joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c3f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x6d89fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x6c4002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.006c7dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x6c4002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.006bf6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.006c820b
push 0x10
call fcn.006c81d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x6c3fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.006b41c0
jmp 0x6c3fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.006c3b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x6c3ff0
mov ecx, edi
call fcn.006b42c0
push edi
call fcn.006c81c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x6c4021
inc ebx
cmp ebx, 0x20
jb 0x6c3f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x6c5250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6d9808
push 0x6c9288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x6c5329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x6c5329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.006c81d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x6c5329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x6c5329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x6c532c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.006c5351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6c5d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x6c5d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x6c5d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x6c5d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x6c5d94
push eax
push esi
call fcn.006c820b
add esp, 8
pop esi
ret 0x10

Function at 0x6c5da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6c5e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x6c5e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x6de320
push ecx
mov dword [esp + 0x1c], 4
call fcn.006c7dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x6c5dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x6c5e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6c5ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x6c5eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x6de320
push ecx
mov dword [esp + 0x1c], 4
call fcn.006c7dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x6c5eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x6c5e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x6c6000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x6c6131
push esi
call fcn.006c9145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.006b8080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x6c6131
push 0
push ebp
call fcn.006b83a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.006b8260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x6c608b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.006b82f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x6c6121
push 0x6de918
push edi
call fcn.006c73f0
push eax
push ebx
push esi
call fcn.006c5f60
push 0x6de8f8
push edi
call fcn.006c73f0
push eax
push ebx
push esi
call fcn.006c5f60
push 0x6de8d8
push edi
call fcn.006c73f0
push eax
push ebx
push esi
call fcn.006c5f60
push 0x6de8c0
push edi
call fcn.006c73f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.006c5f60
push 0x6de8a0
push edi
call fcn.006c73f0
push eax
push ebx
push esi
call fcn.006c5f60
push 0x6de888
push edi
call fcn.006c73f0
push eax
push ebx
push esi
call fcn.006c5f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6c71b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006c7140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006c7140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006c7140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006c7140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6c7bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6c7c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6d987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6c7c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6c7c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x401000
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
call fcn.00402900
push 0x200
lea eax, [esi + 4]
push 0
push eax
call fcn.0040c0e0
push 0x200
lea ecx, [esi + 0x204]
push 0
push ecx
call fcn.0040c0e0
push 0x80
lea edx, [esi + 0x408]
push 0
push edx
call fcn.0040c0e0
push 0x80
lea eax, [esi + 0x488]
push 0
push eax
call fcn.0040c0e0
push 0x80
lea ecx, [esi + 0x50a]
push 0
push ecx
call fcn.0040c0e0
xor eax, eax
mov dword [esi + 0x58c], eax
mov dword [esi + 0x590], eax
mov dword [esi + 0x594], eax
mov dword [esi + 0x598], eax
mov dword [esi + 0x59c], eax
mov dword [esi + 0x5a0], eax
mov dword [esi + 0x5a4], eax
mov dword [esi + 0x5a8], eax
mov dword [esi + 0x9bc], eax
mov dword [esi + 0x9c0], eax
mov dword [esi + 0x9c4], eax
mov dword [esi + 0x9c8], eax
add esp, 0x3c
mov dword [esi + 0x9cc], eax
lea edx, [esi + 0x5ac]
mov dword [esi + 0x9d0], eax
push edx
mov dword [esi + 0x9d4], eax
push 0x104
mov dword [esi + 0x9d8], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x104
lea eax, [esi + 0x7b4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, esi
pop esi
ret

Function at 0x401100
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push 0x206
xor ebx, ebx
lea ecx, [esp + 0x12]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x18], ax
call fcn.0040c0e0
add esp, 0xc
mov dword [esp + 4], ebx
cmp edi, ebx
je 0x401221
cmp esi, ebx
je 0x401221
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401150
sub eax, edx
sar eax, 1
je 0x401221
cmp dword [esp + 0x220], ebx
je 0x401175
lea edx, [esp + 0xc]
push edx
jmp 0x4011af
mov eax, dword [esp + 0x21c]
cmp dword [eax], 3
jne 0x4011aa
push 0x104
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41dccc
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.00408fc5
add esp, 0xc
jmp 0x4011ba
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.00408fc5
push 0x41dcd0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00409108
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, ebx
je 0x401221
push eax
push 1
push 0x200
push edi
call fcn.004093fb
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040948f
add esp, 0x14
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00408fb6
add esp, 0x214
ret 8
mov ecx, dword [esp + 0x214]
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00408fb6
add esp, 0x214
ret 8
Function at 0x4012b0
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push 0x206
xor esi, esi
lea ecx, [esp + 0x12]
xor eax, eax
push esi
push ecx
mov word [esp + 0x18], ax
call fcn.0040c0e0
add esp, 0xc
cmp edi, esi
je 0x401398
mov eax, 0x41dcd8
mov dword [esp + 4], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4012f5
sub eax, edx
sar eax, 1
je 0x40131f
push 0x41dcdc
lea edx, [esp + 8]
push 0x41dcd8
push edx
call fcn.00409108
add esp, 0xc
jmp 0x40135a
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41dc98
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.00408fc5
push 0x41dcdc
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00409108
add esp, 0x18
mov eax, dword [esp + 4]
cmp eax, esi
je 0x40137d
push eax
push 1
push 0x200
push edi
call fcn.0040966d
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040948f
add esp, 0x14
mov eax, 1
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00408fb6
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00408fb6
add esp, 0x214
ret

Function at 0x4013b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0x208], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.0040c0e0
mov edx, dword [esp + 0x21c]
add esp, 0xc
cmp dword [edx], 3
jne 0x401413
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41dccc
lea ecx, [esp + 4]
push 0x104
push ecx
call fcn.00408fc5
add esp, 0xc
jmp 0x401422
lea edx, [esp]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea eax, [esp + 4]
push eax
push 0x41dce4
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [esp + 0x218]
add esp, 0x10
xor ecx, esp
call fcn.00408fb6
add esp, 0x20c
ret 4

Function at 0x401450
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 3
push 0
push 0x41dcf8
push closesocket
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4014b6
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401480
sub eax, edx
mov edx, dword [esp]
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push 0
push 0x41dd64
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4014b6
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
Function at 0x402240
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc0c
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0xc08], eax
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.00402850
push 0x206
lea ecx, [esp + 0xa0e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0xa14], ax
call fcn.0040c0e0
add esp, 0xc
mov esi, 0x422060
call fcn.00402900
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x28]
call fcn.00401000
lea ebx, [esp + 0x28]
call fcn.004014c0
test eax, eax
je 0x4022cb
call fcn.00403370
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x4230e0
push 0x67
push edi
call esi
push 0x64
push 0x423018
push 0x6d
push edi
call esi
mov eax, edi
call fcn.00402430
push 0
push edi
push 0
push 0
push 0
push closesocket
push 0
push closesocket
push 0xcf0000
push 0x4230e0
push 0x423018
push 0
mov dword [0x4231a8], edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x40232f
call fcn.004024c0
test eax, eax
jne 0x402348
mov ecx, dword [esp + 0xc14]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00408fb6
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov eax, dword [0x423828]
test eax, eax
jbe 0x402380
cmp word [0x42382c], 0
jbe 0x402380
push eax
mov esi, 0x42206c
call fcn.00403bb0
mov dx, word [0x42382c]
add esp, 4
mov word [0x42207c], dx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov eax, edx
xor edx, edx
shr eax, 6
mov ecx, 0x3e8
div ecx
push edx
push 0x41de14
mov edx, 0x423da0
call fcn.00402830
call fcn.00403c90
lea esi, [esp + 0xa10]
call fcn.00403c30
push 0x41dccc
mov edx, esi
push 0x104
push edx
call fcn.00408fc5
add esp, 0x14
push 0x423da0
mov eax, esi
push 0x104
push eax
call fcn.00408fc5
add esp, 0xc
mov ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402417
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0x41dcd8
mov edx, esi
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00401fb0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4024c0
Capabilities:
Create thread
Initialize winsock library

Disassembly:
sub esp, 0x3e8
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0x3e0], eax
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1e2]
push ecx
mov word [esp + 0x1e4], ax
call fcn.0040c0e0
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, 0x4239a0
call fcn.00402a10
test eax, eax
jne 0x4025f9
push 0x3a
push eax
lea ecx, [esp + 0x1a6]
push ecx
mov word [esp + 0x1a8], ax
call fcn.0040c0e0
add esp, 0xc
lea edi, [esp + 0x19c]
call fcn.00403600
xor eax, eax
movzx ecx, word [esp + eax + 0x19c]
mov word [eax + 0x423b48], cx
add eax, 2
test cx, cx
jne 0x402540
push 0x41ddb8
push 0x40
push 0x4239a4
call fcn.004096ef
add esp, 0xc
push 0x41ddd4
push 0x10
push 0x423a26
call fcn.004096ef
add esp, 0xc
push 0x41dd9c
push 0x40
push 0x423a46
call fcn.004096ef
mov eax, 0x2b70
mov edx, 0x51
add esp, 0xc
mov word [0x423ac6], ax
mov word [0x423a24], dx
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x19c]
mov word [eax + 0x423b28], cx
add eax, 2
test cx, cx
jne 0x4025b0
mov eax, 0x423b28
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4025d0
mov ecx, dword [0x41de2c]
mov dx, word [0x41de30]
mov dword [eax], ecx
mov word [eax + 4], dx
mov dword [0x423b68], 5
call fcn.004036a0
lea edi, [esp + 0x1d8]
call fcn.00403600
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x1d8]
mov word [eax + 0x423960], cx
add eax, 2
test cx, cx
jne 0x402610
push 0x423960
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x40265c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.00408fb6
add esp, 0x3e8
ret
push 0x423960
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x402644
push 0x41dd9c
call fcn.00403750
add esp, 4
mov edi, 0x423ba0
mov dword [0x423828], eax
call fcn.00401e30
mov eax, dword [0x423b6c]
push 0
push 0
push 0
push 0x403af0
push 0
push 0
mov dword [0x423ba8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x3e4]
pop edi
xor ecx, esp
mov eax, 1
call fcn.00408fb6
add esp, 0x3e8
ret

Function at 0x402850
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
mov eax, 0x41dcd8
mov dword [esp], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402862
sub eax, edx
sar eax, 1
jne 0x402879
xor eax, eax
add esp, 0x18
ret
push 0x41dcdc
lea eax, [esp + 4]
push 0x41dcd8
push eax
call fcn.00409108
add esp, 0xc
test eax, eax
jne 0x402873
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov word [esp + 0x14], ax
mov eax, dword [esp]
push eax
mov ecx, 0x4d42
push 1
mov word [esp + 0x10], cx
lea ecx, [esp + 0x10]
add edx, 0xe
push 0xe
push ecx
mov dword [esp + 0x1a], edx
mov dword [esp + 0x22], 0x36
call fcn.0040966d
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edx
push 1
push eax
push ecx
call fcn.0040966d
mov edx, dword [esp + 0x20]
push edx
call fcn.0040948f
add esp, 0x24
mov eax, 1
add esp, 0x18
ret
Function at 0x402900
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0x11c], eax
push 0x118
lea eax, [esp + 8]
push 0
push eax
mov dword [esi], 0
call fcn.0040c0e0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4029fa
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x4029c7
mov eax, dword [esp + 8]
test eax, eax
jne 0x402983
cmp word [esp + 0x114], 4
jb 0x4029fa
mov dword [esi], 1
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00408fb6
add esp, 0x120
ret
cmp eax, 2
jne 0x4029a5
mov dword [esi], eax
mov dword [esi], 3
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00408fb6
add esp, 0x120
ret
jae 0x4029ac
cmp eax, 1
jne 0x4029fa
mov dword [esi], 3
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00408fb6
add esp, 0x120
ret
cmp eax, 6
jne 0x4029fa
mov eax, dword [esp + 8]
test eax, eax
jne 0x4029ef
mov dword [esi], 4
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00408fb6
add esp, 0x120
ret
cmp eax, 1
jne 0x4029fa
mov dword [esi], 5
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00408fb6
add esp, 0x120
ret

Function at 0x402ac0
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.0040c0e0
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0x402b8f
mov eax, 0x41dc98
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402b05
sub eax, edx
sar eax, 1
je 0x402b8f
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41dc98
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.00408fc5
push 0x41dcd0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00409108
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x402b8f
push eax
push 1
push 0x200
push esi
call fcn.004093fb
mov eax, dword [esp + 0x14]
push eax
call fcn.0040948f
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00408fb6
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.00408fb6
add esp, 0x214
ret

Function at 0x402c80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x218
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.0040c0e0
add esp, 0xc
push 0x104
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx eax, word [esp + 8]
sub eax, 0x41
push eax
lea ebx, [esp + 8]
call fcn.00402ed0
mov ebx, dword [esp + 8]
add esp, 4
call fcn.00402fe0
cmp eax, 0xffffffff
jne 0x402d02
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00408fb6
add esp, 0x218
ret
push esi
call fcn.00402bb0
mov ecx, dword [esp + 0x218]
add esp, 4
pop ebx
xor ecx, esp
call fcn.00408fb6
add esp, 0x218
ret