joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4068ff
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 1
push edi
mov edi, eax
jne 0x40691f
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [edi + 0x14], 0xfd
jmp 0x40697c
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
je 0x406981
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
je 0x406981
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x40697c
or byte [edi + 0x14], 4
mov al, byte [edi + 0x14]
test al, 2
jne 0x406973
push dword [ebp + 8]
or al, 2
mov byte [edi + 0x14], al
call fcn.00405d72
push 8
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40697c
cmp dword [edi + 0x18], esi
je 0x40697c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], esi
jmp 0x406990
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [edi + 0x14], 0xfd
pop edi
leave
ret 8

Function at 0x406fbb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x406fd2
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x407007
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x407003
cmp edi, eax
jae 0x407007
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x406ff5
cmp edi, eax
jb 0x40700b
xor eax, eax
jmp 0x407015
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x40784e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x40786d
xor eax, eax
jmp 0x4078bd
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 8], eax
je 0x407869
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x407869
push ebx
lea ebx, [edi + 1]
push ebx
call fcn.00405961
test eax, eax
je 0x4078a9
push edi
push dword [ebp - 4]
push eax
call fcn.00437950
add esp, 0xc
mov eax, ebx
call fcn.00407781
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4078c1
Capabilities:
Get file size
Read file on windows

Disassembly:
push 8
mov eax, 0x456281
call fcn.0043ddba
mov esi, ecx
mov eax, dword [esi]
xor edi, edi
cmp dword [eax - 0xc], edi
mov dword [ebp - 0x14], edi
je 0x4079a4
mov eax, dword [0x471fb4]
mov ecx, 0x471fb4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push dword [esi]
push str._s_d._s
call fcn.004079af
add esp, 0x10
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x407999
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, edi
je 0x407990
mov esi, dword [ebp + 0xc]
push edi
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebx + 0xa]
push eax
mov dword [ebp + 8], edi
call fcn.00405961
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
mov dword [ebp - 0x14], eax
je 0x407987
cmp dword [ebp + 8], ebx
jne 0x407987
mov eax, ebx
call fcn.00407781
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405754
xor eax, eax
inc eax
jmp 0x4079a7
xor eax, eax
mov edx, esi
call fcn.004056db
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405754
mov eax, dword [ebp - 0x14]
call fcn.0043de59
ret 0xc

Function at 0x40b924
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b987
cmp dword [ebp + 0xc], 1
je 0x40b960
cmp dword [ebp + 0xc], 2
je 0x40b960
push 0xd
pop eax
jmp 0x40b987
test edi, edi
mov eax, dword [ebp - 4]
je 0x40b981
test eax, eax
je 0x40b97d
test al, 1
jne 0x40b95b
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40b981
jmp 0x40b95b
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x40bae5
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x45692e
call fcn.0043ddba
mov esi, ecx
call fcn.0040b806
push dword [esi]
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.0040bc12
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], edi
je 0x40bc04
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40bc01
lea eax, [ebp - 0x24]
mov ebx, vtable.Gdiplus::PrivateFontCollection.0
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], edi
call sub.gdiplus.dll_GdipNewPrivateFontCollection
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
push dword [ebp - 0x24]
call sub.gdiplus.dll_GdipPrivateAddFontFile
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call sub.gdiplus.dll_GdipGetFontCollectionFamilyCount
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
cmp eax, edi
jle 0x40bbee
xor ecx, ecx
push 8
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call sub.gdiplus.dll_GdipAlloc
mov dword [ebp - 0x1c], eax
test eax, eax
mov byte [ebp - 4], 2
je 0x40bbb7
mov ecx, dword [ebp - 0x14]
push 0x40b83e
push 0x40be45
push ecx
lea edi, [eax + 4]
push 8
push edi
mov dword [eax], ecx
call fcn.0043741e
mov eax, edi
jmp 0x40bbb9
xor eax, eax
test eax, eax
mov byte [ebp - 4], 1
mov dword [esi + 4], eax
je 0x40bbee
push eax
push dword [ebp - 0x14]
lea edi, [ebp - 0x18]
lea eax, [ebp - 0x28]
call fcn.0040be4f
test eax, eax
jne 0x40bbe9
mov eax, dword [ebp - 0x18]
test eax, eax
jle 0x40bbe9
mov ecx, dword [ebp - 0x14]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
jmp 0x40bbee
call fcn.0040b806
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x28], ebx
call sub.gdiplus.dll_GdipDeletePrivateFontCollection
mov dword [ebp - 0x28], vtable.Gdiplus::FontCollection.0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405754
call fcn.0043de59
ret

Function at 0x40bd78
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x46f190]
xor eax, ebp
mov dword [ebp + 0x194], eax
xor eax, eax
push 0x20e
push eax
mov dword [ebp - 0x80], eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.00438440
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x7c]
push eax
push esi
call fcn.004210a8
mov ecx, dword [ebp + 0x194]
xor ecx, ebp
mov eax, esi
call fcn.004372f9
add ebp, 0x198
leave
ret
Function at 0x4116aa
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
inc ebx
cmp eax, 0xf
push edi
mov esi, ecx
jne 0x4116d9
mov ecx, dword [ebp + 0x18]
lea eax, [esi + 0xb4]
mov dword [eax], ebx
and dword [ecx], 0
cmp dword [eax], 0
je 0x411710
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp eax, 2
jne 0x411731
push dword [esi + 0x10]
mov dword [esi + 0xb4], ebx
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x41170a
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41170a
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], 0
cmp dword [esi + 0xb4], 0
jne 0x4116d0
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040d4eb
jmp 0x4116d2
cmp eax, 0x47
jne 0x411756
push dword [ebp + 0x14]
lea edi, [esi + 0xb4]
mov eax, esi
mov dword [edi], ebx
call fcn.004117ae
mov eax, dword [ebp + 0x18]
and dword [eax], 0
cmp dword [edi], 0
jmp 0x4116ce
cmp eax, 0x18
jne 0x411710
push dword [ebp + 0x10]
mov dword [esi + 0xb4], ebx
call fcn.00408c5e
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x41178e
push dword [esi + 8]
jmp 0x411784
mov ecx, dword [eax + 0x34]
shr ecx, 3
not ecx
test bl, cl
je 0x411798
push dword [eax + 8]
call fcn.004069f7
cmp eax, edi
pop ecx
jne 0x411775
mov eax, dword [ebp + 0x10]
mov ecx, esi
call fcn.00407597
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
cmp dword [esi + 0xb4], edi
jne 0x4116d0
jmp 0x411710

Function at 0x4159bf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [edi + 0x184]
xor ebx, ebx
cmp dword [edi + 0x180], esi
jne 0x415a45
cmp esi, ebx
jne 0x4159e5
push 0x80004005
call fcn.00420ecc
cmp dword [esi + 0xc], ebx
jne 0x415a05
mov eax, dword [esi + 0x28]
cmp dword [eax - 0xc], ebx
je 0x415a05
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x415a45
mov eax, dword [edi + 0xc]
push eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push 0x4e
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
mov dword [edi + 0x184], ebx
pop ebx
leave
ret
Function at 0x418260
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x456128
call fcn.0043ddba
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.004210a8
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push eax
push str.__02d__02d__02d__03d__n
lea ecx, [ebp + 8]
call fcn.004182c6
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00405754
call fcn.0043de59
ret 4

Function at 0x41a5af
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp + 0xc]
sub edi, dword [esi + 0x18]
sub eax, dword [esi + 0x14]
mov edx, dword [esi]
push 1
xor ebx, ebx
push edi
push eax
mov ecx, esi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [edx + 0x6c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xf4]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x41a6e8
push eax
call fcn.004069f7
mov ebx, eax
test ebx, ebx
pop ecx
je 0x41a6b5
mov eax, dword [ebx + 0x10]
push 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x41a629
lea eax, [ebx + 0x14]
push eax
call fcn.0040c45a
movzx eax, word [ebp + 0xc]
movzx edi, di
shl edi, 0x10
or edi, eax
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x202
call fcn.004075ed
mov eax, dword [ebp - 0x10]
cmp dword [esi + 0xf4], eax
jne 0x41a67f
mov ecx, dword [ebx + 0x40]
xor eax, eax
cmp ecx, eax
je 0x41a671
cmp word [ecx], ax
je 0x41a671
push 1
push eax
push eax
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x41a6b5
cmp dword [ebx + 0x10], eax
je 0x41a6b5
mov dword [ebp - 4], 1
jmp 0x41a6b5
mov eax, dword [ebx]
push 1
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x41a69e
lea eax, [ebx + 0x14]
push eax
call fcn.0040c45a
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x2a3
call fcn.004075ed
mov dword [ebp - 8], 1
xor ecx, ecx
cmp dword [ebp - 4], ecx
mov dword [esi + 0xf4], ecx
je 0x41a6c6
push 0x67
jmp 0x41a6e1
cmp dword [ebp - 8], ecx
je 0x41a6e8
cmp dword [ebp - 0xc], ecx
je 0x41a6e8
mov edx, dword [ebp - 0x14]
lea eax, [esi + 0xf0]
cmp edx, dword [eax]
jne 0x41a6df
mov dword [eax], ecx
push 0x6a
mov edi, ebx
call fcn.0041a2fb
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x42132f
Capabilities:
Check if file exists
Hash data with md5

Disassembly:
push 0x510
mov eax, 0x457476
call fcn.0043de23
mov eax, dword [ebp + 8]
mov esi, ecx
test esi, esi
mov dword [ebp - 0x488], eax
jne 0x421355
xor eax, eax
call fcn.0043de6d
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42134d
lea eax, [ebp - 0x51c]
push eax
call fcn.00421688
and dword [ebp - 4], 0
push esi
lea ebx, [ebp - 0x514]
call fcn.0042204d
xor ebx, ebx
test eax, eax
jne 0x42139a
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax + 4]
push ebx
lea ecx, [ebp + ecx - 0x51c]
push 2
call fcn.00422e04
mov eax, dword [ebp - 0x51c]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x514], 6
je 0x4213c0
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x51c]
call fcn.004214a1
mov eax, ebx
jmp 0x42134f
push 0x10
lea eax, [ebp - 0x42b]
push ebx
push eax
mov byte [ebp - 0x42c], bl
call fcn.00438440
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x484], ebx
mov dword [ebp - 0x480], ebx
mov dword [ebp - 0x47c], 0x67452301
mov dword [ebp - 0x478], 0xefcdab89
mov dword [ebp - 0x474], 0x98badcfe
mov dword [ebp - 0x470], 0x10325476
mov eax, dword [eax + 4]
mov eax, dword [ebp + eax - 0x514]
add esp, 0xc
test al, 1
jne 0x42146c
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x51c]
push eax
call fcn.00421f2e
cmp dword [ebp - 0x518], ebx
jle 0x421459
push dword [ebp - 0x518]
lea eax, [ebp - 0x414]
push eax
lea esi, [ebp - 0x484]
mov byte [ebp - 0x42c], bl
call fcn.00431193
mov eax, dword [ebp - 0x51c]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x514], 1
je 0x421420
lea edi, [ebp - 0x51c]
call fcn.0042171a
lea ecx, [ebp - 0x484]
call fcn.0043121c
push 0x10
lea eax, [ebp - 0x42b]
push eax
push dword [ebp - 0x488]
call fcn.00437950
xor ebx, ebx
add esp, 0xc
inc ebx
jmp 0x4213ad

Function at 0x4214bd
Capabilities:
Move file

Disassembly:
push 0x24
mov eax, 0x4566d7
call fcn.0043ddba
xor esi, esi
cmp dword [ebp + 8], esi
je 0x42155f
cmp dword [ebp + 0xc], esi
je 0x42155f
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004210a8
push dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
mov dword [ebp - 4], esi
call fcn.004210a8
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00422e3c
lea eax, [ebp + 8]
call fcn.00422e3c
push 6
xor eax, eax
pop ecx
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
mov word [ebp - 0x20], 0x614
mov dword [ebp - 0x2c], 4
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esi, eax
mov eax, dword [ebp + 8]
neg esi
sbb esi, esi
add eax, 0xfffffff0
inc esi
call fcn.00405754
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405754
mov eax, esi
jmp 0x421561
xor eax, eax
call fcn.0043de59
ret
Function at 0x421567
Capabilities:
Copy file
Move file

Disassembly:
push 0x24
mov eax, 0x4566ab
call fcn.0043ddba
xor esi, esi
cmp dword [ebp + 8], esi
je 0x421609
cmp dword [ebp + 0xc], esi
je 0x421609
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004210a8
push dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
mov dword [ebp - 4], esi
call fcn.004210a8
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00422e3c
lea eax, [ebp + 8]
call fcn.00422e3c
push 6
xor eax, eax
pop ecx
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
mov word [ebp - 0x20], 0x614
mov dword [ebp - 0x2c], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esi, eax
mov eax, dword [ebp + 8]
neg esi
sbb esi, esi
add eax, 0xfffffff0
inc esi
call fcn.00405754
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405754
mov eax, esi
jmp 0x42160b
xor eax, eax
call fcn.0043de59
ret

Function at 0x421611
Capabilities:
Delete file

Disassembly:
push 0x20
mov eax, 0x456680
call fcn.0043ddba
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x421628
xor eax, eax
jmp 0x421682
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.004210a8
lea eax, [ebp + 8]
mov dword [ebp - 4], esi
call fcn.00422e3c
push 6
xor eax, eax
pop ecx
mov dword [ebp - 0x2c], esi
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov word [ebp - 0x1c], 0x614
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esi, eax
mov eax, dword [ebp + 8]
neg esi
sbb esi, esi
add eax, 0xfffffff0
inc esi
call fcn.00405754
mov eax, esi
call fcn.0043de59
ret
Function at 0x422152
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x45660a
call fcn.0043de23
mov edi, ecx
cmp dword [edi + 0x3c], 0
mov dword [ebp - 0x38], edi
je 0x422262
cmp byte [edi + 0x41], 0
je 0x422262
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x42218a
xor al, al
jmp 0x422264
lea eax, [ebp - 0x30]
call fcn.00421e72
and dword [ebp - 4], 0
lea eax, [edi + 0x44]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
call fcn.00421ed2
mov esi, eax
call fcn.004223d6
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x30]
call fcn.00421ed2
mov esi, eax
call fcn.004223d6
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x34]
push esi
mov esi, dword [ebp - 0x40]
add ebx, esi
push ebx
push eax
push dword [ebp - 0x3c]
call dword [edx + 0x18]
sub eax, 0
je 0x4221fa
dec eax
je 0x4221fe
dec eax
dec eax
je 0x42225e
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00407c0d
mov al, bl
jmp 0x422264
mov byte [edi + 0x41], 0
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
call fcn.00421ed2
mov esi, eax
call fcn.004223d6
mov ebx, dword [ebp - 0x34]
sub ebx, eax
je 0x42223c
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x30]
call fcn.00421ed2
mov esi, eax
call fcn.004223d6
push dword [edi + 0x4c]
push ebx
push 1
push eax
call fcn.00438e5f
add esp, 0x10
cmp ebx, eax
jne 0x4221e8
cmp byte [edi + 0x41], 0
je 0x42225e
test ebx, ebx
jne 0x42219c
push ebx
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.00421e8e
mov edi, dword [ebp - 0x38]
jmp 0x42219c
mov bl, 1
jmp 0x4221ea
mov al, 1
call fcn.0043de6d
ret

Function at 0x422ef6
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov dword [esi], eax
push ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x422f7f
push ebx
call fcn.00435667
pop ecx
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x422f70
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x463fb4
push dword [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x422f70
cmp dword [ebp - 0xc], ebx
je 0x422f70
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
mov dword [ebp - 0x14], 1
cmp dword [ebp - 4], 0
je 0x422f7f
push dword [ebp - 4]
call fcn.00438311
pop ecx
mov eax, dword [ebp - 0x14]
pop ebx
leave
ret
Function at 0x42319a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x120
mov eax, dword [0x46f190]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa8]
push edi
push eax
call fcn.00438440
add esp, 0xc
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x4231fd
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x114
call esi
cmp eax, edi
je 0x4232b3
mov eax, dword [ebp - 0x98]
dec eax
je 0x42329f
dec eax
jne 0x4232b3
mov eax, dword [ebp - 0xa4]
xor edx, edx
push 6
pop ecx
inc edx
cmp eax, ecx
jne 0x42324c
cmp dword [ebp - 0xa0], edx
jne 0x423236
xor eax, eax
cmp byte [ebp + 0x72], dl
setne al
add eax, 8
jmp 0x42329b
cmp dword [ebp - 0xa0], edi
jne 0x423284
xor eax, eax
cmp byte [ebp + 0x72], dl
setne al
lea eax, [eax + eax + 7]
jmp 0x42329b
cmp eax, 5
jne 0x423276
cmp dword [ebp - 0xa0], 2
jne 0x42325d
push eax
jmp 0x42327d
cmp dword [ebp - 0xa0], 1
jne 0x42326a
mov edi, ecx
jmp 0x4232b3
cmp dword [ebp - 0xa0], edi
jne 0x4232b3
push 3
jmp 0x42327d
cmp eax, 4
ja 0x423280
push 4
pop edi
jmp 0x4232b3
cmp eax, ecx
jb 0x4232b3
cmp dword [ebp - 0xa0], 2
jae 0x423291
cmp eax, ecx
jbe 0x4232b3
cmp byte [ebp + 0x72], dl
jne 0x4232b3
call fcn.004230df
mov edi, eax
jmp 0x4232b3
mov eax, dword [ebp - 0x9c]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov ecx, dword [ebp + 0x74]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004372f9
add ebp, 0x78
leave
ret