jne 0x4310a2
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x2b8]
call fcn.00430ce0
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x40]
call fcn.0040e6b0
mov rax, qword [rbp + 0x2c0]
cmp qword [rax], 0
je 0x4310a2
mov rcx, rbp
lea rdx, [rbp + 0x38]
mov rax, qword [rbp + 0x2c0]
mov r8, qword [rax]
call fcn.00430b60
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x38]
call fcn.0040e6b0
mov byte [rbp + 0x28f], 1
nop
lea rcx, [rbp + 0x38]
mov edx, 6
call fcn.0040e140
movzx rax, byte [rbp + 0x28f]
lea rsp, [rbp + 0x2a0]
pop rbp
ret
Function at 0x431160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
mov byte [rbp + 0x67], 0
mov ecx, 6
xor rdx, rdx
call fcn.0043f6e0
test al, al
je 0x431277
mov rcx, qword [rbp + 0x80]
xor rdx, rdx
call fcn.00433820
test al, al
je 0x431277
mov rcx, qword [rbp + 0x80]
call fcn.004333f0
test al, 0x20
je 0x431277
mov rcx, qword [rbp + 0x80]
call fcn.0040f670
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x5c], eax
cmp dword [rbp + 0x5c], 0xffffffff
je 0x431277
mov eax, dword [rbp + 0x5c]
test eax, 0x400
je 0x431277
mov eax, dword [rbp + 0x5c]
test eax, 0x10
je 0x431204
mov dword [rbp + 0x60], 0x2000000
jmp 0x43120b
mov dword [rbp + 0x60], 0
mov rcx, qword [rbp + 0x80]
call fcn.0040f670
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov eax, dword [rbp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0xffffffffffffffff
je 0x431277
nop
mov rcx, rbp
mov rdx, qword [rbp + 0x68]
mov r8, qword [rbp + 0x88]
mov r9d, dword [rbp + 0x60]
call fcn.00430e20
mov byte [rbp + 0x67], al
nop
mov rcx, qword [rbp + 0x68]
call sub.kernel32.dll_CloseHandle_1
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x4333f0
Capabilities:
Get disk information

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x68], 0
nop
lea rcx, [rbp + 0x70]
mov rdx, qword [0x00433368]
mov r8d, 1
mov r9d, 0x104
call fcn.00411350
lea rcx, [rbp + 0x68]
mov rdx, qword [0x004333a8]
mov r8d, 1
mov r9d, 0x104
call fcn.00411350
movzx rax, byte [0x0043369c]
mov byte [rbp + 0x47], al
mov rcx, qword [rbp + 0x48]
mov dl, 1
call fcn.00433910
test al, al
jne 0x433494
mov rcx, qword [rbp + 0x48]
mov dl, 1
call fcn.00433820
test al, al
je 0x4335ac
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x48]
call fcn.00433e90
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x58]
call fcn.0043fd40
mov rcx, qword [rbp + 0x88]
call fcn.0040f670
mov rcx, rax
mov rdx, qword [rbp + 0x70]
mov r8d, 0x104
lea r9, [rbp + 0x84]
lea rax, [rbp + 0x7c]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x104
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x4335a7
mov eax, dword [rbp + 0x80]
test eax, 1
je 0x43351e
movzx rax, byte [rbp + 0x47]
or al, 1
mov byte [rbp + 0x47], al
mov eax, dword [rbp + 0x80]
test eax, 2
je 0x433537
movzx rax, byte [rbp + 0x47]
or al, 2
mov byte [rbp + 0x47], al
mov eax, dword [rbp + 0x80]
test eax, 0x80
je 0x433550
movzx rax, byte [rbp + 0x47]
or al, 0x20
mov byte [rbp + 0x47], al
mov rcx, qword [rbp + 0x88]
call fcn.0040f670
mov rcx, rax
call sub.kernel32.dll_GetDriveTypeW
sub eax, 2
test eax, eax
je 0x433580
sub eax, 1
test eax, eax
je 0x43358d
sub eax, 1
test eax, eax
je 0x43359a
sub eax, 1
test eax, eax
jne 0x4335d7
movzx rax, byte [rbp + 0x47]
or al, 0x10
mov byte [rbp + 0x47], al
jmp 0x4335d7
movzx rax, byte [rbp + 0x47]
or al, 4
mov byte [rbp + 0x47], al
jmp 0x4335d7
movzx rax, byte [rbp + 0x47]
or al, 8
mov byte [rbp + 0x47], al
jmp 0x4335d7
call fcn.00440860
lea rcx, [rbp + 0x50]
mov rdx, qword [0x008e9910]
call fcn.00413d20
mov rcx, qword [0x00429320]
mov dl, 1
mov r8, qword [rbp + 0x50]
call fcn.0043db50
mov rcx, rax
call fcn.0040d210
nop
lea rcx, [rbp + 0x50]
mov edx, 2
call fcn.0040e140
lea rcx, [rbp + 0x68]
mov rdx, qword [0x004333a8]
call fcn.00411530
lea rcx, [rbp + 0x70]
mov rdx, qword [0x00433368]
call fcn.00411530
lea rcx, [rbp + 0x88]
call fcn.0040e060
movzx rax, byte [rbp + 0x47]
lea rsp, [rbp + 0x90]
pop rbp
ret
Function at 0x433820
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x40
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rcx, rbx
call fcn.0040f670
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4338d2
mov ecx, eax
test ecx, 0x400
je 0x4338c7
test sil, sil
jne 0x43385f
mov al, 1
jmp 0x4338fc
test eax, 0x10
je 0x43386f
xor rax, rax
jmp 0x4338fc
mov rcx, rbx
call fcn.0040f670
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x4338ba
mov rcx, rax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x4338fc
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x20
sete al
jmp 0x4338fc
test eax, 0x10
sete al
jmp 0x4338fc
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x4338f5
cmp eax, 3
je 0x4338f5
cmp eax, 0x7b
je 0x4338f5
mov rcx, rbp
mov rdx, rbx
call fcn.004337d0
test al, al
jne 0x4338fa
xor rax, rax
jmp 0x4338fc
mov al, 1
lea rsp, [rbp + 0x40]
pop rbx
pop rsi
pop rbp
ret

Function at 0x433910
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov esi, edx
xor rdi, rdi
mov rcx, rbx
call fcn.0040f670
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov r13d, eax
cmp r13d, 0xffffffff
je 0x433a19
mov eax, r13d
test eax, 0x400
jne 0x43395a
test r13d, 0x10
setne dil
jmp 0x433a3f
test sil, sil
je 0x4339ba
mov rcx, rbx
call fcn.0040f670
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x433a3f
mov rcx, rax
call sub.kernel32.dll_CloseHandle_1
test r13d, 0x10
setne dil
jmp 0x433a3f
test r13d, 0x10
je 0x4339c8
mov dil, 1
jmp 0x433a3f
mov rcx, rbx
call fcn.0040f670
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x433a14
mov rcx, rax
call sub.kernel32.dll_CloseHandle_1
xor rdi, rdi
jmp 0x433a3f
mov dil, 1
jmp 0x433a3f
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x433a37
cmp eax, 3
je 0x433a37
cmp eax, 0x7b
je 0x433a37
cmp eax, 0x35
je 0x433a37
cmp eax, 0x15
jne 0x433a3c
xor rdi, rdi
jmp 0x433a3f
mov dil, 1
mov eax, edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x433bd0
Capabilities:
Get file attributes

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov byte [rbp + 0x2f], dl
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x48], 0
nop
mov rcx, qword [rbp + 0x20]
call fcn.0040f670
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x28], eax
mov eax, dword [rbp + 0x28]
test eax, 0x400
je 0x433c83
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x433c83
or eax, 0xffffffff
mov dword [rbp + 0x28], eax
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x48]
call fcn.00431160
test al, al
je 0x433c83
mov rcx, qword [rbp + 0x48]
call fcn.00434130
test al, al
je 0x433c6f
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x20]
call fcn.00433e30
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.0043fd40
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x48]
call fcn.0040fad0
mov rcx, qword [rbp + 0x48]
call fcn.0040f670
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x28], eax
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040e140
lea rcx, [rbp + 0x48]
call fcn.0040e060
mov eax, dword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x4341c0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
call fcn.0040f670
mov rcx, rax
xor rdx, rdx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x43c620
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov ebx, r8d
lea r8, [rbp + 0x2c]
mov r9d, 2
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x43c647
movzx rax, word [rbp + 0x2c]
jmp 0x43c649
mov eax, ebx
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret
Function at 0x43d910
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.0043d6b0
mov ebx, eax
mov rax, qword [0x008e9588]
cmp byte [rax], 0
je 0x43da48
mov rcx, qword [0x008e87c8]
call fcn.0040a270
call fcn.00408740
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x0043d8d0]
mov r8d, 1
movsxd r9, esi
call fcn.00411350
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
lea rdx, [0x0043dae8]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
jmp 0x43da8e
mov rcx, qword [0x008eed68]
call fcn.004118c0
mov rcx, rax
mov rax, qword [0x008e85a8]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW_1
xor rcx, rcx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x0043d8d0]
call fcn.00411530
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret

Function at 0x43f700
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x70], rcx
nop
mov dword [rbp + 0x54], 0xffffffff
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x70]
call fcn.0040e730
lea rcx, [rbp + 0x48]
call fcn.0040e970
mov rcx, qword [rbp + 0x48]
call fcn.0040f670
mov rcx, rax
lea rdx, [rbp + 0x40]
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x43f7b1
mov ecx, dword [rbp + 0x44]
call fcn.00408400
mov qword [rbp + 0x58], rax
nop
mov rcx, qword [rbp + 0x48]
call fcn.0040f670
mov rcx, rax
mov edx, dword [rbp + 0x40]
mov r8d, dword [rbp + 0x44]
mov r9, qword [rbp + 0x58]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x43f7a7
mov rcx, qword [rbp + 0x58]
lea rdx, [0x0043f824]
lea r8, [rbp + 0x38]
lea r9, [rbp + 0x34]
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x43f7a7
mov rax, qword [rbp + 0x38]
mov eax, dword [rax + 8]
mov dword [rbp + 0x54], eax
nop
mov rcx, qword [rbp + 0x58]
call fcn.00408430
nop
lea rcx, [rbp + 0x48]
call fcn.0040e060
mov eax, dword [rbp + 0x54]
lea rsp, [rbp + 0x60]
pop rbp
ret