joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ce57c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ce75c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.004c9964
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [ebp - 0x14]
mov dword [0x5416f8], eax
mov eax, dword [ebp - 0xc]
mov dword [0x5416fc], eax
mov eax, dword [ebp - 0x24]
mov dword [0x541700], eax
mov eax, dword [0x54358c]
cmp dword [eax], 2
sete byte [0x540ec4]
push 0x4ce768
call sub.kernel32.dll_GetModuleHandleW_2
lea edx, [ebp - 4]
call fcn.004c7564
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x540ec4], 0
jne 0x4ce60b
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.004c7be8
test al, al
je 0x4ce60b
mov eax, dword [ebp - 0x4c]
mov dword [0x54990c], eax
jmp 0x4ce612
xor eax, eax
mov dword [0x54990c], eax
call fcn.004cde14
and eax, 0x7f
cmp eax, 0x12
ja case.0x4ce623.0
jmp dword [eax*4 + 0x4ce62a]
mov byte [0x540eb0], 1
jmp case.0x4ce623.0
mov byte [0x540eb4], 1
jmp case.0x4ce623.0
mov byte [0x540eb8], 1
jmp case.0x4ce623.0
mov byte [0x540ebc], 1
jmp case.0x4ce623.0
mov byte [0x540ec0], 1
jmp case.0x4ce623.0
mov byte [0x540ec8], 1
mov byte [0x540ecc], 1
jmp case.0x4ce623.0
mov byte [0x540ec8], 1
mov byte [0x540ed0], 1
jmp case.0x4ce623.0
mov byte [0x540ec8], 1
mov byte [0x540ed0], 1
mov byte [0x540ed4], 1
jmp case.0x4ce623.0
mov byte [0x540ed8], 1
jmp case.0x4ce623.0
mov byte [0x540edc], 1
jmp case.0x4ce623.0
mov byte [0x540ee0], 1
jmp case.0x4ce623.0
mov byte [0x540ee4], 1
jmp case.0x4ce623.0
mov byte [0x540ee8], 1
jmp case.0x4ce623.0
mov byte [0x540eec], 1
jmp case.0x4ce623.0
mov byte [0x540ef0], 1
jmp case.0x4ce623.0
mov byte [0x540ef4], 1
jmp case.0x4ce623.0
mov byte [0x540ef8], 1
jmp case.0x4ce623.0
mov byte [0x540efc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce763
lea eax, [ebp - 4]
call fcn.004077c0
ret

Function at 0x4d16a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x4d1704
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.004079e0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.004151a8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d170b
lea eax, [ebp - 0x14]
call fcn.004077c0
ret
Function at 0x4d59d4
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4d59e9
add esp, 0xfffffff0
call fcn.00405c98
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.00405734
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.004077d0
mov eax, esi
call fcn.0040785c
push eax
movzx eax, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateMutexW
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x4d5a3d
mov ecx, dword [0x5433a8]
mov dl, 1
mov eax, dword [0x4d5574]
call fcn.004c1134
call fcn.0040623c
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4d5a64
call fcn.00405cf0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4e0894
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e0985
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x4e0994
push esi
call sub.kernel32.dll_FindResourceW
test eax, eax
setne al
mov byte [ebx + 4], al
cmp byte [ebx + 4], 0
je 0x4e0925
push 0x4e0844
lea ecx, [ebx + 0x14]
mov edx, ebx
mov eax, esi
call fcn.0041d930
cmp dword [ebx + 0xc], 0
jne 0x4e0909
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004c7564
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004c7438
mov edx, dword [ebp - 8]
lea eax, [ebx + 0xc]
mov ecx, 0x4e09b8
call fcn.00407cb4
cmp byte [ebx + 0x1d], 0
je 0x4e0925
mov eax, dword [ebx + 8]
mov edx, dword [eax]
call dword [edx + 0xa0]
mov eax, dword [ebx + 0x10]
mov edx, dword [eax]
call dword [edx + 0xa0]
push 0xa
push 0x4e09c4
push esi
call sub.kernel32.dll_FindResourceW
mov edi, eax
test edi, edi
je 0x4e096a
push edi
push esi
call sub.kernel32.dll_LoadResource
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4e096a
push edi
push esi
call sub.kernel32.dll_SizeofResource
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LockResource
lea ecx, [ebx + 0x18]
pop edx
call fcn.00408aa4
lea eax, [ebx + 0x18]
call fcn.004d22d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e098c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004077c8
ret

Function at 0x4e13cc
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
push 0x40
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x4e140b
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x4e140b
cmp dword [eax + 0x3c], 0
je 0x4e140b
mov esi, dword [eax + 0x3c]
add esi, ebx
push 0xf8
push esi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x4e1409
cmp dword [esi], 0x4550
je 0x4e140b
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4e1410
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
push 0x40
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x4e144f
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x4e144f
cmp dword [eax + 0x3c], 0
je 0x4e144f
mov esi, dword [eax + 0x3c]
add esi, ebx
push 0x108
push esi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x4e144d
cmp dword [esi], 0x4550
je 0x4e144f
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4f2be8
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f2cac
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00415bb0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4f2cc8
call fcn.00407cb4
mov eax, dword [ebp - 4]
call fcn.00415728
push 0
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00415cac
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00407cb4
mov eax, dword [ebp - 0xc]
call fcn.0040785c
push eax
mov eax, ebx
call fcn.0040785c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x4f2c68
mov eax, ebx
call fcn.0040785c
push eax
call sub.kernel32.dll_DeleteFileW
push 0
mov eax, dword [esi + 0x30]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x4f2c91
mov eax, dword [esi + 0x2c]
push eax
mov eax, dword [esi + 0x30]
push eax
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4f0bf8]
call fcn.004f2d40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2cb3
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004077c8
ret
Function at 0x4f3458
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f358c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp bx, 0x5c
je 0x4f3571
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
je 0x4f34cc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.0040794c
lea eax, [ebp - 0x2c]
mov edx, 0x4f35a8
call fcn.00407bf4
mov eax, dword [ebp - 0x2c]
call fcn.0040785c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call eax
jmp 0x4f3528
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
mov edx, ebx
call fcn.0040794c
lea eax, [ebp - 0x30]
mov edx, 0x4f35a8
call fcn.00407bf4
mov eax, dword [ebp - 0x30]
call fcn.0040785c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceW
test eax, eax
je 0x4f3528
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.00408c10
call fcn.00408c10
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0x4f35bc
lea eax, [ebp - 0x38]
mov edx, ebx
call fcn.0040794c
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
mov eax, dword [0x4f1250]
call fcn.004f46b4
push dword [ebp - 0x34]
push 0x4f35cc
push dword [ebp - 4]
push dword [ebp - 8]
lea edx, [ebp - 0x3c]
mov eax, dword [0x4f1250]
call fcn.004f47a0
push dword [ebp - 0x3c]
mov eax, esi
mov edx, 4
call fcn.00407d98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f3593
lea eax, [ebp - 0x3c]
mov edx, 5
call fcn.004077c8
ret
Function at 0x4f3f7c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
mov ebx, edx
push 0x104
lea eax, [ebp - 0x20a]
push eax
push 0x1001
push 0x800
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4f3fbb
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.004079e0
jmp 0x4f3fc4
mov eax, ebx
xor edx, edx
call fcn.004077d0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f41b8
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor ecx, ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x68], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x4f42a4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4f42b0
push 0x4f42dc
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040d220
test eax, eax
je 0x4f41ff
mov dword [ebp - 0x60], 0x40
lea edx, [ebp - 0x60]
push edx
call eax
jmp 0x4f4225
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push 0
push 0x100000
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
add eax, 0x80000
adc edx, 0
call fcn.00408c34
push edx
push eax
lea eax, [ebp - 0x64]
call fcn.004150ec
push dword [ebp - 0x64]
push 0x4f4304
push 0
push 0x100000
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
add eax, 0x80000
adc edx, 0
call fcn.00408c34
push edx
push eax
lea eax, [ebp - 0x68]
call fcn.004150ec
push dword [ebp - 0x68]
push 0x4f4314
mov eax, ebx
mov edx, 4
call fcn.00407d98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f42ab
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.004077c8
ret

Function at 0x4f614c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4f6213
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004f6448
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4f622c
call fcn.00407cb4
mov eax, dword [ebp - 4]
call fcn.00415728
mov ecx, 0x10000000
mov edx, 0x4f625c
mov eax, dword [ebp - 4]
call fcn.004f5f94
mov ecx, 0x10000000
mov edx, 0x4f6270
mov eax, dword [ebp - 4]
call fcn.004f5f94
mov ecx, 0x10000000
mov edx, 0x4f6284
mov eax, dword [ebp - 4]
call fcn.004f5f94
mov eax, 0x104
call fcn.0041643c
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x104
call fcn.00404d7c
push ebx
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040785c
push eax
call sub.kernel32.dll_GetTempFileNameW
mov edx, esi
mov eax, ebx
call fcn.00416410
mov eax, ebx
call fcn.0041648c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f621a
lea eax, [ebp - 8]
mov edx, 2
call fcn.004077c8
ret
Function at 0x4f6390
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004077b8
mov eax, dword [ebp - 8]
call fcn.004077b8
lea eax, [ebp - 0x14]
mov edx, dword [0x4f5510]
call fcn.004084c0
xor eax, eax
push ebp
push 0x4f641e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00407824
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00407824
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push 0x4f62a0
call sub.user32.dll_EnumWindows
mov ebx, dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6425
lea eax, [ebp - 0x14]
mov edx, dword [0x4f5510]
call fcn.00408598
lea eax, [ebp - 8]
mov edx, 2
call fcn.004077c8
ret

Function at 0x4f642c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040785c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne al
pop ebx
pop ebp
ret

Function at 0x4f6448
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
mov ebx, eax
push 1
push 0x23
lea eax, [ebp - 0x200]
push eax
push 0
call sub.Shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x4f647e
mov eax, ebx
lea edx, [ebp - 0x200]
mov ecx, pe_nt_image_headers32
call fcn.004079e0
jmp 0x4f6487
mov eax, ebx
xor edx, edx
call fcn.004077d0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f66a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 9
add esp, 0xfffff004
push eax
dec eax
jne 0x4f66ad
mov eax, dword [ebp - 4]
add esp, 0xfffff3a4
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004077b8
xor eax, eax
push ebp
push 0x4f68a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x9c40
mov eax, dword [ebp - 4]
call fcn.004156bc
test al, al
je 0x4f688d
push 2
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x430484]
call fcn.0043bf8c
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x4308b0]
call fcn.00405734
mov dword [ebp - 8], eax
xor ecx, ecx
push ebp
push 0x4f6886
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x9c5c], eax
mov dword [ebp - 0x9c58], edx
fild qword [ebp - 0x9c5c]
mov dword [ebp - 0x9c60], esi
fild dword [ebp - 0x9c60]
fdivp st(1)
call fcn.00404718
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, ebx
imul esi
cdq
cmp edx, dword [esp + 4]
jne 0x4f676c
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4f6771
jmp 0x4f6770
pop edx
pop eax
jge 0x4f6771
inc ebx
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0043b5d8
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0043b63c
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0043b5d8
test ebx, ebx
jle 0x4f6830
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x9c54]
xor ecx, ecx
mov edx, 0x9c40
call fcn.00404d7c
cmp ebx, dword [ebp - 0x10]
jne 0x4f67e5
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov eax, dword [ebp - 0x10]
dec eax
imul eax, eax, 0x9c40
sub ecx, eax
lea edx, [ebp - 0x9c54]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
jmp 0x4f67fa
lea edx, [ebp - 0x9c54]
mov ecx, 0x9c40
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
mov edx, ebx
test edx, edx
jle 0x4f6814
lea eax, [ebp - 0x9c54]
movzx ecx, byte [eax]
xor cx, 0xa2ca
mov byte [eax], cl
inc eax
dec edx
jne 0x4f6806
lea edx, [ebp - 0x9c54]
mov ecx, ebx
mov eax, dword [ebp - 8]
call fcn.0043b844
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x4f67a7
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0043b63c
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0043b5d8
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0043b5d8
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0043b87c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f688d
mov eax, dword [ebp - 0xc]
call fcn.00405764
mov eax, dword [ebp - 8]
call fcn.00405764
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f68aa
lea eax, [ebp - 4]
call fcn.004077c0
ret
Function at 0x4f6a3c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4f6b5e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4f6b39
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4f6b6c
push 0
push 4
call sub.kernel32.dll_OpenFileMappingW
mov dword [0x5cadc4], eax
cmp dword [0x5cadc4], 0
jne 0x4f6ab4
push 0
push 1
push 0
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 8]
call fcn.0041a224
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x4f6ba8
call fcn.00407cb4
mov eax, dword [ebp - 4]
push eax
call fcn.004f170c
mov cl, 1
pop edx
call fcn.004f1aac
xor eax, eax
push ebp
push 0x4f6b25
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [0x5cadc4]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edx, dword [0x542d44]
mov dword [edx], eax
mov eax, dword [0x542d44]
cmp dword [eax], 0
jne 0x4f6b1b
push 0
push 1
push 0
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x10]
call fcn.0041a224
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x4f6be8
call fcn.00407cb4
mov eax, dword [ebp - 0xc]
push eax
call fcn.004f170c
mov cl, 1
pop edx
call fcn.004f1aac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f6b2f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f6b43
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6b65
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004077c8
ret
Function at 0x4fa408
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4fa686
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0xc0], 0
jne 0x4fa65d
mov eax, dword [edi + 0x34]
test eax, eax
je 0x4fa461
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4fa481
mov eax, dword [edi + 0x38]
test eax, eax
je 0x4fa471
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4fa481
mov eax, edi
call fcn.004fa73c
jmp 0x4fa65d
cmp dword [edi + 0xc4], 0
jne 0x4fa4d0
lea eax, [ebp - 0x108]
mov edx, dword [edi + 0x34]
mov ecx, 0
call fcn.00407a24
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.00415fe8
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x5caddc]
call fcn.004f9de8
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xc4], eax
cmp dword [edi + 0xc8], 0
jne 0x4fa51f
lea eax, [ebp - 0x10c]
mov edx, dword [edi + 0x38]
mov ecx, 0
call fcn.00407a24
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x101]
call fcn.00415fe8
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x5caddc]
call fcn.004f9de8
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xc8], eax
mov ecx, dword [edi + 0xc8]
mov edx, dword [edi + 0xc4]
mov eax, edi
call fcn.004fa77c
mov ebx, eax
test bl, bl
jne 0x4fa612
mov eax, dword [edi + 0x34]
test eax, eax
je 0x4fa548
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4fa562
mov eax, dword [edi + 0xb8]
test eax, eax
je 0x4fa55b
sub eax, 4
mov eax, dword [eax]
test eax, eax
sete al
jmp 0x4fa564
xor eax, eax
test al, al
jne 0x4fa612
mov eax, dword [edi + 0xb8]
test eax, eax
je 0x4fa57b
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x4fa5a8
lea eax, [ebp - 0x110]
mov edx, dword [edi + 0xb8]
mov ecx, 0
call fcn.00407a24
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 0x101]
call fcn.00415fe8
jmp 0x4fa5ea
push dword [edi + 0x34]
push 0x4fa6a4
push dword [edi + 0x38]
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.00407d98
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov ecx, 0
call fcn.00407a24
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 0x101]
call fcn.00415fe8
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x4fa612
mov ecx, dword [edi + 0xc8]
mov edx, dword [edi + 0xc4]
mov eax, edi
call fcn.004fa77c
mov ebx, eax
test bl, bl
jne 0x4fa61f
mov eax, edi
call fcn.004fa73c
jmp 0x4fa65d
mov eax, dword [edi + 0x58]
test eax, eax
je 0x4fa62e
mov dword [edi + 0xa0], eax
jmp 0x4fa638
mov dword [edi + 0xa0], 1
mov eax, edi
call fcn.004fa800
test al, al
je 0x4fa65d
mov eax, edi
mov si, 0xffef
call fcn.004059f0
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.004face4
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fa68d
lea eax, [ebp - 0x118]
call fcn.004077c0
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.00406a64
ret
Function at 0x500624
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x50063c
add esp, 0xfffffff0
call fcn.00405c98
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x500756
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.00404280
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x500740
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.004c50b0
xor eax, eax
push ebp
push 0x50072d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.004c50b0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00407a48
jmp 0x5006fe
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.00407ff0
mov eax, dword [ebx + 4]
call fcn.00407b50
dec eax
jle 0x500712
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x5006ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x500734
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50075d
lea eax, [ebp - 4]
call fcn.0040739c
ret

Function at 0x504ce8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.004077d0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
call fcn.0040785c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x504d55
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
push 0x504d5c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x504d55
mov eax, dword [ebp + 8]
push eax
mov edx, ebx
mov eax, esi
call fcn.00504bb4
pop ecx
pop esi
pop ebx
pop ebp
ret