joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4220e0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x120]
sub esp, 0x120
push 0xffffffffffffffff
push 0x55fef2
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5a800c]
xor eax, ebp
mov dword [ebp + 0x11c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x422124
call fcn.00422270
cmp byte [0x5aabfc], 0
jne 0x422137
mov eax, 0x80000001
jmp 0x42224c
mov eax, dword [esi]
test eax, eax
jne 0x4221a2
push 8
call fcn.0055953d
mov edi, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
push 1
call fcn.0055953d
mov dword [edi + 4], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp + 4]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x14
mov dword [ebp], 0x11c
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x422191
cmp dword [ebp + 4], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x42223b
call fcn.0042d7e0
test al, al
jne 0x4221dc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.0042dd40
test al, al
je 0x42223b
mov ecx, dword [esi]
add ecx, 4
call fcn.0042d300
call fcn.0042d7e0
test al, al
je 0x42223b
push str.Advapi32.dll
lea ecx, [ebp - 0x28]
call fcn.00404ba0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x28]
push eax
call fcn.00424480
mov ecx, eax
call fcn.00424540
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402400
test edi, edi
je 0x42223b
push str.RegOpenCurrentUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42223b
push dword [esi]
push dword [ebp + 0x128]
call eax
test eax, eax
je 0x42223b
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x42224a
mov dword [eax], 0x80000001
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x11c]
xor ecx, ebp
call fcn.0055929f
lea esp, [ebp + 0x120]
pop ebp
ret 4
Function at 0x422430
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x640]
sub esp, 0x640
push 0xffffffffffffffff
push 0x55ffa0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5a800c]
xor eax, ebp
mov dword [ebp + 0x63c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x64c]
lea ecx, [ebp]
mov ebx, dword [ebp + 0x648]
mov dword [ebp - 0x10], eax
call fcn.00402410
mov dword [ebp - 4], 0
mov eax, dword [0x5aac80]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x18], 0x5aac80
test eax, eax
je 0x4224a5
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
mov ecx, 0x5aac5c
call fcn.00402520
mov edx, eax
mov esi, dword [edx + 0x10]
test esi, esi
je 0x4224db
call fcn.00402520
lea ecx, [ebp]
cmp ecx, eax
je 0x422588
cmp dword [edx + 0x14], 8
jb 0x4224d4
mov edx, dword [edx]
push esi
push edx
jmp 0x422580
push 0x20c
lea eax, [ebp + 0x430]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp + 0x430]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x422623
xor eax, eax
push 0x412
push eax
mov word [ebp + 0x63a], ax
lea eax, [ebp + 0x1c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp + 0x1c]
push 0x208
push eax
lea eax, [ebp + 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x42256d
test eax, eax
je 0x42256d
add eax, eax
cmp eax, 0x412
jae 0x422676
xor ecx, ecx
mov word [ebp + eax + 0x1c], cx
lea ecx, [ebp + 0x1c]
call fcn.004028c0
push eax
lea eax, [ebp + 0x1c]
jmp 0x42257f
lea ecx, [ebp + 0x430]
call fcn.004028c0
push eax
lea eax, [ebp + 0x430]
push eax
lea ecx, [ebp]
call fcn.00402610
mov byte [ebp - 4], 0
mov eax, dword [0x5aac80]
test eax, eax
je 0x42259c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x10]
lea eax, [ebp]
push esi
push ebx
push eax
mov ecx, edi
mov dword [ebp + 0x18], 0
call fcn.004223c0
test al, al
je 0x4225be
mov bl, 1
jmp 0x422640
push 0x20c
lea eax, [ebp + 0x430]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp + 0x430]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x42263e
xor eax, eax
lea ecx, [ebp + 0x430]
mov word [ebp + 0x63a], ax
call fcn.004028c0
push eax
lea eax, [ebp + 0x430]
push eax
lea ecx, [ebp]
call fcn.00402610
push esi
push ebx
lea eax, [ebp]
mov ecx, edi
push eax
call fcn.004223c0
mov bl, al
jmp 0x422640
mov byte [ebp - 4], 0
mov eax, dword [0x5aac80]
test eax, eax
je 0x422637
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp + 0x18], 0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.00402400
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x63c]
xor ecx, ebp
call fcn.0055929f
lea esp, [ebp + 0x640]
pop ebp
ret 8
call fcn.00559b9e
int3
Function at 0x425700
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5606df
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [edi + 4]
push eax
lea ecx, [eax + 0x94]
call fcn.00425e40
mov esi, dword [edi + 4]
add esp, 4
sub esi, 0x94
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00402400
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00402400
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00402400
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00402400
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00402400
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00402400
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add dword [edi + 4], 0xffffff6c
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x426400
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5608cf
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00402400
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00402400
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00402400
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00402400
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00402400
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00402400
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x427850
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x560a6f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00405080
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00405080
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00405080
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00405080
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00405080
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00405080
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42a5e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x5a800c]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x42a662
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x42a662
test ecx, ecx
je 0x42a65e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x42a620
xor eax, eax
jmp 0x42a667
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x42a671
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0055929f
add esp, 0xc
ret 0xc
Function at 0x42c210
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x42c248
mov edx, dword [esp + 4]
test edx, edx
je 0x42c248
cmp dword [eax], 0xffffffff
je 0x42c248
mov eax, dword [esp + 0xc]
push 0
push eax
push dword [esp + 0x10]
mov dword [eax], 0
mov eax, dword [ecx]
push edx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42c248
mov al, 1
ret 0xc
xor al, al
ret 0xc

Function at 0x42c250
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx]
push esi
push edi
test eax, eax
je 0x42c28a
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x42c28a
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x42c28a
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push 0
push esi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42c28a
cmp edi, dword [esi]
jne 0x42c28a
pop edi
mov al, 1
pop esi
ret 0xc
pop edi
xor al, al
pop esi
ret 0xc

Function at 0x42c2d0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x5a800c]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
test eax, eax
je 0x42c333
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x42c333
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42c30e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42c333
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0055929f
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.0055929f
add esp, 8
ret 4

Function at 0x42c410
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x42c4be
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push 1
push 0
push 0
movlpd qword [esp + 0x28], xmm0
call fcn.0042c350
test al, al
je 0x42c4be
mov edi, dword [ebp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0
push edi
push dword [ebp + 8]
xorps xmm0, xmm0
mov ecx, esi
movlpd qword [esp + 0x20], xmm0
call fcn.0042c350
test al, al
je 0x42c4be
mov eax, dword [ebp + 8]
xor bl, bl
cmp dword [esp + 0x10], eax
jne 0x42c494
cmp dword [esp + 0x14], edi
jne 0x42c494
mov eax, dword [esi]
test eax, eax
jne 0x42c481
xor bl, bl
jmp 0x42c494
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x42c47d
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne bl
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
push 0
push dword [esp + 0x24]
mov ecx, esi
movlpd qword [esp + 0x1c], xmm0
push dword [esp + 0x24]
call fcn.0042c350
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42c4d0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c398
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5a800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
cmp esi, 0xffffffff
jne 0x42c507
xor al, al
jmp 0x42c569
and esi, 0xffffb1af
push esi
call fcn.004023c0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x42c522
mov al, 1
jmp 0x42c569
lea ecx, [ebp - 0x28]
call fcn.00402410
mov dword [ebp - 4], 0
mov edx, ecx
mov ecx, ebx
call fcn.0042cbb0
test al, al
je 0x42c556
push esi
lea ecx, [ebp - 0x28]
call fcn.004023c0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x42c556
mov bl, 1
jmp 0x42c558
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402400
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055929f
mov esp, ebp
pop ebp
ret

Function at 0x42c590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c398
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5a800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.004023c0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42c60d
lea ecx, [ebp - 0x28]
call fcn.00402410
mov dword [ebp - 4], 0
mov edx, ecx
mov ecx, ebx
call fcn.0042cbb0
test al, al
je 0x42c5fc
lea ecx, [ebp - 0x28]
call fcn.004023c0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402400
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055929f
mov esp, ebp
pop ebp
ret
Function at 0x42c740
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x561500
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5a800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004023c0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x42c786
mov al, 1
jmp 0x42c87a
mov ecx, esi
call fcn.004023c0
push eax
lea ecx, [ebp - 0x28]
call fcn.00404ba0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0042c590
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402400
cmp ebx, 0xffffffff
jne 0x42c7c5
xor al, al
jmp 0x42c87a
mov ecx, esi
call fcn.004023c0
push eax
lea ecx, [ebp - 0x28]
call fcn.00404ba0
mov dword [ebp - 4], 1
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.0042c4d0
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402400
test bl, bl
je 0x42c7be
mov ecx, esi
call fcn.004023c0
push eax
call edi
test eax, eax
jne 0x42c77f
lea ecx, [ebp - 0x28]
call fcn.00402410
mov dword [ebp - 4], 2
mov edx, ecx
mov ecx, esi
call fcn.0042cbb0
test al, al
je 0x42c83c
lea ecx, [ebp - 0x28]
call fcn.004023c0
push eax
call edi
test eax, eax
je 0x42c83c
mov bl, 1
jmp 0x42c869
mov ecx, esi
call fcn.004023c0
push eax
lea ecx, [ebp - 0x44]
call fcn.00404ba0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
call fcn.0042c4d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.00402400
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402400
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055929f
mov esp, ebp
pop ebp
ret

Function at 0x42c8c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x5a800c]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
lea eax, [esp + 4]
push esi
push edi
push 0x20c
push 0
push eax
mov esi, edx
mov edi, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 0
call fcn.004023c0
push eax
mov ecx, edi
call fcn.004023c0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x42c951
xor eax, eax
lea ecx, [esp + 0xc]
mov word [esp + 0x216], ax
call fcn.004028c0
push eax
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
call fcn.00402610
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0055929f
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0055929f
add esp, 0x210
ret
Function at 0x42cc70
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x5a800c]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 1
mov esi, ecx
call fcn.0055953d
mov dword [esi], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [esp + 0x14]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov dword [esp + 4], 0x11c
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x42cccc
cmp dword [esp + 8], 6
mov ecx, dword [esi]
setae dl
mov byte [ecx], dl
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
call fcn.0055929f
add esp, 0x120
ret
Function at 0x430ae0
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x808]
sub esp, 0x808
push 0xffffffffffffffff
push 0x561b80
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5a800c]
xor eax, ebp
mov dword [ebp + 0x804], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
lea eax, [ebp + 4]
push eax
push 0x3fe
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x430ba7
lea edi, [ebp + 4]
mov dword [ebp], 0
xor esi, esi
mov dword [ebp - 0x14], edi
mov dword [ebp], esi
mov dword [ebp - 4], esi
cmp ebx, 0x3fe
jbe 0x430bcc
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00559a74
add esp, 4
mov dword [ebp - 0x14], eax
mov edi, eax
mov esi, edi
mov dword [ebp], esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x430b93
cmp eax, ebx
ja 0x430b93
xor ecx, ecx
mov ebx, eax
mov dword [edi + eax*2], ecx
mov dword [ebp - 0x10], ebx
jmp 0x430bf0
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x430ba7
push edi
call fcn.00559c78
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x804]
xor ecx, ebp
call fcn.0055929f
lea esp, [ebp + 0x808]
pop ebp
ret
lea eax, [ebx + ebx]
cmp eax, 0x800
jae 0x430c63
xor ecx, ecx
mov word [ebp + eax + 4], cx
add eax, 2
cmp eax, 0x800
jae 0x430c63
mov word [ebp + eax + 4], cx
xor ecx, ecx
xor edi, edi
test ebx, ebx
je 0x430c48
mov esi, dword [ebp - 0x14]
mov ebx, 2
mov eax, dword [ebp - 0x10]
cmp word [esi + ebx - 2], 0
jne 0x430c3d
cmp ecx, edi
je 0x430c3d
lea eax, [esi + ecx*2]
push eax
lea ecx, [ebp - 0x30]
call fcn.00404ba0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.00404aa0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00402400
mov eax, dword [ebp - 0x10]
lea ecx, [edi + 1]
inc edi
add ebx, 2
cmp edi, eax
jb 0x430c03
mov esi, dword [ebp]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x430c5c
push esi
call fcn.00559c78
add esp, 4
mov al, 1
jmp 0x430ba9
call fcn.00559b9e
int3
Function at 0x433b60
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5606df
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00401f50
mov esi, dword [ebp + 8]
mov edi, eax
push esi
mov ecx, edi
mov dword [ebp - 0x10], edi
call fcn.00402430
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push ecx
lea ecx, [edi + 0x18]
call fcn.00402430
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00402430
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00402430
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00402430
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00402430
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x435880
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x5a800c]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4358e5
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4358c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4358e5
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0055929f
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.0055929f
add esp, 8
ret 4
Function at 0x435ab0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562798
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5a800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x435af9
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x435c4b
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x435c16
test eax, eax
je 0x435c16
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x435c19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x435b9b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x435b8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x435b9b
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x435ba9
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.00402430
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x435c16
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x435b54
jmp 0x435c19
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x435c42
test edx, edx
je 0x435c3e
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x435b10
mov al, 1
jmp 0x435c4d
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x435c4b
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055929f
mov esp, ebp
pop ebp
ret 0x10