joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a6da
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41a6f1
test al, 0x10
je 0x41a6f1
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x41a84e
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x35c
mov eax, dword [0x5065d0]
xor eax, esp
mov dword [esp + 0x358], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [esp + 0x25d]
push ebx
push eax
mov byte [esp + 0x264], bl
call fcn.004ab5d0
push esi
lea eax, [esp + 0x161]
push ebx
push eax
mov byte [esp + 0x168], bl
call fcn.004ab5d0
push 0x13c
lea eax, [esp + 0x30]
push ebx
push eax
mov dword [esp + 0x34], ebx
call fcn.004ab5d0
add esp, 0x24
cmp edi, ebx
je 0x41a993
cmp byte [edi], bl
je 0x41a993
push edi
lea ecx, [esi + 1]
lea eax, [esp + 0x25c]
call fcn.00476b6c
push eax
lea eax, [esp + 0x158]
push eax
call fcn.004aa9a0
add esp, 0xc
lea esi, [esp + 0x150]
call fcn.00476e69
mov eax, dword [0x51eac8]
lea ecx, [eax + 0xf]
mov eax, dword [0x51eac4]
cmp eax, ecx
jle 0x41a90b
mov dword [0x51eac8], eax
inc eax
mov dword [0x51eac4], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
dec dword [0x51eac4]
mov esi, eax
cmp esi, 0xffffffff
je 0x41a993
cmp byte [esp + 0x3c], 0x2e
je 0x41a97c
lea edx, [esp + 0x3c]
call fcn.00476b3a
test eax, eax
jne 0x41a97c
cmp byte [esp + 0x150], 0x2a
jne 0x41a9ac
cmp byte [esp + 0x152], 0x2a
jne 0x41a9ac
cmp byte [esp + 0x151], 0x3f
je 0x41a9ac
movsx eax, byte [esp + 0x151]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.004ad070
test eax, eax
pop ecx
pop ecx
jne 0x41a9ac
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41a931
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov ecx, dword [esp + 0x364]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004aaeb5
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x41a995
Function at 0x41a9b8
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp + 0x90], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], ebx
je 0x41aaed
cmp byte [edi], 0x30
je 0x41aaed
mov esi, 0x104
push esi
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.004ab5d0
push edi
mov ecx, esi
lea eax, [ebp - 0x74]
call fcn.00476b6c
push 0x22
mov edi, eax
call fcn.004774f1
add esp, 0x14
cmp dword [ebp + 0x9c], ebx
jbe 0x41aa41
push 0xf83
push str..File.c
mov eax, edi
push eax
push 0x41ab36
push ebx
mov ecx, str.CreateDirectorySuper
call fcn.0041cd43
mov esi, eax
jmp 0x41aa43
xor esi, esi
cmp esi, ebx
jne 0x41aa77
push ebx
push dword [ebp - 0x7c]
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
cmp eax, ebx
je 0x41aa72
cmp eax, 0x50
je 0x41aa72
cmp eax, 0xb7
je 0x41aa72
cmp eax, 0x4c7
je 0x41aa72
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x41aaed
xor eax, eax
inc eax
jmp 0x41aaef
call fcn.0049c471
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x78], ebx
jmp 0x41aaab
cmp dword [ebp - 0x78], 0x103
jne 0x41aac5
call fcn.0049c471
sub eax, dword [ebp - 0x80]
cmp eax, dword [ebp + 0x9c]
ja 0x41aab8
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x78]
push eax
push esi
call edi
test eax, eax
jne 0x41aa8a
jmp 0x41aac5
mov dword [ebp - 0x78], ebx
mov dword [0x51eac0], 0x5b4
call fcn.0041cef3
push dword [0x51eac0]
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
call esi
cmp dword [ebp - 0x78], ebx
jne 0x41aa72
mov eax, dword [ebp - 0x7c]
call fcn.0041ab07
push dword [0x51eac0]
call esi
xor eax, eax
mov ecx, dword [ebp + 0x90]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aaeb5
add ebp, 0x94
leave
ret
Function at 0x41abf9
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
mov eax, dword [0x5065d0]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push esi
mov esi, edx
push edi
mov ebx, ecx
mov dword [esp + 0x10], esi
call fcn.00476b3a
test eax, eax
je 0x41ac3e
xor eax, eax
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004aaeb5
mov esp, ebp
pop ebp
ret
call fcn.0049c471
push ebx
mov edi, 0x80
push edi
mov dword [esp + 0x1c], eax
push 3
push closesocket
mov eax, esi
call fcn.00418dab
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x41accb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
mov esi, eax
je 0x41ac7f
call fcn.0049c471
sub eax, dword [esp + 0x14]
cmp eax, ebx
jae 0x41acbf
mov eax, dword [esp + 0x10]
push ebx
push edi
push 3
push 0x2000000
call fcn.00418dab
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x41accb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
mov esi, eax
je 0x41acb4
call fcn.0049c471
sub eax, dword [esp + 0x14]
cmp eax, ebx
jae 0x41acbf
mov ecx, dword [esp + 0x10]
push ebx
call fcn.0041a6f4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x41ac27
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x41ace8
call fcn.0041cef3
jmp 0x41ac27
cmp eax, ebx
jbe 0x41ad19
push ebx
lea eax, [esp + 0x14]
push eax
push edi
lea eax, [esp + 0x24]
push eax
push esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41ad0d
cmp dword [esp + 0x10], ebx
jne 0x41ad19
call fcn.0041cef3
mov eax, ebx
jmp 0x41ac29
mov ebx, dword [esp + 0x14]
jmp 0x41ad0d
Function at 0x41b661
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
call fcn.00476b3a
test eax, eax
je 0x41b67e
xor eax, eax
jmp 0x41b70d
mov edx, dword [ebp + 8]
xor ecx, ecx
call fcn.0041abf9
mov edi, eax
test edi, edi
je 0x41b677
mov ecx, dword [ebp + 8]
push 0x138d
push str..File.c
mov edx, 0x4c91fc
call fcn.0041c646
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
mov dword [esp + 0xc], ebx
je 0x41b677
lea eax, [edi + 0xe]
push eax
call fcn.004abb87
mov esi, eax
test esi, esi
pop ecx
jne 0x41b6ca
mov ecx, ebx
call fcn.0041ca73
jmp 0x41b677
push ebx
push edi
lea eax, [esi + 4]
push 1
push eax
call fcn.004ab915
mov ebx, eax
add esp, 0x10
cmp ebx, edi
jae 0x41b6f0
push dword [esp + 0xc]
call fcn.004ab64a
test eax, eax
pop ecx
jne 0x41b6f0
xor ebx, ebx
mov ecx, dword [esp + 0xc]
call fcn.0041ca73
test ebx, ebx
jne 0x41b709
push esi
call fcn.004aa2a8
pop ecx
jmp 0x41b677
mov dword [esi], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41b7b6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and word [ebp - 0x10], 0
push esi
push edi
mov esi, eax
xor eax, eax
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edx, esi
stosw word es:[edi], ax
call fcn.00476b3a
test eax, eax
je 0x41b7e1
xor eax, eax
jmp 0x41b863
call fcn.0049c471
mov edi, eax
lea eax, [ebp - 0x10]
push eax
call fcn.0049cee4
pop ecx
jmp 0x41b80d
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0049c471
sub eax, edi
cmp eax, 0x7530
ja 0x41b81a
xor ecx, ecx
mov edx, esi
call fcn.0041abf9
test eax, eax
ja 0x41b7f4
push 0x140e
push str..File.c
mov edx, 0x4c9338
mov ecx, esi
call fcn.0041c646
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x41b7da
push esi
push 1
push 0x14
push str.ThisIsAFileLockxxxx
call fcn.004aa5f2
push esi
push 1
lea eax, [ebp - 0x10]
push 0x10
push eax
call fcn.004aa5f2
add esp, 0x20
mov ecx, esi
mov edi, eax
call fcn.0041ca73
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x41b867
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
mov eax, dword [0x5065d0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
push 5
pop ecx
mov esi, str.ThisIsAFileLockxxxx
lea edi, [esp + 0x18]
mov dword [esp + 0x14], ebp
rep movsd dword es:[edi], dword [esi]
call fcn.0049c471
mov edx, ebp
mov dword [esp + 0x10], eax
call fcn.00476b3a
test eax, eax
jne 0x41b981
mov edi, ebp
call fcn.0041a629
test eax, eax
jne 0x41b8b8
inc eax
jmp 0x41b983
push 0x1493
mov ebx, str..File.c
mov edi, 0x4c91fc
push ebx
mov edx, edi
mov ecx, ebp
call fcn.0041c646
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x41b8f8
push 0x64
call ebp
mov ecx, dword [esp + 0x14]
push 0x1497
push ebx
mov edx, edi
call fcn.0041c646
pop ecx
pop ecx
mov esi, eax
lea eax, [esp + 0x18]
call fcn.00476abd
xor edi, edi
inc edi
test esi, esi
je 0x41b91c
push esi
push edi
push 0x14
push eax
call fcn.004ab915
add esp, 0x10
mov ecx, esi
call fcn.0041ca73
lea eax, [esp + 0x18]
push str.ThisIsAFileLockxxxx
push eax
call fcn.004abab0
test eax, eax
pop ecx
pop ecx
jne 0x41b981
mov ebx, dword [esp + 0x14]
mov eax, ebx
call fcn.0041a140
test eax, eax
je 0x41b944
mov eax, edi
jmp 0x41b983
push 0x64
call ebp
call fcn.0049c471
sub eax, dword [esp + 0x10]
mov esi, 0x2710
cmp eax, esi
jae 0x41b965
mov eax, ebx
call fcn.0041a140
test eax, eax
jne 0x41b940
push 0x64
call ebp
call fcn.0049c471
sub eax, dword [esp + 0x10]
cmp eax, esi
jae 0x41b981
mov eax, ebx
call fcn.0041a140
test eax, eax
jne 0x41b940
xor eax, eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004aaeb5
add esp, 0x20
ret

Function at 0x41b996
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
mov esi, edx
push 0
push eax
mov edi, ecx
mov dword [ebp - 0x114], esi
mov byte [ebp - 0x110], 0
call fcn.004ab5d0
add esp, 0xc
test esi, esi
je 0x41ba77
mov edx, edi
call fcn.00476b3a
test eax, eax
jne 0x41ba77
push edi
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.00476b6c
mov esi, eax
call fcn.00476e69
mov eax, esi
push edi
push eax
call fcn.004abab0
add esp, 0xc
test eax, eax
jne 0x41ba33
push edi
push eax
push eax
call fcn.0045ac28
pop ecx
pop ecx
push eax
push 0x4ca4a0
mov eax, esi
push 0x104
push eax
call fcn.004781b1
add esp, 0x14
mov edi, esi
push 0x14cc
push str..File.c
mov edx, 0x4c91fc
mov ecx, edi
call fcn.0041c646
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x41ba77
push edi
push 1
push 0x64
push dword [ebp - 0x114]
call fcn.004ab915
mov esi, eax
add esp, 0x10
neg esi
sbb esi, esi
mov ecx, edi
neg esi
call fcn.0041ca73
mov eax, esi
jmp 0x41ba79
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004aaeb5
leave
ret
Function at 0x41ba87
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x103
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x10f]
push 0
push eax
mov edi, ecx
mov byte [ebp - 0x110], 0
call fcn.004ab5d0
add esp, 0xc
mov edx, edi
call fcn.00476b3a
test eax, eax
je 0x41bad6
xor eax, eax
jmp 0x41bb76
push edi
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.00476b6c
pop ecx
mov esi, eax
call fcn.00476e69
mov eax, esi
push edi
push eax
call fcn.004abab0
test eax, eax
pop ecx
pop ecx
jne 0x41bb20
push edi
push eax
push eax
call fcn.0045ac28
pop ecx
pop ecx
push eax
push 0x4ca4a0
mov eax, esi
push 0x104
push eax
call fcn.004781b1
add esp, 0x14
mov edi, esi
cmp dword [ebp - 0x114], 0
je 0x41bb6b
push 0x14ec
push str..File.c
mov edx, 0x4c9338
mov ecx, edi
call fcn.0041c646
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x41bacf
push edi
push 1
push 0x64
push dword [ebp - 0x114]
call fcn.004aa5f2
mov esi, eax
add esp, 0x10
neg esi
sbb esi, esi
mov ecx, edi
neg esi
call fcn.0041ca73
jmp 0x41bb74
mov eax, edi
call fcn.0041a140
mov esi, eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004aaeb5
leave
ret

Function at 0x41bba1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x114], esi
mov edi, edx
mov dword [ebp - 0x118], ebx
mov byte [ebp - 0x110], bl
call fcn.004ab5d0
add esp, 0xc
cmp edi, ebx
jne 0x41bbee
lea edi, [ebp - 0x118]
mov edx, esi
call fcn.00476b3a
test eax, eax
je 0x41bc02
mov dword [edi], ebx
xor eax, eax
jmp 0x41bc9d
push esi
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.00476b6c
mov esi, eax
call fcn.00476e69
push dword [ebp - 0x114]
mov eax, esi
push eax
call fcn.004abab0
add esp, 0xc
test eax, eax
jne 0x41bc5c
push dword [ebp - 0x114]
push ebx
push ebx
call fcn.0045ac28
pop ecx
pop ecx
push eax
push 0x4ca4a0
mov eax, esi
push 0x104
push eax
call fcn.004781b1
mov eax, esi
add esp, 0x14
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
push 0x1524
push str..File.c
mov edx, 0x4c91fc
call fcn.0041c646
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
mov dword [edi], ebx
je 0x41bbfb
push esi
push 1
push 4
push edi
call fcn.004ab915
add esp, 0x10
mov ecx, esi
mov edi, eax
call fcn.0041ca73
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aaeb5
leave
ret
Function at 0x41bcac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov edi, ecx
mov byte [ebp - 0x110], 0
call fcn.004ab5d0
add esp, 0xc
mov edx, edi
call fcn.00476b3a
test eax, eax
je 0x41bcf2
xor eax, eax
jmp 0x41bd76
push edi
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.00476b6c
mov esi, eax
call fcn.00476e69
mov eax, esi
push edi
push eax
call fcn.004abab0
add esp, 0xc
test eax, eax
jne 0x41bd3c
push edi
push eax
push eax
call fcn.0045ac28
pop ecx
pop ecx
push eax
push 0x4ca4a0
mov eax, esi
push 0x104
push eax
call fcn.004781b1
add esp, 0x14
mov edi, esi
push 0x154a
push str..File.c
mov edx, 0x4c9338
mov ecx, edi
call fcn.0041c646
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x41bceb
push esi
push 1
lea eax, [ebp + 8]
push 4
push eax
call fcn.004aa5f2
add esp, 0x10
mov ecx, esi
mov edi, eax
call fcn.0041ca73
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004aaeb5
leave
ret
Function at 0x41c384
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x5065d0]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x103
lea eax, [esp + 0x15]
push ebx
push eax
mov byte [esp + 0x1c], bl
call fcn.004ab5d0
add esp, 0xc
mov edx, edi
call fcn.00476b3a
test eax, eax
je 0x41c3cf
xor eax, eax
jmp 0x41c57b
push edi
push str._s.manifest
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.004781b1
add esp, 0x10
cmp dword [ebp + 0xc], ebx
jne 0x41c40a
push 0x80
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
call fcn.0041a140
jmp 0x41c57b
push dword [ebp + 0x10]
push ebx
push edi
call fcn.0041c384
add esp, 0xc
push 0x18e2
push str..File.c
mov edx, 0x4cbe64
lea ecx, [esp + 0x18]
call fcn.0041c646
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
jne 0x41c4c1
push 0x103
lea eax, [esp + 0x11d]
push ebx
push eax
mov byte [esp + 0x124], bl
call fcn.004ab5d0
lea eax, [esp + 0x1c]
add esp, 0xc
push eax
mov ecx, 0x104
lea eax, [esp + 0x11c]
call fcn.00476b6c
pop ecx
call fcn.00476eac
push eax
call fcn.0041a6da
test eax, eax
pop ecx
jne 0x41c3c8
cmp dword [0x51ed9c], ebx
jne 0x41c3c8
push ebx
lea ecx, [esp + 0x11c]
call fcn.0041a9b8
pop ecx
push dword [ebp + 0x10]
mov dword [0x51ed9c], 1
push dword [ebp + 0xc]
push edi
call fcn.0041c384
add esp, 0xc
mov dword [0x51ed9c], ebx
jmp 0x41c57b
push str.__xml_version_1.0__encoding_UTF_8__standalone_yes___
push esi
call fcn.004ab930
push str._n_assembly_xmlns_urn:schemas_microsoft_com:asm.v1__manifestVersion_1.0__
push esi
call fcn.004ab930
push str._n___trustInfo_xmlns_urn:schemas_microsoft_com:asm.v2__
push esi
call fcn.004ab930
push str._n_____security_
push esi
call fcn.004ab930
push str._n_______requestedPrivileges_
push esi
call fcn.004ab930
push str._n_________requestedExecutionLevel
push esi
call fcn.004ab930
add esp, 0x30
cmp dword [ebp + 0x10], ebx
je 0x41c512
push str._n__________level_requireAdministrator_
jmp 0x41c517
push str._n__________level_asInvoker_
push esi
call fcn.004ab930
pop ecx
pop ecx
push str._n__________uiAccess_false___
push esi
call fcn.004ab930
push str._n________requestedPrivileges_
push esi
call fcn.004ab930
push str._n______security_
push esi
call fcn.004ab930
push str._n____trustInfo_
push esi
call fcn.004ab930
push str._n__assembly_
push esi
call fcn.004ab930
push 0x4cb20c
push esi
call fcn.004ab930
add esp, 0x30
mov ecx, esi
call fcn.0041ca73
push 7
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
inc eax
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004aaeb5
mov esp, ebp
pop ebp
ret
Function at 0x41c590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp - 0x147]
push ebx
push eax
mov byte [ebp - 0x148], bl
call fcn.004ab5d0
push 0x3f
lea eax, [ebp - 0x43]
push ebx
push eax
mov byte [ebp - 0x44], bl
call fcn.004ab5d0
add esp, 0x18
cmp edi, ebx
je 0x41c636
mov eax, edi
call fcn.00476abd
push 0x21e88e
lea eax, [esi - 0x25]
call fcn.0043db21
push eax
push str.P2_Tmp__d
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.004781b1
add esp, 0x14
lea eax, [ebp - 0x148]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x41c636
push edi
push ebx
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x41c636
mov edx, edi
call fcn.00476b3a
test eax, eax
jne 0x41c636
mov eax, edi
jmp 0x41c638
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004aaeb5
leave
ret
Function at 0x41cd43
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
push edi
push 0x103
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x107]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x108], 0
call fcn.004ab5d0
push 0x1c8
push 1
call fcn.004aa454
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x41cda1
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x41ce8f
push ebx
mov ebx, dword [0x520554]
test ebx, ebx
jne 0x41cdb9
call fcn.0046aaee
mov ebx, eax
mov dword [0x520554], ebx
push edi
call fcn.0046aba0
xor ebx, ebx
cmp dword [0x520554], ebx
pop ecx
jne 0x41cdde
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
call fcn.004aa2a8
pop ecx
jmp 0x41ce8c
push 0xc
lea eax, [edi + 4]
push ebx
push eax
mov dword [edi], ebx
call fcn.004ab5d0
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [edi + 0x18], eax
push 0x40
lea eax, [edi + 0x24]
pop ecx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
call fcn.00476b6c
push dword [ebp - 0x10c]
mov ecx, 0x104
lea eax, [ebp - 0x108]
call fcn.00476b6c
mov esi, eax
call fcn.00476e69
mov eax, esi
push eax
push 0x40
lea eax, [edi + 0x64]
pop ecx
call fcn.00476b6c
mov eax, dword [ebp + 0x18]
add esp, 0x18
mov dword [edi + 0xa4], eax
mov dword [edi + 0xb0], ebx
call fcn.0049c471
mov dword [edi + 0xb4], eax
lea eax, [edi + 0xb8]
call fcn.00476abd
push ebx
push ebx
push edi
push 0x41ccff
push dword [ebp + 8]
mov dword [edi + 0xac], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [edi + 0xa8], eax
jne 0x41ce8e
mov eax, edi
call fcn.0041ccb7
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004aaeb5
leave
ret 0x14

Function at 0x41ce9f
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, dword [0x520554]
xor ebx, ebx
call fcn.0046addc
xor esi, esi
jmp 0x41ced4
cmp esi, 0x56ce
jge 0x41cedc
cmp ebp, dword [eax + 0xa8]
je 0x41ceda
mov edi, dword [0x520554]
call fcn.0046ae28
inc esi
test eax, eax
jne 0x41ceb8
jmp 0x41cedc
mov ebx, eax
mov eax, ebx
call fcn.0041ccb7
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x42071a
Capabilities:
Log keystrokes via polling

Disassembly:
push dword [esp + 4]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx eax, ax
movzx eax, ax
shr eax, 0xf
ret
Function at 0x425a3b
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
xor ebp, ebp
push edi
xor eax, eax
cmp dword [eax*4 + 0x5fb020], ebp
je 0x425a53
inc eax
cmp eax, 2
jl 0x425a44
xor ebx, ebx
cmp eax, 2
mov edi, 0x6cc5c
jge 0x425b3b
mov esi, eax
imul esi, esi, 0x6cc5c
add esi, 0x521768
inc ebx
mov dword [eax*4 + 0x5fb020], ebx
push edi
push ebp
push esi
call fcn.004ab5d0
add esp, 0xc
push 0x64
lea ecx, [esi + 0x4c0]
lea eax, [esi + 0x32c]
pop edx
mov dword [eax - 0x194], ecx
mov dword [eax], ecx
add eax, 4
dec edx
jne 0x425a93
push ebp
push ebp
mov dword [esi + 0x37608], ebx
call fcn.0045ac28
push eax
push 0x4c943c
mov edi, 0x104
lea eax, [esi + 0x240c]
push edi
push eax
call fcn.004781b1
add esp, 0x18
push str.PaulaConfig.cfg
push ebp
push ebp
call fcn.0045aa3a
pop ecx
pop ecx
push eax
mov ebx, 0x4ca4a0
push ebx
lea eax, [esi + 0x22a8]
push edi
push eax
call fcn.004781b1
add esp, 0x14
push str.PaulaEmpConfig.cfg
push ebp
push ebp
call fcn.0045aa3a
pop ecx
pop ecx
push eax
push ebx
lea eax, [esi + 0x21a4]
push edi
push eax
call fcn.004781b1
add esp, 0x14
xor eax, eax
call fcn.00425b6a
cmp eax, ebp
je 0x425b22
push esi
mov ebx, eax
call fcn.0046aba0
pop ecx
push esi
call fcn.00436791
pop ecx
mov ecx, 0x4393bf
call fcn.0043ee26
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push edi
inc ebx
push ebx
call fcn.004aa454
mov esi, eax
cmp esi, ebp
pop ecx
pop ecx
jne 0x425a79
push str._n_nERROR:_OUT_OF_MEMORY__Could_not_create_PAULA_object_
call fcn.0040de4c
mov dword [esp], 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x425b35