joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40498b
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
sub esp, 0x220
lea ebp, [esp - 4]
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp + 0x220], eax
push 0x140
mov eax, 0x41a873
call fcn.00408a47
mov esi, dword [ebp + 0x22c]
lea eax, [ebp + 0x18]
push 0x104
push 0
push eax
call fcn.004037ab
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x4049d5
mov eax, dword [esi]
jmp 0x4049d7
mov eax, esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push 0x41b3bc
push eax
lea eax, [ebp + 0x18]
push eax
call ebx
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x404ae9
push 0x104
lea eax, [ebp + 0x11c]
push 0
push eax
call fcn.004037ab
add esp, 0xc
test byte [ebp - 0x14c], 0x10
je 0x404aa2
lea eax, [ebp - 0x120]
push 0x41b380
push eax
call fcn.0040e800
pop ecx
pop ecx
test eax, eax
je 0x404acc
lea eax, [ebp - 0x120]
push 0x41b3c0
push eax
call fcn.0040e800
pop ecx
pop ecx
test eax, eax
je 0x404acc
cmp dword [esi + 0x14], 0x10
jb 0x404a60
mov eax, dword [esi]
jmp 0x404a62
mov eax, esi
lea ecx, [ebp - 0x120]
push ecx
push eax
lea eax, [ebp + 0x11c]
push eax
call ebx
lea eax, [ebp + 0x11c]
push eax
lea ecx, [ebp]
call fcn.004048dc
and dword [ebp - 4], 0
lea eax, [ebp]
push eax
call fcn.0040498b
or dword [ebp - 4], 0xffffffff
pop ecx
push 0
push 1
lea ecx, [ebp]
call fcn.004054de
jmp 0x404acc
cmp dword [esi + 0x14], 0x10
jb 0x404aac
mov eax, dword [esi]
jmp 0x404aae
mov eax, esi
lea ecx, [ebp - 0x120]
push ecx
push eax
lea eax, [ebp + 0x11c]
push eax
call ebx
lea eax, [ebp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x14c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x404a05
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esi + 0x14], 0x10
jb 0x404af1
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x220]
xor ecx, ebp
call fcn.00408980
lea esp, [ebp + 0x224]
pop ebp
ret
Function at 0x404b21
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0xa8]
sub esp, 0x128
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp + 0xa4], eax
push esi
mov esi, dword [ebp + 0xb0]
cmp dword [esi + 0x14], 0x10
jb 0x404b4d
mov eax, dword [esi]
jmp 0x404b4f
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x404be4
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
push edi
lea eax, [ebp + 0x84]
push 0x41b3c4
push eax
call fcn.004048a2
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x404b86
mov eax, dword [esi]
jmp 0x404b88
mov eax, esi
lea ecx, [ebp + 0x84]
push ecx
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x404bb5
inc edi
jmp 0x404b67
xor edi, edi
lea eax, [ebp - 0x80]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp byte [ebp - 0x80], 0
je 0x404bd4
lea eax, [ebp - 0x80]
push eax
call fcn.0040c200
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x80]
mov ecx, esi
push eax
call fcn.004057c7
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp + 0xa4]
xor ecx, ebp
pop esi
call fcn.00408980
lea esp, [ebp + 0xa8]
pop ebp
ret

Function at 0x404bfa
Capabilities:
Accept command line arguments

Disassembly:
push 0x20
mov eax, 0x41a8a6
call fcn.00408a7b
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp - 0x2c]
mov ebx, 0x41b3c8
push ecx
push ebx
push eax
jmp 0x404c4d
push eax
lea ecx, [ebp - 0x28]
call fcn.004048dc
lea eax, [ebp - 0x28]
mov dword [ebp - 4], edi
push eax
mov ecx, esi
call fcn.00405bb4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push edi
push 1
call fcn.004054de
lea eax, [ebp - 0x2c]
push eax
push ebx
push edi
call fcn.0040e7be
add esp, 0xc
test eax, eax
jne 0x404c21
call fcn.00408a36
ret

Function at 0x404d7e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 0x103
jb 0x404db2
xor eax, eax
jmp 0x404e2b
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x208
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
test eax, eax
je 0x404dff
cmp byte [ebp - 0x310], 0
jne 0x404de9
xor eax, eax
jmp 0x404df6
lea eax, [ebp - 0x310]
push eax
call fcn.0040c200
pop ecx
push eax
lea eax, [ebp - 0x310]
jmp 0x404e20
cmp byte [ebp - 0x108], 0
jne 0x404e0c
xor eax, eax
jmp 0x404e19
lea eax, [ebp - 0x108]
push eax
call fcn.0040c200
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.004057c7
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00408980
mov esp, ebp
pop ebp
ret
Function at 0x406170
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [0x426c6e]
test edi, edi
jg 0x406186
and dword [0x426da8], 0
xor eax, eax
pop edi
ret
mov eax, 0x800
cmp edi, eax
push esi
cmova edi, eax
push edi
push dword [0x426db0]
push dword [0x423b60]
call dword [sym.imp.KERNEL32.dll__lread]
cmp dword [0x423b7c], 0
mov esi, eax
mov dword [0x426da8], esi
je 0x406204
cmp esi, 0xffffffff
je 0x406204
cmp esi, edi
je 0x406215
test esi, esi
js 0x406204
mov ax, word [0x423060]
push dword [0x423b80]
inc ax
movzx eax, ax
push eax
call fcn.004039a6
mov esi, dword [0x426da8]
test esi, esi
jne 0x4061fe
push edi
push dword [0x426db0]
push dword [0x423b60]
call dword [sym.imp.KERNEL32.dll__lread]
mov esi, eax
mov dword [0x426da8], esi
cmp esi, 0xffffffff
cmovne edi, esi
cmp esi, edi
je 0x406215
push 2
call fcn.00401988
mov esi, dword [0x426da8]
sub dword [0x426c6e], esi
cmp dword [0x423b70], 0
mov edi, dword [0x426db0]
mov dword [0x426dac], edi
je 0x406251
test esi, esi
je 0x406251
call fcn.00408068
xor byte [edi], al
movzx eax, byte [edi]
push eax
call fcn.00408142
inc edi
pop ecx
sub esi, 1
jne 0x406234
mov esi, dword [0x426da8]
mov eax, esi
dec esi
mov dword [0x426da8], esi
pop esi
pop edi
ret
Function at 0x4080ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0x423b78]
mov esi, dword [ebp + 8]
call fcn.00408082
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00403787
add esp, 0x10
xor esi, esi
call fcn.00408068
movzx ecx, byte [ebp + esi - 0x10]
xor eax, ecx
mov byte [ebp + esi - 0x10], al
movzx eax, al
push eax
call fcn.00408142
inc esi
pop ecx
cmp esi, 0xc
jl 0x4080ea
cmp dword [0x423b74], 0
movzx ecx, byte [ebp - 5]
pop esi
je 0x408129
movzx eax, byte [0x426c67]
cmp cx, ax
je 0x408132
or eax, 0xffffffff
jmp 0x408134
movzx eax, byte [0x426c6d]
jmp 0x40811f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408980
mov esp, ebp
pop ebp
ret

Function at 0x408142
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [0x426350]
mov eax, ecx
xor eax, dword [esp + 4]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x4263a0]
movzx eax, cl
add eax, dword [0x426354]
imul eax, eax, 0x8088405
mov dword [0x426350], ecx
mov ecx, dword [0x426358]
inc eax
mov dword [0x426354], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4263a0]
mov dword [0x426358], ecx
ret
Function at 0x30032398
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x30033f10
call fcn.3003260e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x3006be98
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x30032188
cmp eax, esi
jne 0x3003217b
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x3003218b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30032162
xor esi, esi
inc esi
mov eax, dword [0x3006be94]
cmp eax, esi
jne 0x3003219e
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x300321d9
mov eax, dword [0x3006be94]
test eax, eax
jne 0x300321d3
mov dword [0x3006be94], esi
push 0x3000130c
push 0x30001300
call fcn.300fe000
pop ecx
pop ecx
test eax, eax
je 0x300321d9
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x300322b0
mov dword [0x3006bb50], esi
mov eax, dword [0x3006be94]
cmp eax, esi
jne 0x300321fd
push 0x300012fc
push 0x300012e4
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x3006be94], 2
cmp dword [ebp - 0x1c], ebx
jne 0x3003220a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x3006bea4], ebx
je 0x3003222b
push 0x3006bea4
call fcn.300329cc
pop ecx
test eax, eax
je 0x3003222b
push ebx
push 2
push ebx
call dword [0x3006bea4]
mov eax, dword [0x3006bb38]
mov ecx, dword [sym.imp.MSVCR80.dll___winitenv]
mov dword [ecx], eax
push dword [0x3006bb38]
push dword [0x3006bb3c]
push dword [0x3006bb34]
call fcn.3001d9bd
add esp, 0xc
mov dword [0x3006bb4c], eax
cmp dword [0x3006bb40], ebx
jne 0x30032296
push eax
call dword [sym.imp.MSVCR80.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.MSVCR80.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x3006bb50], ebx
jne 0x300322a4
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x3006bb4c]
call fcn.30032653
ret
call fcn.30032029
jmp 0x30032140
Function at 0x402f22
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xc4
mov eax, 0x481842
call fcn.00464da0
xor esi, esi
mov dword [ebp - 4], esi
push 0xf
pop edi
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], edi
call fcn.00401680
push esi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], edi
call fcn.00401680
push dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00402150
push dword [ebp + 8]
movzx eax, word [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [ebp - 0x14], 0x10
mov edi, eax
mov eax, dword [ebp - 0x28]
jae 0x402f98
lea eax, [ebp - 0x28]
push 1
push 0x40
push 0x20
push eax
lea ecx, [ebp - 0xd0]
call fcn.00402db2
push edi
push ebx
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 5
call fcn.00402e7c
lea ecx, [ebp - 0xd0]
call fcn.00402b74
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 4
call fcn.00402c66
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.004018d3
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.004018d3
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401000
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00401000
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.00401000
call fcn.00464e23
ret

Function at 0x403d27
Capabilities:
Encode data using xor

Disassembly:
push 0x48
mov eax, 0x481913
call fcn.00464da0
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], edi
lea eax, [ebp + 0xc]
push eax
xor ebx, ebx
lea eax, [ebp - 0x2c]
inc ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00403b70
pop ecx
pop ecx
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0040362e
mov dword [ebp - 0x50], ebx
cmp dword [ebp - 0x18], edi
jbe 0x403d91
push edi
lea ecx, [ebp - 0x2c]
call fcn.004033dc
mov cl, byte [0x4b629d]
xor byte [eax], cl
push edi
lea ecx, [ebp - 0x2c]
call fcn.004033dc
movzx eax, byte [eax]
push eax
mov ecx, esi
call fcn.00403a99
inc edi
cmp edi, dword [ebp - 0x18]
jb 0x403d66
push dword [esi]
lea ecx, [ebp - 0x48]
call fcn.004023a7
mov edi, dword [ebp + 0x28]
dec edi
mov byte [ebp - 4], 3
test edi, edi
jle 0x403de3
push dword [ebp + 0x2c]
lea eax, [ebp - 0x48]
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
push eax
call fcn.00401f63
lea eax, [ebp - 0x4c]
push eax
call fcn.00403d27
add esp, 0x28
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.00403ae1
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00401000
inc edi
cmp dword [ebp + 0x2c], edi
jne 0x403e14
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
sub eax, dword [ebp + 0x2c]
mov ecx, esi
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.0040370f
push eax
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00403ae1
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.00401000
push 0
push ebx
lea ecx, [ebp - 0x48]
call fcn.004018d3
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004018d3
push 0
push ebx
lea ecx, [ebp + 0xc]
call fcn.004018d3
mov eax, esi
call fcn.00464e23
ret
Function at 0x404df9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x170]
test ecx, ecx
je 0x404e0b
call fcn.00433ad5
mov ecx, esi
pop esi
jmp fcn.0044e0d9

Function at 0x405075
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x4b82fc]
xor eax, ebp
mov dword [ebp + 0x84], eax
push ebx
push esi
mov esi, dword [ebp + 0x90]
push edi
push esi
mov dword [ebp - 0x80], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x405105
xor ebx, ebx
push 0xff
lea eax, [ebp - 0x7b]
push ebx
push eax
mov byte [ebp - 0x7c], bl
call fcn.004645c0
mov esi, dword [sym.imp.USER32.dll_GetKeyboardState]
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
test eax, eax
je 0x4050e2
test byte [ebp - 0x6a], 0x80
jne 0x4050e2
push ebx
push 1
push ebx
push 0x12
call edi
push dword [ebp - 0x80]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [ebp - 0x7c]
push eax
call esi
test eax, eax
je 0x40511a
test byte [ebp - 0x6a], 0x80
jne 0x40511a
push ebx
push 3
push ebx
push 0x12
call edi
jmp 0x40511a
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov ecx, dword [ebp + 0x84]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464d28
add ebp, 0x88
leave
ret 4

Function at 0x405312
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4b82fc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x405371
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x405377
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x10], ebx
je 0x405385
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
pop ebx
call fcn.00464d28
leave
ret
Function at 0x40b310
Capabilities:
Identify system language via api

Disassembly:
push 8
mov eax, 0x482324
call fcn.00464d37
and dword [ebp - 0x10], 0
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0040362e
and dword [ebp - 4], 0
xor esi, esi
inc esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
test eax, eax
je 0x40b4a3
mov ecx, 0x140c
cmp eax, ecx
jg 0x40b40b
je 0x40b3a9
mov ecx, 0x816
cmp eax, ecx
jg 0x40b3bd
je 0x40b3b3
mov ecx, 0x416
cmp eax, ecx
jg 0x40b391
je 0x40b3b3
sub eax, 0x407
je 0x40b3eb
sub eax, 3
je 0x40b495
dec eax
dec eax
je 0x40b3a9
sub eax, 5
jne 0x40b48e
push 0x48fac8
jmp 0x40b49a
sub eax, 0x807
je 0x40b3eb
sub eax, 3
je 0x40b495
dec eax
dec eax
jne 0x40b48e
push 0x48fac4
jmp 0x40b49a
push 0x48fac0
jmp 0x40b49a
mov ecx, 0x100a
cmp eax, ecx
jg 0x40b3f5
je 0x40b495
sub eax, 0xc07
je 0x40b3eb
sub eax, 3
je 0x40b495
dec eax
dec eax
je 0x40b3a9
sub eax, 0x3fb
jne 0x40b48e
push 0x48fabc
jmp 0x40b49a
sub eax, 0x100c
je 0x40b3a9
sub eax, 0x3fb
je 0x40b3eb
sub eax, 3
jmp 0x40b48c
mov ecx, 0x380a
cmp eax, ecx
jg 0x40b452
je 0x40b495
mov ecx, 0x280a
cmp eax, ecx
jg 0x40b43d
je 0x40b495
cmp eax, 0x180a
je 0x40b495
cmp eax, 0x1c0a
je 0x40b495
cmp eax, 0x200a
je 0x40b495
cmp eax, 0x240a
jmp 0x40b48c
cmp eax, 0x2c0a
je 0x40b495
cmp eax, 0x300a
je 0x40b495
cmp eax, 0x340a
jmp 0x40b48c
mov ecx, 0x4c0a
cmp eax, ecx
jg 0x40b479
je 0x40b495
cmp eax, 0x3c0a
je 0x40b495
cmp eax, 0x400a
je 0x40b495
cmp eax, 0x440a
je 0x40b495
cmp eax, 0x480a
jmp 0x40b48c
cmp eax, 0x500a
je 0x40b495
cmp eax, 0x540a
je 0x40b495
cmp eax, 0x580a
je 0x40b495
push 0x48fab8
jmp 0x40b49a
push 0x48fab4
mov ecx, edi
call fcn.00403b2e
jmp 0x40b4c9
lea eax, [ebp - 0x14]
push 0x95
push eax
call fcn.00428be0
pop ecx
pop ecx
push eax
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.00403ae1
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401000
mov eax, edi
call fcn.00464e0f
ret 4
Function at 0x42858e
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4b82fc]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
mov dword [ebp - 0x80], eax
mov eax, dword [0x4b9ae4]
xor ebx, ebx
push esi
mov dword [ebp - 0x78], ebx
cmp dword [eax - 0xc], ebx
jne 0x4286e9
push edi
push 0x100
lea eax, [ebp - 0x6c]
push eax
push ebx
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
mov esi, 0x4b9af8
cmp edi, ebx
je 0x4286d9
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
push edi
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x6c]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.VarFileInfoTranslation
lea eax, [ebp + 0x94]
push eax
call edi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x94]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x428672
cmp dword [ebp - 0x74], ebx
je 0x428672
mov eax, dword [ebp - 0x70]
cmp eax, ebx
je 0x428672
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str._04x_04x
push esi
call fcn.00467621
add esp, 0x10
jmp 0x42867a
push str.041904b0
push esi
call edi
push esi
lea eax, [ebp + 0x94]
push str.StringFileInfo_s_
push eax
call fcn.00467621
add esp, 0xc
push 0x498528
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x94]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4286d1
cmp dword [ebp - 0x74], ebx
je 0x4286d1
cmp dword [ebp - 0x70], ebx
je 0x4286d1
push dword [ebp - 0x70]
jmp 0x4286d6
push str.bootstrapper
push esi
call edi
push esi
mov esi, 0x4b9ae4
mov ecx, esi
call fcn.00403b2e
pop edi
jmp 0x4286ee
mov esi, 0x4b9ae4
mov eax, dword [0x4b9ae4]
cmp dword [eax - 0xc], ebx
jne 0x428704
push str.4.4.20.15
mov ecx, esi
call fcn.00403b2e
mov ecx, dword [ebp - 0x80]
push esi
call fcn.004036b5
mov ecx, dword [ebp + 0x194]
mov eax, dword [ebp - 0x80]
pop esi
xor ecx, ebp
pop ebx
call fcn.00464d28
add ebp, 0x198
leave
ret
Function at 0x4288a2
Capabilities:
Check os version

Disassembly:
push ebp
sub esp, 0x94
lea ebp, [esp - 4]
mov eax, dword [0x4b82fc]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 8
mov eax, 0x486595
call fcn.00464d37
mov ebx, dword [ebp + 0xa0]
xor edi, edi
push str.Unknown
mov ecx, ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edi
call fcn.00404237
push 0x94
lea eax, [ebp]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 1
call fcn.004645c0
add esp, 0xc
lea eax, [ebp]
push eax
mov dword [ebp], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp + 4], 5
jne 0x428930
cmp dword [ebp + 8], 1
jne 0x428923
push str.WinXP
jmp 0x42895a
cmp dword [ebp + 8], 2
jne 0x428961
push str.WinXP_64
jmp 0x42895a
cmp dword [ebp + 4], 6
jne 0x428961
cmp dword [ebp + 8], edi
jne 0x428942
push str.WinVista
jmp 0x42895a
cmp dword [ebp + 8], 1
jne 0x42894f
push str.Win7
jmp 0x42895a
cmp dword [ebp + 8], 2
jne 0x428961
push str.Win8
mov ecx, ebx
call fcn.00403b2e
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.00464d28
add ebp, 0x98
leave
ret
Function at 0x42b49a
Capabilities:
Print debug messages

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x4b82fc]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x94
mov eax, 0x486d3e
call fcn.00464d37
lea eax, [ebp + 0x810]
push eax
push dword [ebp + 0x80c]
mov esi, 0x800
lea eax, [ebp]
push esi
push eax
call fcn.00468291
add esp, 0x10
call fcn.00443455
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x42b4fa
push 0x80004005
call fcn.00403039
mov edx, dword [eax]
push 1
push esi
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x42b50c
call fcn.0043185e
lea edi, [eax + 0x10]
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
call fcn.0040324d
push esi
lea eax, [ebp]
push eax
push esi
push edi
call fcn.004644e4
add esp, 0x10
and dword [ebp - 4], 0
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [0x4b9ab8], 0
je 0x42b5af
lea eax, [ebp - 0x10]
push eax
call fcn.00430a93
mov dword [esp], str._log_file.txt
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.004039cb
add esp, 0xc
mov eax, dword [eax]
push 1
push 0x40
push 0xa
push eax
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 2
call fcn.00402db2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401000
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.00401000
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00413ef4
pop ecx
pop ecx
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0
call fcn.00402c66
lea ecx, [edi - 0x10]
call fcn.00401000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00464d28
add ebp, 0x804
leave
ret

Function at 0x42cc24
Capabilities:
Get mac address on windows

Disassembly:
push ebp
lea ebp, [esp - 0x5304]
mov eax, 0x5304
call fcn.00467bc0
push 0xffffffffffffffff
push 0x487097
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4b82fc]
xor eax, ebp
mov dword [ebp + 0x5300], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x530c]
mov ecx, edi
call fcn.0042b083
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
mov dword [ebp - 0x10], 0x5100
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x42cd16
lea esi, [ebp]
cmp dword [esi + 0x1a0], 6
jne 0x42cd0c
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push str._.2x__.2x__.2x__.2x__.2x__.2x
lea eax, [ebp + 0x5100]
push 0x200
push eax
call fcn.0046769e
add esp, 0x24
lea eax, [ebp + 0x5100]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004023a7
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call fcn.0042cbca
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004018d3
mov esi, dword [esi]
test esi, esi
jne 0x42cc8c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x5300]
xor ecx, ebp
call fcn.00464d28
add ebp, 0x5304
leave
ret