joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415b10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
push ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
push esi
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
push 0
push dword [esp + 0x34]
movlpd qword [esp + 0x14], xmm0
push dword [esp + 0x34]
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
sete bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x415b89
cmp eax, 0x3e5
jne 0x415b89
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
test bl, bl
jne 0x415b9b
pop esi
xor al, al
pop ebx
add esp, 0x14
ret 0x14
test bl, bl
jne 0x415b7f
test eax, eax
jne 0x415b7f
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov eax, dword [esp + 8]
test eax, eax
je 0x415bae
cmp eax, 0x103
je 0x415bae
test ecx, ecx
je 0x415b7f
pop esi
mov al, 1
pop ebx
add esp, 0x14
ret 0x14

Function at 0x416450
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443a00
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x466df4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x284]
lea ecx, [esi + 0x284]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x416562
push 0
push dword [esi + 0x288]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x416562
mov dword [ebp - 0x18], 0x4477bc
mov dword [ebp - 0x14], 0
push 1
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.004031f0
push 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004032d0
test al, al
je 0x416539
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push dword [esi + 0x288]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x416501
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
inc eax
push eax
call fcn.0040cba0
test eax, eax
je 0x416539
mov ecx, dword [ebp - 0x10]
push ecx
push dword [ebp - 0x1c]
inc ecx
push ecx
push eax
call fcn.0040bd60
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.0040cea0
push eax
lea ecx, [esi + 0x34]
call fcn.0040c860
mov bl, al
jmp 0x41653b
xor bl, bl
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.004032b0
lea ecx, [ebp - 0x18]
call fcn.0040c7b0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416710
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443a2b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x466df4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x4167f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 3
je 0x416770
sub eax, 2
je 0x4167e1
sub eax, 0xc9
jne 0x416815
push 0
push 0x108
push 2
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x234]
call fcn.00403220
mov eax, dword [ebp - 0x224]
xor ecx, ecx
mov word [eax], cx
push ebx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x234]
push esi
call fcn.004089e0
test al, al
je 0x4167fc
push 0x80
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4167fc
push dword [ebp - 0x224]
call edi
test eax, eax
je 0x4167fc
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 1
call fcn.004032b0
mov al, 1
jmp 0x41681d
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x416815
push esi
call edi
test eax, eax
je 0x416815
mov al, 1
jmp 0x41681d
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 2
call fcn.004032b0
mov dword [ebp - 4], 0xffffffff
push esi
mov ecx, ebx
call fcn.00405760
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422f50
mov esp, ebp
pop ebp
ret

Function at 0x417340
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x1cc]
lea ecx, [esi + 0x1cc]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x417366
push 0
push dword [esi + 0x1d0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
ret
Function at 0x417370
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x430]
sub esp, 0x430
push 0xffffffffffffffff
push 0x443af8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x466df4]
xor eax, ebp
mov dword [ebp + 0x42c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test byte [esi + 0x17], 1
je 0x4174e7
cmp dword [0x468df0], 0
je 0x4174e7
cmp dword [0x468df8], 0
je 0x4174e7
push 0
push 0x108
push 2
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp]
call fcn.00403220
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
push 0x208
push ecx
lea eax, [ebp + 0x224]
mov dword [ebp - 4], ecx
push eax
call fcn.00424c20
add esp, 0xc
lea ecx, [ebp]
push 0
call fcn.004080b0
push 0x44b6ec
lea ecx, [ebp]
call fcn.00408630
lea ecx, [ebp]
call fcn.00407dc0
push 0
lea eax, [ebp + 0x224]
push 0
push eax
call fcn.00404640
add esp, 4
lea ecx, [ebp]
push eax
call fcn.00407910
push 1
push 0x44bd58
lea ecx, [ebp]
call fcn.00408550
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0x10]
mov edi, 0x104
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
test ebx, ebx
je 0x4174d8
cmp dword [0x468df8], 2
mov eax, 0x106
push 0
push 0
push 0
cmove edi, eax
push edi
push ebx
push dword [esi + 0x37c]
push dword [esi + 0x360]
call dword [0x468df0]
test eax, eax
jne 0x4174d1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x4174d1
cmp byte [0x4ea458], 0
je 0x4174d1
cmp byte [0x4ea4a0], 0
je 0x4174d1
push str.Debugger:_MiniDump_Failed_to_write._n
push 0
push 8
push 0x46a400
call fcn.00419900
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp]
mov dword [ebp - 4], 1
call fcn.004032b0
push 1
push dword [esi + 0x360]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esi + 0x360], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x42c]
xor ecx, ebp
call fcn.00422f50
lea esp, [ebp + 0x430]
pop ebp
ret
Function at 0x417bc0
Capabilities:
Get disk size
Get file size
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x228]
sub esp, 0x228
push 0xffffffffffffffff
push 0x443bb8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x466df4]
xor eax, ebp
mov dword [ebp + 0x224], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x230]
mov eax, dword [ebp + 0x234]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x44adcc
push 0
push 0x108
push 2
lea eax, [ebp + 0x14]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp]
call fcn.00403220
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.004088d0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x417d49
mov edi, dword [ebp - 0x28]
lea ecx, [ebp - 0x14]
imul edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
push 0
push 3
push 3
mov eax, dword [eax + 0x30]
push 0xc0000000
push ebx
mov dword [ebp - 0x18], edi
call eax
test al, al
je 0x417d49
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, 0xffffffff
jne 0x417cc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x417cc1
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
lea ecx, [ebp - 0x44]
push 1
call fcn.004031f0
push 1
push edi
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.004032d0
test al, al
je 0x417d36
mov eax, esi
or eax, ebx
je 0x417d1d
nop word [eax + eax]
test ebx, ebx
jl 0x417cfa
jg 0x417cfc
cmp esi, edi
ja 0x417cfc
mov edi, esi
push 0
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 0x34]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, edi
mov edi, dword [ebp - 0x18]
mov eax, esi
sbb ebx, 0
or eax, ebx
jne 0x417cf0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 3
call fcn.004032b0
mov bl, 1
jmp 0x417d54
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 5
call fcn.004032b0
mov ebx, dword [ebp - 0x30]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
push ebx
call fcn.00405760
mov bl, al
lea ecx, [ebp]
mov byte [ebp - 4], 6
call fcn.004032b0
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 7
mov dword [ebp - 0x14], vtable.HandleClass.0
call fcn.00414da0
test al, al
je 0x417d8c
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
call dword [eax + 0x1c]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.00422f50
lea esp, [ebp + 0x228]
pop ebp
ret
Function at 0x418000
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
push ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
push esi
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
push 0
push dword [esp + 0x34]
movlpd qword [esp + 0x14], xmm0
push dword [esp + 0x34]
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
sete bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x418079
cmp eax, 0x3e5
jne 0x418079
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
test bl, bl
jne 0x41808b
pop esi
xor al, al
pop ebx
add esp, 0x14
ret 0x14
test bl, bl
jne 0x41806f
test eax, eax
jne 0x41806f
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
cmp dword [esp + 8], 0
je 0x418096
test ecx, ecx
je 0x41806f
pop esi
mov al, 1
pop ebx
add esp, 0x14
ret 0x14

Function at 0x419070
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443d00
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x466df4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0x80050]
push 0
push esi
call fcn.00414b50
add esp, 8
test eax, eax
je 0x4190dc
cmp dword [edi + 0x80010], 0
je 0x4190d1
push 0
push esi
call fcn.00414b50
push eax
push 0x44c5c0
push 0
push 0xffffffffffffffff
push edi
call fcn.00419900
add esp, 0x1c
jmp 0x4190dc
push str.Messages_missed__likely_during_startup._r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [edi + 0x8003c]
call fcn.0040c7b0
lea ecx, [edi + 0x80020]
call fcn.00406cb0
lea ecx, [edi + 0x8000c]
mov dword [ebp - 4], 0
call fcn.00419170
lea ecx, [edi + 0x8000c]
mov byte [ebp - 4], 1
call fcn.004032b0
mov ecx, edi
call fcn.004037a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41b570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
je 0x41b5ac
call fcn.00413f80
push eax
mov eax, dword [esi + 0x14]
lea ecx, [esi + 0x2c]
add eax, eax
push eax
call fcn.004034c0
test al, al
je 0x41b6f7
push 0
push 0x8800
lea ecx, [esi + 0x40]
call fcn.004032d0
test al, al
je 0x41b6f7
mov ecx, dword [esi + 0x50]
mov eax, dword [esi + 0x14]
add ecx, 0x400
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x3c]
mov dword [esi + 4], eax
lea eax, [ecx + 0x8000]
mov dword [esi + 0x10], 0
mov dword [esi + 0x74], ecx
mov dword [esi + 0x78], eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0x80], ecx
mov dword [esi + 0x7c], ecx
mov dword [esi + 0xa4], 1
mov dword [esi + 0xc], 1
nop word [eax + eax]
cmp dword [esi + 0x18], 0
je 0x41b680
mov ecx, esi
call fcn.0041bb90
mov edx, dword [esi + 0x14]
mov dword [esi + 0x10], eax
sub edx, dword [esi + 0x1c]
je 0x41b674
mov ecx, dword [esi + 8]
push 0x465210
push edx
push dword [esi + 0x3c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x94]
call eax
test al, al
je 0x41b66d
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x14]
shr eax, 0xd
test al, 1
jne 0x41b66d
mov eax, dword [esi + 0x3c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x1c], eax
jmp 0x41b674
mov dword [esi + 0x10], 0xffffffff
cmp dword [esi + 0x10], 0
je 0x41b620
nop word [eax + eax]
mov ecx, esi
call fcn.0041bb90
mov edx, dword [esi + 0x14]
mov dword [esi + 0x10], eax
sub edx, dword [esi + 0x1c]
je 0x41b6d5
mov ecx, dword [esi + 8]
push 0x465210
push edx
push dword [esi + 0x3c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x94]
call eax
test al, al
je 0x41b6ce
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x14]
shr eax, 0xd
test al, 1
jne 0x41b6ce
mov eax, dword [esi + 0x3c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x41b680
jmp 0x41b6d8
mov dword [esi + 0x10], 0xffffffff
mov eax, dword [esi + 0x10]
test eax, eax
je 0x41b713
cmp eax, 1
je 0x41b713
mov eax, dword [esp + 8]
push dword [esp + 0xc]
push str.Decompression_error_in___s_._File_may_be_corrupted
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
add esp, 0xc
mov eax, dword [esi + 0xac]
lea ecx, [esi + 0xac]
mov dword [esi + 0x10], 0xfffffffc
call dword [eax + 0xc]
xor al, al
pop esi
ret 8
mov eax, dword [esi + 0xac]
lea ecx, [esi + 0xac]
call dword [eax + 0xc]
mov al, 1
pop esi
ret 8
Function at 0x41c7a0
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x228]
sub esp, 0x228
push 0xffffffffffffffff
push 0x4432d8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x466df4]
xor eax, ebp
mov dword [ebp + 0x224], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x230]
lea ecx, [ebp]
mov ebx, dword [ebp + 0x234]
push 0
push 0x108
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
push 2
push eax
call fcn.00403220
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
push 0x5c
push ebx
mov dword [ebp - 4], ecx
call fcn.0040be20
mov esi, eax
push esi
call fcn.0040bc90
add esp, 0xc
lea ecx, [ebp]
mov edi, eax
push 0xffffffffffffffff
push esi
call fcn.00408720
cmp edi, 4
jbe 0x41c837
mov ecx, dword [ebp + 0x10]
xor eax, eax
mov word [ecx + edi*2 - 8], ax
mov esi, dword [ebp - 0x10]
push esi
push dword [0x4ea814]
push ebx
call fcn.004224a0
push 0x7530
push dword [ebp + 0x10]
push esi
call fcn.0041edb0
push 0
push dword [ebp + 0x10]
push esi
call fcn.0041e780
add esp, 0x24
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 2
nop word [eax + eax]
push 0xffffffffffffffff
push ebx
lea ecx, [ebp]
call fcn.00408720
lea ecx, [ebp]
sub edi, 1
je 0x41c89a
call fcn.004080a0
jmp 0x41c8aa
call fcn.004080a0
push 0x2e
push eax
call fcn.00425aa7
add esp, 8
mov esi, eax
test esi, esi
je 0x41c8d5
push esi
call fcn.0040bcc0
push eax
lea eax, [esi + 2]
push esi
push eax
call fcn.00406ca0
add esp, 0x10
mov eax, 0x5f
mov word [esi], ax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
jne 0x41c880
push ebx
lea ecx, [ebp]
call fcn.00408850
lea ecx, [ebp]
call fcn.004080a0
push 0x5f
lea ecx, [ebp]
mov esi, eax
call fcn.00407770
mov eax, dword [ebp - 0x10]
push edi
push esi
push eax
call fcn.0041e780
add esp, 0xc
lea ecx, [ebp]
push 1
push 0x44d520
call fcn.00408550
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call esi
push 0xffffffffffffffff
push ebx
lea ecx, [ebp]
call fcn.00408720
push 1
push str.snap
lea ecx, [ebp]
call fcn.00408550
push dword [ebp + 0x10]
call esi
lea ecx, [ebp]
mov dword [ebp - 4], 1
call fcn.004032b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.00422f50
lea esp, [ebp + 0x228]
pop ebp
ret
Function at 0x41e490
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4440f8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x466df4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
push eax
push 0
push 8
mov word [ebp - 0x14], 0x500
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41e507
call esi
cmp eax, 0x3f0
jne 0x41e529
lea eax, [ebp - 0x20]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41e529
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 2
push dword [ebp - 0x20]
call edi
test eax, eax
je 0x41e530
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x41e5f1
call esi
cmp eax, 0x7a
jne 0x41e520
push 1
lea ecx, [ebp - 0x3c]
call fcn.004031f0
push 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0
call fcn.004032d0
test al, al
je 0x41e5d5
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push ebx
push 2
push dword [ebp - 0x20]
call edi
test eax, eax
je 0x41e5d5
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x41e5d5
xor esi, esi
mov byte [ebp - 0x19], 0
cmp dword [ebx], esi
jbe 0x41e5ba
lea edi, [ebx + 4]
push dword [ebp - 0x28]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x41e5d1
inc esi
add edi, 8
cmp esi, dword [ebx]
jb 0x41e5a3
mov bl, byte [ebp - 0x19]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41e5e0
mov bl, 1
jmp 0x41e5bd
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 2
call fcn.004032b0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422f50
mov esp, ebp
pop ebp
ret
Function at 0x421a00
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x228]
sub esp, 0x228
push 0xffffffffffffffff
push 0x444420
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x466df4]
xor eax, ebp
mov dword [ebp + 0x224], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x230]
mov ebx, dword [ebp + 0x234]
push 0
push edi
mov dword [ebp - 0x18], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x421b6f
push 1
lea ecx, [ebp - 0x2c]
call fcn.004031f0
push 0
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.004032d0
test al, al
je 0x421b57
push dword [ebp - 0x1c]
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x421b2e
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
push str.StringFileInfo040904B0FileDescription
push dword [ebp - 0x1c]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x421afe
cmp dword [ebp - 0x10], 0
je 0x421acb
push dword [ebp - 0x14]
mov ecx, ebx
call fcn.0040cc50
jmp 0x421ae1
mov eax, dword [vtable.ErrorClass.0]
mov ecx, 0x465210
push 0
push str.Could_not_retrieve_File_Description
mov eax, dword [eax + 4]
call eax
mov bl, al
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.004032b0
mov dword [ebp - 4], 0xffffffff
jmp 0x421b87
mov eax, dword [vtable.ErrorClass.0]
mov ecx, 0x465210
push 0
push str.File_Description_could_not_be_found_in_the_Version_resource
mov eax, dword [eax + 4]
call eax
mov bl, al
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 2
call fcn.004032b0
mov dword [ebp - 4], 0xffffffff
jmp 0x421b87
push str.Could_not_retrieve_Version_information_for_the_running_binary
mov ecx, 0x465210
call fcn.00405760
mov bl, al
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 3
call fcn.004032b0
mov dword [ebp - 4], 0xffffffff
jmp 0x421b87
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 4
call fcn.004032b0
mov dword [ebp - 4], 0xffffffff
jmp 0x421b92
mov eax, dword [vtable.ErrorClass.0]
mov ecx, 0x465210
push 0
push str.Version_resource_is_not_present_in_the_running_binary
mov eax, dword [eax + 4]
call eax
mov bl, al
test bl, bl
je 0x421b8f
mov al, 1
jmp 0x421bf0
mov ebx, dword [ebp - 0x18]
push 0
push 0x108
push 2
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp]
call fcn.00403220
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
push 0xffffffffffffffff
push edi
lea ecx, [ebp]
mov dword [ebp - 4], 6
call fcn.00408720
test al, al
je 0x421bdd
lea ecx, [ebp]
call fcn.004080a0
push eax
mov ecx, ebx
call fcn.0040cc50
test al, al
je 0x421bdd
mov bl, 1
jmp 0x421bdf
xor bl, bl
lea ecx, [ebp]
mov dword [ebp - 4], 7
call fcn.004032b0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.00422f50
lea esp, [ebp + 0x228]
pop ebp
ret