joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001282
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
push 4
pop esi
push esi
call fcn.100066fe
push esi
mov dword [ebp - 4], eax
call fcn.100066fe
push esi
mov ebx, eax
call fcn.100066fe
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
add esp, 0xc
push ebx
mov dword [ebp - 0xc], eax
call edi
movzx eax, ax
push eax
call fcn.1000121b
pop ecx
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push eax
call fcn.1000121b
xor eax, eax
push esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
call fcn.100066fe
add esp, 0xc
mov esi, eax
lea eax, [ebp - 8]
push eax
push str.SoftwareIntelDisplayigfxcuihkcmd_resources
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10001334
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push 0
push str.UserLangID
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x1000132b
mov dword [ebp - 0x14], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call edi
mov ecx, 0x3ff
and ax, cx
movzx eax, ax
push eax
call fcn.1000121b
push ebx
call fcn.100011df
add esp, 0xc
test eax, eax
jne 0x10001369
push dword [ebp - 4]
call fcn.100011df
pop ecx
test eax, eax
je 0x100013a8
push dword [ebp - 4]
jmp 0x1000136a
push ebx
push dword [ebp + 8]
call fcn.100082b0
pop ecx
pop ecx
test esi, esi
je 0x100013a8
push dword [ebp - 0xc]
push ebx
call fcn.100083c0
pop ecx
pop ecx
test eax, eax
je 0x10001390
mov dword [ebp - 0x10], 1
jmp 0x100013a8
push esi
push ebx
call fcn.100083c0
pop ecx
pop ecx
test eax, eax
je 0x100013a8
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jne 0x100013a8
mov dword [ebp - 0x10], eax
push ebx
call fcn.1000120e
push dword [ebp - 0xc]
call fcn.1000120e
push dword [ebp - 4]
call fcn.1000120e
push esi
call fcn.1000120e
mov eax, dword [ebp - 0x10]
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100014a9
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10015450]
xor eax, ebp
mov dword [ebp + 0x18c], eax
mov eax, dword [ebp + 0x1a0]
and dword [ebp - 0x80], 0
push eax
push dword [ebp + 0x198]
lea eax, [ebp + 0x88]
push 0x104
push eax
call sym.hccutils.DLL_GetMyRegKey
add esp, 0x10
dec eax
cmp eax, 0x102
ja 0x1000154e
lea eax, [ebp + 0x88]
push str._resources
push eax
call fcn.100082c0
pop ecx
pop ecx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x88]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x80], 0
je 0x1000154e
push dword [ebp + 0x19c]
lea eax, [ebp - 0x7c]
push 0x1001149c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
call fcn.100083a8
add ebp, 0x190
leave
ret

Function at 0x10001563
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x10015450]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1b8]
push ebx
mov ebx, dword [ebp + 0x1b0]
push esi
push edi
push eax
push dword [ebp + 0x1a4]
lea eax, [ebp + 0x94]
xor edi, edi
push 0x104
push eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x78], edi
call sym.hccutils.DLL_GetMyRegKey
push dword [ebp + 0x1b4]
mov esi, eax
push edi
push ebx
call fcn.10008450
add esp, 0x1c
dec esi
cmp esi, 0x102
ja 0x10001691
lea eax, [ebp + 0x94]
push str._resources
push eax
call fcn.100082c0
cmp dword [ebp + 0x1a8], 0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
mov edi, 0x1001149c
je 0x10001624
push dword [ebp + 0x1a8]
lea eax, [ebp - 0x70]
push edi
push eax
call esi
lea eax, [ebp + 0x94]
push 0x10011404
push eax
call fcn.100082c0
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x94]
push eax
call fcn.100082c0
add esp, 0x1c
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x94]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x74], 0
je 0x10001691
push dword [ebp + 0x1ac]
lea eax, [ebp - 0x70]
push edi
push eax
call esi
mov eax, dword [ebp + 0x1b4]
add esp, 0xc
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x7c]
push eax
push ebx
lea eax, [ebp - 0x80]
push eax
push 0
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000167b
cmp dword [ebp - 0x80], 1
jne 0x10001682
cmp eax, 0xea
jne 0x10001688
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x78], eax
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x198]
mov eax, dword [ebp - 0x78]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100083a8
add ebp, 0x19c
leave
ret
Function at 0x100016ac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000171c
lea eax, [ebp - 0x38]
push eax
push ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
cmp dword [ebp - 0x18], esi
jne 0x10001715
push edi
push dword [ebp - 0x14]
call fcn.100066fe
pop ecx
push esi
mov edi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000170d
mov esi, edi
jmp 0x10001714
push edi
call fcn.10006939
pop ecx
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x10001b0a
Capabilities:
Log keystrokes via application hook

Disassembly:
push 0
push dword [0x10016120]
push 0x10001ab9
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x100160e0], eax
mov al, 1
ret
Function at 0x100027b9
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x298]
sub esp, 0x318
mov eax, dword [0x10015450]
xor eax, ebp
mov dword [ebp + 0x294], eax
push ebx
mov ebx, dword [ebp + 0x2a0]
push esi
push edi
mov edi, dword [ebp + 0x2a4]
push edi
mov esi, 0x104
push esi
lea eax, [ebp + 0x8c]
push eax
push 0x66
push ebx
call fcn.10001e4c
push edi
push esi
lea eax, [ebp - 0x78]
push eax
push 0x68
push ebx
call fcn.10001e4c
push edi
push esi
lea eax, [ebp + 0x190]
push eax
push 0x69
push ebx
call fcn.10001e4c
add esp, 0x3c
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 0
push 3
push eax
mov dword [ebp - 0x7c], eax
call esi
mov ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.100066fe
pop ecx
push ebx
push eax
push 3
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
call esi
mov esi, dword [ebp - 0x80]
test esi, esi
je 0x10002886
push esi
call fcn.10008140
pop ecx
test eax, eax
je 0x10002886
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp + 0x8c]
push eax
push esi
call fcn.1000254e
push esi
mov dword [0x100160e4], eax
call fcn.10006939
add esp, 0x18
jmp 0x1000288d
push esi
call fcn.10006939
pop ecx
mov ecx, dword [ebp + 0x294]
mov eax, dword [0x100160e4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100083a8
add ebp, 0x298
leave
ret
Function at 0x10002c37
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10015450]
xor eax, ebp
mov dword [ebp + 0x18c], eax
mov eax, dword [ebp + 0x1a4]
and dword [ebp - 0x80], 0
push edi
mov edi, dword [ebp + 0x1a0]
push eax
push dword [ebp + 0x198]
lea eax, [ebp + 0x88]
push 0x104
push eax
call sym.hccutils.DLL_GetMyRegKey
add esp, 0x10
dec eax
cmp eax, 0x102
ja 0x10002d0d
push esi
lea eax, [ebp + 0x88]
push str._resources
push eax
call fcn.100082c0
pop ecx
pop ecx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x88]
push eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x80], 0
jne 0x10002cd1
lea eax, [ebp + 0x88]
push eax
push esi
call sym.hccutils.DLL_CreateThisKey
pop ecx
pop ecx
mov dword [ebp - 0x80], eax
test eax, eax
je 0x10002d0c
push dword [ebp + 0x19c]
lea eax, [ebp - 0x7c]
push 0x1001149c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
call fcn.10008140
add esp, 0x10
inc eax
push eax
push edi
push 1
push 0
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop edi
call fcn.100083a8
add ebp, 0x190
leave
ret
Function at 0x10002d23
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x10015450]
xor eax, ebp
mov dword [ebp + 0x3a0], eax
mov eax, dword [ebp + 0x3b4]
push ebx
mov ebx, dword [ebp + 0x3ac]
push esi
push edi
push eax
mov dword [ebp - 0x78], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x70]
push eax
push 0x1235
push ebx
call sym.hccutils.DLL_LoadSTRING
push dword [ebp + 0x3b0]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x94]
push eax
call edi
lea eax, [ebp + 0x94]
push eax
call fcn.100016ac
add esp, 0x24
mov dword [ebp - 0x80], eax
test eax, eax
jne 0x10002e53
push dword [ebp - 0x78]
and dword [ebp - 0x74], eax
push ebx
lea eax, [ebp + 0x198]
push esi
push eax
call sym.hccutils.DLL_GetMyRegKey
add esp, 0x10
dec eax
cmp eax, 0x102
ja 0x10002e53
lea eax, [ebp + 0x198]
push str._resources
push eax
call fcn.100082c0
pop ecx
pop ecx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x198]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor ebx, ebx
cmp dword [ebp - 0x74], ebx
je 0x10002e53
push dword [ebp + 0x3b0]
lea eax, [ebp + 0x29c]
push 0x1001149c
push eax
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push ebx
lea eax, [ebp - 0x78]
push eax
push ebx
lea eax, [ebp + 0x29c]
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], ebx
call esi
cmp dword [ebp - 0x78], 3
jne 0x10002e4a
push dword [ebp - 0x7c]
call fcn.100066fe
pop ecx
lea ecx, [ebp - 0x7c]
push ecx
push eax
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x78]
push eax
push ebx
lea eax, [ebp + 0x29c]
push eax
push dword [ebp - 0x74]
call esi
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x3a0]
mov eax, dword [ebp - 0x80]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100083a8
add ebp, 0x3a4
leave
ret

Function at 0x100037c1
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x1000380f
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x10003820
push 0xd
pop eax
jmp 0x1000384a
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x10003823
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x10003d62
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x10015450]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.100032d1
mov ebx, eax
cmp ebx, esi
je 0x10003dd2
lea ecx, [ebp - 0x70]
call fcn.100032b6
mov eax, ebx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100083a8
add ebp, 0x9c
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x10003dea
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x70]
call fcn.10003d62
cmp eax, esi
jne 0x10003e1c
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call ebx
test eax, eax
je 0x10003dda
lea ecx, [ebp - 0x70]
call fcn.100032b6
push dword [ebp - 0x78]
mov ecx, edi
call fcn.1000325b
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.100032b6
mov eax, esi
jmp 0x10003db8
Function at 0x100083a8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10015450]
jne 0x100083b2
repz ret
jmp fcn.1000a285

Function at 0x1000ee97
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000b292
and dword [ebp - 4], 0
cmp dword [0x10016bd8], 0
mov ebx, eax
jne 0x1000ef48
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000eff9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000eff9
push eax
call fcn.1000b220
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10016bd8], eax
call esi
push eax
call fcn.1000b220
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10016bdc], eax
call esi
push eax
call fcn.1000b220
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10016be0], eax
call esi
push eax
call fcn.1000b220
pop ecx
mov dword [0x10016be8], eax
test eax, eax
je 0x1000ef48
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000b220
pop ecx
mov dword [0x10016be4], eax
mov eax, dword [0x10016be4]
cmp eax, ebx
je 0x1000efa0
cmp dword [0x10016be8], ebx
je 0x1000efa0
push eax
call fcn.1000b29b
push dword [0x10016be8]
mov esi, eax
call fcn.1000b29b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000efa0
test edi, edi
je 0x1000efa0
call esi
test eax, eax
je 0x1000ef97
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000ef97
test byte [ebp - 0xc], 1
jne 0x1000efa0
or dword [ebp + 0x10], 0x200000
jmp 0x1000efd9
mov eax, dword [0x10016bdc]
cmp eax, ebx
je 0x1000efd9
push eax
call fcn.1000b29b
pop ecx
test eax, eax
je 0x1000efd9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000efd9
mov eax, dword [0x10016be0]
cmp eax, ebx
je 0x1000efd9
push eax
call fcn.1000b29b
pop ecx
test eax, eax
je 0x1000efd9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10016bd8]
call fcn.1000b29b
pop ecx
test eax, eax
je 0x1000eff9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000effb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401b90
Capabilities:
Accept command line arguments

Disassembly:
push ecx
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [esp]
push eax
push ecx
call fcn.00401bc0
add esp, 0xc
ret 0x10
Function at 0x403993
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov ecx, dword ds:[eax + 0x3c]
mov edx, eax
push dword ds:[ecx + edx + 0x78]
push edx
pop edx
pop eax
add eax, edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x4039c1
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
cmp edx, dword [ecx + 0x18]
jae 0x403a74
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
add ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov cl, byte [eax]
mov byte [ebp - 0x19], cl
mov edx, dword [ebp - 0x14]
cmp cl, byte [edx]
jne 0x403a2e
cmp byte [ebp - 0x19], 0
je 0x403a25
mov eax, dword [ebp - 0x18]
mov cl, byte [eax + 1]
mov byte [ebp - 0x1a], cl
mov edx, dword [ebp - 0x14]
cmp cl, byte [edx + 1]
jne 0x403a2e
add dword [ebp - 0x18], 2
add dword [ebp - 0x14], 2
cmp byte [ebp - 0x1a], 0
jne 0x4039f1
mov dword [ebp - 0x20], 0
jmp 0x403a36
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
jne 0x403a6f
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dx, word [eax + ecx*2]
mov word [ebp - 0x10], dx
mov eax, dword [ebp - 4]
mov ecx, dword ds:[eax + 0x1c]
add ecx, dword [ebp + 8]
movzx edx, word [ebp - 0x10]
mov eax, dword ds:[ecx + edx*4]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
jmp 0x4039b8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x404ffe
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
cmp dword [0x42e734], 0
jle 0x40501e
mov eax, dword [0x42e734]
jmp 0x40503a
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov dword [0x42e734], eax
mov eax, dword [0x42e734]
jmp 0x40503a
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4078f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40791b
xor eax, eax
jmp 0x407936
test byte [ebp - 4], 0x10
je 0x40792f
mov eax, 1
jmp 0x407931
xor eax, eax
jmp 0x407936
pop edi
pop esi
pop ebx
leave
ret
Function at 0x421970
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
mov eax, 0
jne 0x42198a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42199d
push eax
call fcn.00427fd0
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x4223e0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x432bd8], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x4223fe
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x432bd4], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x432bd0], bl
jne 0x422458
cmp dword [0x1791fb8], 0
je 0x422446
mov edi, dword [0x1791fb4]
sub edi, 4
cmp edi, dword [0x1791fb8]
jb 0x422446
mov eax, dword [edi]
test eax, eax
je 0x42243b
call eax
sub edi, 4
cmp edi, dword [0x1791fb8]
jae 0x422433
push 0x42e030
push 0x42e028
call fcn.00422490
add esp, 8
push 0x42e038
push 0x42e034
call fcn.00422490
add esp, 8
test ebx, ebx
jne 0x42247f
mov dword [0x432bd8], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret

Function at 0x4224b0
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov eax, 0
jne 0x4224cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4224df
push eax
call fcn.00427fd0
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x422c00
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
mov eax, 0
jne 0x422c1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x422c32
push eax
call fcn.00427fd0
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x423520
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x433088
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x423547
add eax, 8
inc ecx
cmp eax, 0x433118
jb 0x423538
cmp dword [ecx*8 + 0x433088], edx
lea ebx, [ecx*8]
jne 0x42370b
cmp dword [0x432b7c], 1
je 0x4236c7
cmp dword [0x432b7c], 0
jne 0x42357e
cmp dword [0x432b80], 1
je 0x4236c7
cmp edx, 0xfc
je 0x42370b
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x4235bb
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x4235ff
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x42d3a0
push ebp
call fcn.004217b0
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x42d380
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x43308c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.00429480
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
cmp dword [0x1790ea0], 0
je 0x4236dd
mov eax, dword [0x1790ea0]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x4236e7
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x43308c]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x423b00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x423b25
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00427fd0
add esp, 4
mov eax, 0xffffffff
ret
test al, 1
je 0x423b4a
test byte [esp + 8], 2
je 0x423b4a
mov dword [0x432b90], 0xd
mov dword [0x432b94], 5
mov eax, 0xffffffff
ret
xor eax, eax
ret