joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100021fe
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
cmp dword [0x10008160], 0
je 0x10002229
push 0x104
lea eax, [ebp - 0x228]
push eax
push dword [0x10008160]
call sub.KERNEL32.dll_GetModuleFileNameA
jmp 0x1000228b
push 0x104
lea eax, [ebp - 0x228]
push eax
call fcn.100034f3
push dword [0x10008164]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x124]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x104
lea eax, [ebp - 0x228]
push eax
call sub.ntdll.dll_RtlZeroMemory
push 0x104
lea eax, [ebp - 0x228]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x228]
push eax
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp - 0x228]
push eax
call sub.KERNEL32.dll_DeleteFileA
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x104]
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_GetTempFileNameA
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_DeleteFileA
lea eax, [ebp - 0x104]
push eax
push 0x20
lea eax, [ebp - 0x124]
push eax
call fcn.10001e13
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.10002073
push 4
push 0
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x228]
push eax
call sub.KERNEL32.dll_MoveFileExA
leave
ret
Function at 0x1000314d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ecx
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
or ecx, ecx
je 0x10003167
lodsb al, byte [esi]
xor al, byte [ebp + 0x14]
stosb byte es:[edi], al
loop 0x10003160
pop ecx
pop esi
pop edi
leave
ret 0x10

Function at 0x10003d61
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
push 0xa
lea eax, [ebp - 0x12e]
push eax
call fcn.100038bd
lea eax, [ebp - 0x12e]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0xa
lea eax, [ebp - 0x12e]
push eax
call sub.ntdll.dll_RtlZeroMemory
push dword [ebp + 8]
push 0x10007234
lea eax, [ebp - 0x124]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 8
lea eax, [ebp - 0x136]
push eax
call fcn.100038f5
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x136]
push eax
push 0x10008aea
call sub.KERNEL32.dll_WritePrivateProfileStringA
push 8
lea eax, [ebp - 0x136]
push eax
call sub.ntdll.dll_RtlZeroMemory
leave
ret 4

Function at 0x10003fac
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
push 0xa
lea eax, [ebp - 0x10e]
push eax
call fcn.100038bd
lea eax, [ebp - 0x10e]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0xa
lea eax, [ebp - 0x10e]
push eax
call sub.ntdll.dll_RtlZeroMemory
push 7
lea eax, [ebp - 0x115]
push eax
call fcn.10003929
lea eax, [ebp - 0x104]
push eax
push 0
lea eax, [ebp - 0x115]
push eax
push 0x10008aea
call sub.KERNEL32.dll_GetPrivateProfileIntA
push 7
lea eax, [ebp - 0x115]
push eax
call sub.ntdll.dll_RtlZeroMemory
leave
ret

Function at 0x1000402d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
push 0xa
lea eax, [ebp - 0x12e]
push eax
call fcn.100038bd
lea eax, [ebp - 0x12e]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0xa
lea eax, [ebp - 0x12e]
push eax
call sub.ntdll.dll_RtlZeroMemory
push dword [ebp + 8]
push 0x10007234
lea eax, [ebp - 0x124]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 7
lea eax, [ebp - 0x135]
push eax
call fcn.10003929
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x135]
push eax
push 0x10008aea
call sub.KERNEL32.dll_WritePrivateProfileStringA
push 7
lea eax, [ebp - 0x135]
push eax
call sub.ntdll.dll_RtlZeroMemory
leave
ret 4
Function at 0x100049a4
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
push 0xa
lea eax, [ebp - 0x10e]
push eax
call fcn.100038bd
lea eax, [ebp - 0x10e]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0xa
lea eax, [ebp - 0x10e]
push eax
call sub.ntdll.dll_RtlZeroMemory
push 8
lea eax, [ebp - 0x116]
push eax
call fcn.100038f5
lea eax, [ebp - 0x104]
push eax
push 0
lea eax, [ebp - 0x116]
push eax
push 0x10008aea
call sub.KERNEL32.dll_GetPrivateProfileIntA
push 8
lea eax, [ebp - 0x116]
push eax
call sub.ntdll.dll_RtlZeroMemory
leave
ret

Function at 0x10004f51
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push ecx
push esi
push edx
and dword [ebp - 4], 0
push 0
push 0
push 0x10005094
push 0x100019cc
push dword fs:[0]
mov dword fs:[0], esp
push dword [ebp + 8]
call fcn.10004ea5
or eax, eax
jne 0x10004f8c
jmp 0x10005094
push dword [ebp + 8]
call fcn.10004f33
or eax, eax
jne 0x10004f9d
jmp 0x10005094
mov edi, eax
push 0x40
push 0x1000
push dword [edi + 0x50]
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
jne 0x10004fb9
jmp 0x10005094
mov dword [ebp - 8], eax
push edi
push dword [edi + 0x50]
push dword [ebp - 8]
call sub.ntdll.dll_RtlZeroMemory
pop edi
movzx eax, word [edi + 0x14]
add eax, 0x14
add eax, 4
add eax, edi
sub eax, dword [ebp + 8]
movzx ecx, word [edi + 6]
push ecx
add eax, 0x28
loop 0x10004fdd
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call sub.ntdll.dll_memcpy
add esp, 0xc
pop ecx
mov ebx, edi
add ebx, 4
add ebx, 0x14
movzx eax, word [edi + 0x14]
add ebx, eax
push ecx
mov edx, dword [ebx + 0x10]
mov esi, dword [ebx + 0x14]
add esi, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
push edx
push esi
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
pop ecx
add esi, 0x28
add ebx, 0x28
loop 0x10005000
push dword [ebp - 8]
call fcn.10004f33
or eax, eax
jne 0x10005032
jmp 0x10005094
mov edi, eax
mov esi, dword [edi + 0xa0]
or esi, esi
je 0x1000508e
add esi, dword [ebp - 8]
jmp 0x10005089
mov ebx, esi
add ebx, 8
mov edx, esi
add edx, dword [esi + 4]
jmp 0x10005082
mov ax, word [ebx]
mov cx, ax
and ax, 0xf000
cmp ax, 0x3000
jne 0x10005081
and cx, 0xfff
movzx ecx, cx
add ecx, dword [esi]
add ecx, dword [ebp - 8]
mov eax, dword [ecx]
cmp dword [ebp + 0xc], 0
je 0x10005079
add eax, dword [ebp + 0xc]
jmp 0x1000507c
add eax, dword [ebp - 8]
sub eax, dword [edi + 0x34]
mov dword [ecx], eax
inc ebx
cmp ebx, edx
jb 0x1000504f
add esi, dword [esi + 4]
cmp dword [esi], 0
jne 0x10005043
push dword [ebp - 8]
pop dword [ebp - 4]
cmp dword [ebp - 4], 0
jne 0x100050af
cmp dword [ebp - 8], 0
je 0x100050af
push 0x8000
push 0
push dword [ebp - 8]
call sub.KERNEL32.dll_VirtualFree
pop dword fs:[0]
add esp, 0x10
mov eax, dword [ebp - 4]
pop edx
pop esi
pop ecx
pop edi
leave
ret 8
Function at 0x100050c4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
and dword [ebp - 0xc], 0
push 0
push 0
push 3
push 0
push 7
push closesocket
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x10005141
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 2
push 0
push eax
call sub.KERNEL32.dll_CreateFileMappingA
or eax, eax
je 0x10005139
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 4
push eax
call sub.KERNEL32.dll_MapViewOfFile
or eax, eax
je 0x10005131
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
push eax
call fcn.10004f51
or eax, eax
je 0x10005129
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_UnmapViewOfFile
push dword [ebp - 8]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
leave
ret 8
Function at 0x406a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esi - 0x72f7137d]
inc ebp
clc
jg 0x406a5b
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xchg ebx, eax
push ebp
cld
mov eax, dword [ebp - 8]
xor esi, esi
xor ecx, ecx
or edx, esi
push esi
sbb cl, al
push 0xa
push edx
push ecx
call fcn.0040b556
sub eax, 0x24864000
nop
sbb edx, 0x6946b3
mov esp, ebp
pop ebp
lahf
nop
dec esi
nop
nop
into
mov word [eax - 0x741374ab], ss
inc ebp
or al, 0x33
pop ds
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor esi, edx
pop ds
jg 0x406a41
test dword [ebx + 0xc8d0e48], 0x890c8dcf
lea edx, [ecx + ecx*4]
xor al, 0
mov cl, 0xc1
loop 0x406a61
shl edx, 3
mov dword [ebp + 0x33], edi
rcr byte [edx - 0x75], cl
push eax
or al, 0x89
test dword [ebx + esi], 0x8c8b66d2
or cl, byte [ecx - 0x2dccf79a]
mov dx, word [eax - 0x33]
mov dword [ecx - 0x6c], edx
xor edx, edx
aas
push eax
pop es
mov dword [ecx + 0x10], edx
xor ebp, dword [edi]
pop esi
mov edx, dword [eax + 2]
popal
mov dword [ecx + 0x14], edx
xor edx, edx
mov dx, word [eax]
sub edx, 0xf000076c
mov dword [ecx + 0x18], edx
xor edx, edx
Function at 0x408fb0
Capabilities:
Hash data with md5

Disassembly:
movss xmm0, dword [0x4ad0c4]
mov edx, 0xc62a5859
mov eax, dword [0x4ad37c]
sub edx, eax
movsd xmm1, qword [0x4ad148]
cvtps2pd xmm2, xmm0
movd xmm0, edx
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
subsd xmm2, xmm1
cvtpd2ps xmm0, xmm2
movss dword [0x4ad0c4], xmm0
inc dword [0x4ad37c]
mov dword [ecx], 0
movsx eax, word [0x4ad25c]
add eax, 0x722acd66
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [0x4ad3c8], xmm0
mov dword [ecx + 4], 0
movzx eax, word [0x4ad518]
sub eax, 0x10bacc75
mov word [0x4ad5fc], ax
inc word [0x4ad518]
mov dword [ecx + 8], 0x67452301
movsd xmm0, qword [0x4ad2f8]
subsd xmm0, qword [0x4a03c0]
movsd qword [0x4ad2f8], xmm0
mov dword [ecx + 0xc], 0xefcdab89
movsx eax, word [0x4ad510]
movss xmm0, dword [0x4ad34c]
add eax, 0x4737f67a
movd xmm1, eax
cvtdq2ps xmm1, xmm1
addss xmm0, xmm1
cvtps2pd xmm1, xmm0
movsd xmm0, qword [0x4ad5d8]
mulsd xmm0, xmm1
movsd qword [0x4ad5d8], xmm0
mov dword [ecx + 0x10], 0x98badcfe
mov eax, dword [0x4ad5d4]
movss xmm1, dword [0x4ad318]
movd xmm0, eax
mov eax, dword [0x4ad618]
cvtdq2ps xmm0, xmm0
addss xmm1, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
cvtps2pd xmm0, xmm0
movsd qword [0x4ad1f8], xmm0
dec dword [0x4ad618]
mov dword [ecx + 0x14], 0x10325476
movsx eax, word [0x4ad064]
mov ecx, dword [0x4ad4f0]
add eax, 0x4b065465
imul ecx, eax
mov dword [0x4ad4f0], ecx
ret

Function at 0x41c1a0
Capabilities:
Terminate process

Disassembly:
add dword [0x4ad52c], 0x92f69cf6
push dword [0x4ae598]
call fcn.00433960
movss xmm0, dword [0x4ad314]
add esp, 4
subss xmm0, dword [0x49efec]
push 1
movss dword [0x4ad314], xmm0
movss xmm0, dword [0x4ad314]
movsd xmm1, qword [0x4ad2a0]
mov eax, dword [0x4ad464]
cvtps2pd xmm0, xmm0
movd xmm2, eax
movsx eax, word [0x4ad388]
addsd xmm1, xmm0
cvtdq2pd xmm2, xmm2
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm2, xmm1
addsd xmm0, xmm2
cvttsd2si eax, xmm0
mov word [0x4ad388], ax
inc dword [0x4ad464]
movsd xmm0, qword [0x4ad2a0]
addsd xmm0, qword [0x49eff0]
movsd qword [0x4ad2a0], xmm0
call fcn.00455972
int3
Function at 0x485596
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048538a

Function at 0x4877f4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00486fce

Function at 0x4877ff
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00487209

Function at 0x4914f4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004910f9

Function at 0x4914ff
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049127a
Function at 0x4053e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
lea eax, [esp + 4]
push esi
push eax
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x405505
mov eax, dword [esp + 0x18]
dec eax
je 0x4054ec
dec eax
jne 0x405505
mov eax, dword [esp + 0xc]
cmp eax, 4
jne 0x405436
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x405505
mov eax, 2
pop esi
add esp, 0x98
ret
cmp eax, 5
jne 0x405492
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4054df
cmp eax, 1
je 0x4054df
cmp eax, 2
jne 0x405505
push str.IsWow64Process
push str.kernel32.dll
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4054df
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [esp + 4]
jmp 0x4054ce
cmp eax, 6
jne 0x405505
push str.IsWow64Process
push str.kernel32.dll
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4054df
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [esp + 4]
test eax, eax
je 0x4054df
mov eax, 4
pop esi
add esp, 0x98
ret
mov eax, 3
pop esi
add esp, 0x98
ret
mov eax, dword [esp + 0x14]
pop esi
and eax, 0xffff0000
cmp eax, 0x40a0000
sbb eax, eax
inc eax
add esp, 0x98
ret
or eax, 0xffffffff
pop esi
add esp, 0x98
ret
Function at 0x405ec0
Capabilities:
Create directory

Disassembly:
sub esp, 0x118
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x12c]
push edi
call fcn.00406350
add esp, 4
test eax, eax
jne 0x405ee9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
mov cl, byte [edi]
xor eax, eax
cmp cl, 0x5c
mov dword [esp + 0x10], eax
jne 0x405f06
mov cl, byte [edi + 1]
mov dword [esp + 0x18], 1
cmp cl, 0x5c
je 0x405f0a
mov dword [esp + 0x18], eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov dword [esp + 0x20], ebx
lea eax, [ebx + 1]
push eax
call fcn.00424958
mov ebp, eax
mov ecx, edi
add esp, 4
sub ecx, ebp
mov esi, 3
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x405f2e
cmp ebx, 3
mov dword [esp + 0x14], 3
jl 0x405fdd
mov eax, 2
lea esi, [ebp + 3]
sub eax, ebp
mov dword [esp + 0x1c], eax
jmp 0x405f5c
mov eax, dword [esp + 0x1c]
add eax, esi
push eax
push edi
mov bl, byte [eax + edi - 2]
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [esp + 0x24]
push 0x5c
push ecx
call fcn.00406ca0
add esp, 8
test eax, eax
je 0x405fc5
mov cl, byte [eax + 1]
test cl, cl
je 0x405f8d
test bl, bl
jne 0x405fc5
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov eax, 1
inc edx
cmp ecx, eax
mov dword [esp + 0x10], edx
jne 0x405fa9
mov ecx, edx
cmp ecx, eax
je 0x405fc5
push ebp
mov byte [esi], 0
call fcn.00405570
add esp, 4
test eax, eax
jne 0x405fc5
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x405ff6
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov byte [esi], bl
inc eax
inc esi
cmp eax, ecx
mov dword [esp + 0x14], eax
jle 0x405f58
push ebp
call fcn.00424981
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
push ebp
call fcn.00424981
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret

Function at 0x4060b0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax], 0x5c
jne 0x4060c5
cmp byte [eax + 1], 0x5c
jne 0x4060c5
mov eax, 4
ret
push 3
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
movsx ecx, byte [esp + 4]
push ecx
call fcn.00414b77
add esp, 4
test eax, eax
je case.default.0x406109
cmp byte [esp + 5], 0x3a
jne case.default.0x406109
lea edx, [esp + 4]
mov byte [esp + 6], 0x5c
push edx
mov byte [esp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 4
ja case.default.0x406109
jmp dword [eax*4 + 0x406134]
lea eax, [esp + 4]
push eax
call fcn.004064e0
add esp, 4
ret
mov eax, 3
ret
mov eax, 5
ret
mov eax, 6
ret
xor eax, eax
ret
Function at 0x4062d0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.004056e0
add esp, 4
test eax, eax
jne 0x4062eb
pop edi
mov eax, 1
pop esi
ret
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push esi
mov ebx, eax
call ebp
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push esi
mov edi, eax
call ebp
pop ebp
pop ebx
test edi, edi
je 0x40633d
cmp edi, 0xffffffff
je 0x40633d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x4064e0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x10
xor eax, eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp + 0xc], eax
mov dword [esp], eax
lea eax, [esp]
lea edx, [esp + 4]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x40651c
add esp, 0x10
ret
mov edx, dword [esp]
mov eax, 0x163c00
imul edx, dword [esp + 4]
imul edx, dword [esp + 8]
and edx, 0xfffffc00
cmp eax, edx
sbb eax, eax
neg eax
inc eax
add esp, 0x10
ret
Function at 0x406540
Capabilities:
Get file version info

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x318
lea ecx, [esp + 0x110]
push ebp
push esi
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x11c]
push str..exe
push edx
call ebp
lea eax, [esp + 0x14]
lea ecx, [esp + 0x11c]
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x406593
pop edi
pop esi
pop ebp
add esp, 0x318
ret
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x4065ac
pop edi
pop esi
pop ebp
add esp, 0x318
ret
mov edx, dword [esp + 0x14]
push esi
push edi
lea eax, [esp + 0x124]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x4065d7
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x318
ret
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
push edx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x406603
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x318
ret
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
mov ecx, dword [eax]
mov dx, word [eax]
shr ecx, 0x10
push ecx
push edx
lea eax, [esp + 0x228]
push str._04X_04X
push eax
call edi
lea ecx, [esp + 0x230]
lea edx, [esp + 0x28]
push ecx
push str.StringFileInfo_sFileDescription
push edx
call edi
add esp, 0x1c
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x18]
push eax
push ecx
push edx
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x40666b
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x318
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x32c]
push eax
push ecx
call ebp
lea edx, [esp + 0x220]
lea eax, [esp + 0x18]
push edx
push str.StringFileInfo_sFileVersion
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
push ecx
push edx
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x4066bd
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x318
ret
mov ecx, dword [esp + 0x33c]
mov edx, dword [esp + 0x338]
push ebx
push 0x11f
push ecx
push edx
call fcn.00406fa0
mov ebx, dword [esp + 0x340]
add esp, 0xc
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x10]
push eax
push ebx
call ebp
lea ecx, [esp + 0x224]
lea edx, [esp + 0x1c]
push ecx
push str.StringFileInfo_sLegalCopyright
push edx
call edi
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push eax
push ecx
push edx
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
pop ebx
jne 0x406736
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x318
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x334]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x318
ret
Function at 0x406760
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00405570
add esp, 4
test eax, eax
jne 0x406779
mov eax, 1
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x406790
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.004056e0
add esp, 4
test eax, eax
jne 0x4067a9
mov eax, 1
pop esi
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret

Function at 0x4067c0
Capabilities:
Delete file
Move file
Read .ini file
Set file attributes

Disassembly:
sub esp, 0x21c
push ebx
mov ebx, dword [esp + 0x224]
push esi
push edi
push ebx
call fcn.004056e0
add esp, 4
test eax, eax
je 0x40695b
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.004053e0
test eax, eax
je 0x4068b2
cmp eax, 1
je 0x4068b2
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x1a]
mov eax, 0x66666667
and ecx, 0xffff
imul ecx
sar edx, 2
mov ecx, edx
mov eax, dword [esp + 0x16]
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x134]
push str.._02d_02d_02d_02d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [esp + 0x20]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x124]
lea edx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [esp + 0x20]
push 0
push eax
push ebx
call esi
test eax, eax
jne 0x40689d
pop edi
pop esi
pop ebx
add esp, 0x21c
ret
push 4
lea ecx, [esp + 0x24]
push 0
push ecx
call esi
pop edi
pop esi
pop ebx
add esp, 0x21c
ret
push 0x7fff
call fcn.00424958
add esp, 4
mov edi, eax
push str.WININIT.INI
push 0x7fff
push edi
push str.Rename
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov al, byte [edi]
mov esi, edi
test al, al
je 0x4068f2
mov dl, byte [esi]
inc esi
test dl, dl
je 0x4068ed
mov al, byte [esi]
inc esi
test al, al
jne 0x4068e6
cmp byte [esi], 0
jne 0x4068df
push str.NUL
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov cl, byte [esi]
inc esi
test cl, cl
je 0x406914
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x40690d
push str.WININIT.INI
push edi
push str.Rename
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
test eax, eax
jne 0x406941
push edi
call fcn.00424981
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x21c
ret
push str.WININIT.INI
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push edi
call fcn.00424981
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x21c
ret