joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402dcc
Capabilities:
Create service

Disassembly:
call fcn.00401cc8
test eax, eax
jne 0x402bec
push 1
call fcn.00483c58
pop ecx
push esi
push ebx
jmp 0x402c83
lea esi, [ecx + edx - 7]
pop ebp
lea ebp, [ebp + edi + 0x24]
sub ebp, edi
lea esi, [edi + eax*2 + 0x3d]
lea esi, [ecx + edx - 0x19]
sub esi, edx
lea esi, [ebp + 0x7a]
lea esi, [esi - 0x7a]
lea ebp, [ebp + ecx + 0x1e8]
sub ebp, ecx
sub edi, dword [esi]
lea esi, [esi + eax + 1]
sub esi, eax
cmp esi, ebp
jb 0x402df5
pop esi
cmp edi, 0xc9e15cd4
pop ebp
pop edi
nop
jmp 0x402bdb

Function at 0x402e60
Capabilities:
Create service
Start service

Disassembly:
aad 0xbf
push 0x11
pop edx
xor eax, 0x96adddb
or byte [edi - 0x3efc2e87], bl
in al, dx
nop
pop esi
jge 0x402e80
push esi
mov al, byte [esi + 7]
jb 0x402dfb
pop es
lea ebx, [ebp + 0x1e9ccb9a]
and edi, dword [esi - 0x7f]
sbb dh, ah
and byte [eax + 0x1b0719e], 0x5f
push ebp
mov ebp, esp
add esp, 0xfffffff4
push edi
push ebp
push esi
or edi, 0xffffffff
inc edi
call fcn.00403026
dec edx
dec edx
pop edx
jp 0x402e2b
cld
sti
xchg ebp, eax
arpl dx, sp
test dword [edi + 0x4c], esp
lodsb al, byte [esi]
mov dl, dh
pop edi
sbb al, 0xd4
dec edi
shl ebx, 1
pop ds
shl byte [ecx + edx*4 - 0x55], 0xfb
dec edi
jns 0x402ec6
stosd dword es:[edi], eax
popfd
or bl, byte [ebp - 0x11d2174c]
invalid
and al, 0x18
mov ecx, 0x44826e
pop ecx
add edx, ebx
push 0x862ca
mov edx, 0x43a0e2
or edx, 0xffffffed
pop edx
lea ecx, [ecx + edx*2 + 0x69]
sub ecx, 0x69
sub ecx, edx
rol edx, 0x33
mov edx, 0x42f71e
mov edx, dword [ecx]
and edx, 0xff
mov ecx, 0x48ae0e
add ecx, dword [esp + 0x18]
push 0x12f35dd
lea ecx, [ebx + edx - 0x36]
sub ecx, edx
pop ecx
lea edx, [edx + eax - 0x12f36c5]
sub edx, eax
lea edx, [edx + ecx]
test edx, edx
je 0x402f41
add ebp, dword [esp + 0x38]
or ebp, 0xfffffff3
lea esi, [edi + eax + 0x2b]
ror edi, 0xe3
sbb edi, 0x3f
push dword [esp + 0x14]
jmp 0x402f41
pop edx
pop ecx
jmp 0x402fb7
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x403019
push 0xf01ff
push dword [ebp + 8]
push dword [ebp - 8]
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x403019
push 0
push 0
push dword [ebp - 0xc]
call sub.advapi32.dll_StartServiceA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
cmp eax, 0x420
jne 0x403019
push dword [ebp - 0xc]
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 4], 0
setne al
and eax, 1
jmp 0x4030b3
push dword [ebp - 8]
call sub.advapi32.dll_CloseServiceHandle
jmp 0x40307a
jmp 0x4030b1
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x403026
Capabilities:
Start service

Disassembly:
call fcn.00401cc8
test eax, eax
jne 0x402ea7
push 1
call fcn.00483c58
pop ecx
push ecx
push edx
jmp 0x402f41
lea esi, [ecx + edx - 7]
pop ebp
lea ebp, [ebp + edi + 0x24]
sub ebp, edi
lea esi, [edi + eax*2 + 0x3d]
lea esi, [ecx + edx - 0x19]
sub esi, edx
lea esi, [ebp + 0x7a]
lea esi, [esi - 0x7a]
lea ebp, [ebp + ecx + 0x187]
sub ebp, ecx
sub edi, dword [esi]
lea esi, [esi + eax + 1]
sub esi, eax
cmp esi, ebp
jb 0x40304f
pop esi
cmp edi, 0xc8e31707
pop ebp
pop edi
nop
jmp 0x402e96
Function at 0x403130
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffac4
push esi
push edi
mov eax, 0x48e8bc
call fcn.0047eb88
xor edx, edx
mov dword [ebp - 0x34], edx
mov byte [ebp - 0x35], 0x43
mov byte [ebp - 0x35], 0x43
jmp 0x40327c
mov word [ebp - 0x20], 0x14
lea eax, [ebp - 4]
call fcn.004019a4
push eax
inc dword [ebp - 0x14]
mov edx, 0x48e381
lea eax, [ebp - 0xc]
call fcn.00488b78
inc dword [ebp - 0x14]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
mov dl, byte [ebp - 0x35]
call fcn.00488bec
inc dword [ebp - 0x14]
pop edx
pop ecx
call fcn.00488cc0
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00488c7c
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00488c7c
mov word [ebp - 0x20], 8
mov esi, 0x48a661
lea edi, [ebp - 0x13c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsx eax, byte [ebp - 0x35]
push eax
push 0x48e384
lea edx, [ebp - 0x13c]
push edx
call fcn.00480484
add esp, 0xc
lea eax, [ebp - 4]
call fcn.004019d4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
je 0x40321c
lea eax, [ebp - 4]
call fcn.004019d4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x40321c
lea eax, [ebp - 4]
call fcn.004019d4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x403263
mov esi, 0x48a765
lea edi, [ebp - 0x53c]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
push 0x400
lea eax, [ebp - 0x53c]
push eax
lea edx, [ebp - 0x13c]
push edx
call sub.kernel32.dll_QueryDosDeviceA
push 0x19
push 0x48e388
lea ecx, [ebp - 0x53c]
push ecx
call fcn.0047e9d0
add esp, 0xc
test eax, eax
jne 0x403263
inc dword [ebp - 0x34]
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00488c7c
mov word [ebp - 0x20], 0
inc byte [ebp - 0x35]
movsx ecx, byte [ebp - 0x35]
cmp ecx, 0x5a
jle 0x403157
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40329c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff5c4
push esi
push edi
mov eax, 0x48e914
call fcn.0047eb88
mov byte [ebp - 0x31], 0
mov byte [ebp - 0x32], 0x43
mov byte [ebp - 0x32], 0x43
jmp 0x40346d
mov word [ebp - 0x20], 0x14
lea eax, [ebp - 4]
call fcn.004019a4
push eax
inc dword [ebp - 0x14]
mov edx, 0x48e3aa
lea eax, [ebp - 0xc]
call fcn.00488b78
inc dword [ebp - 0x14]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
mov dl, byte [ebp - 0x32]
call fcn.00488bec
inc dword [ebp - 0x14]
pop edx
pop ecx
call fcn.00488cc0
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00488c7c
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00488c7c
mov word [ebp - 0x20], 8
mov esi, 0x48ab65
lea edi, [ebp - 0x138]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsx eax, byte [ebp - 0x32]
push eax
push 0x48e3ad
lea edx, [ebp - 0x138]
push edx
call fcn.00480484
add esp, 0xc
lea eax, [ebp - 4]
call fcn.004019d4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
je 0x40338b
lea eax, [ebp - 4]
call fcn.004019d4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x40338b
lea eax, [ebp - 4]
call fcn.004019d4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x403454
mov esi, 0x48ac69
lea edi, [ebp - 0x538]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
push 0x400
lea eax, [ebp - 0x538]
push eax
lea edx, [ebp - 0x138]
push edx
call sub.kernel32.dll_QueryDosDeviceA
push 0x19
push 0x48e3b1
lea ecx, [ebp - 0x538]
push ecx
call fcn.0047e9d0
add esp, 0xc
test eax, eax
jne 0x403454
mov esi, 0x48b069
lea edi, [ebp - 0x63c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x63c]
push eax
mov dl, byte [ebp - 0x138]
push edx
call fcn.00402518
add esp, 8
mov esi, 0x48b16d
lea edi, [ebp - 0xa3c]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
push dword [ebp + 8]
push 0x48e3cb
lea eax, [ebp - 0xa3c]
push eax
call fcn.00480484
add esp, 0xc
lea edx, [ebp - 0xa3c]
push edx
lea ecx, [ebp - 0x63c]
push ecx
call fcn.0047ea98
add esp, 8
test eax, eax
jne 0x403454
mov byte [ebp - 0x31], 1
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00488c7c
jmp 0x40347a
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00488c7c
mov word [ebp - 0x20], 0
inc byte [ebp - 0x32]
movsx ecx, byte [ebp - 0x32]
cmp ecx, 0x5a
jle 0x4032c2
mov al, byte [ebp - 0x31]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40391a
Capabilities:
Get disk information

Disassembly:
call fcn.00401cc8
test eax, eax
jne 0x4034e6
push 1
call fcn.00483c58
pop ecx
push ebx
push ecx
jmp 0x40359f
lea esi, [ecx + edx - 7]
pop ebp
lea ebp, [ebp + edi + 0x24]
sub ebp, edi
lea esi, [edi + eax*2 + 0x3d]
lea esi, [ecx + edx - 0x19]
sub esi, edx
lea esi, [ebp + 0x7a]
lea esi, [esi - 0x7a]
lea ebp, [ebp + ecx + 0x43c]
sub ebp, ecx
sub edi, dword [esi]
lea esi, [esi + eax + 1]
sub esi, eax
cmp esi, ebp
jb 0x403943
pop esi
cmp edi, 0x849cac9c
pop ebp
pop edi
nop
jmp 0x4034d5
Function at 0x404833
Capabilities:
Check mutex on windows
Get common file path

Disassembly:
call fcn.00401cc8
test eax, eax
jne 0x404558
push 1
call fcn.00483c58
pop ecx
push ebx
push ecx
jmp 0x40460a
pop ecx
pop ebx
jmp 0x404668
mov esi, 0x48caa1
lea edi, [ebp - 0x140]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov esi, 0x48cba1
lea edi, [ebp - 0x244]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x140]
push eax
push 0x48e56b
mov word [ebp - 0x20], 8
lea eax, [ebp - 4]
call fcn.004019a4
mov edx, eax
inc dword [ebp - 0x14]
mov ecx, dword [0x494a10]
mov eax, dword [ecx]
call fcn.00456d08
lea eax, [ebp - 4]
call fcn.004019d4
push eax
push 0x494c0c
call fcn.00406ed4
add esp, 0x10
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00488c7c
lea ecx, [ebp - 0x140]
push ecx
push 0x48e578
lea eax, [ebp - 0x244]
push eax
call fcn.00480484
add esp, 0xc
mov word [ebp - 0x20], 0x14
lea edx, [ebp - 0x244]
lea eax, [ebp - 8]
call fcn.00488b78
inc dword [ebp - 0x14]
mov edx, dword [eax]
mov eax, dword [sym.Project1.exe__Form1]
call fcn.0045f790
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00488c7c
mov word [ebp - 0x20], 0x20
lea eax, [ebp - 0xc]
call fcn.004019a4
mov edx, eax
inc dword [ebp - 0x14]
mov ecx, dword [0x494a10]
mov eax, dword [ecx]
call fcn.00456300
lea eax, [ebp - 0xc]
call fcn.004019d4
push eax
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00488c7c
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x404792
push dword [ebp - 0x3c]
call sub.kernel32.dll_CloseHandle
mov ecx, dword [0x494a10]
mov eax, dword [ecx]
call fcn.0045681c
push 1
call fcn.0047d928
mov dword [ebp - 0x40], eax
mov edx, dword [sym.Project1.exe__Form1]
push dword [edx + 0x4c]
mov edx, dword [ebp - 0x40]
pop eax
sub edx, eax
sar edx, 1
jns 0x4047b2
adc edx, 0
mov eax, dword [sym.Project1.exe__Form1]
call fcn.0045eecc
push 0
call fcn.0047d928
mov edx, eax
mov ecx, dword [sym.Project1.exe__Form1]
sub edx, dword [ecx + 0x48]
sar edx, 1
jns 0x4047d5
adc edx, 0
mov eax, dword [sym.Project1.exe__Form1]
call fcn.0045eea8
mov esi, 0x48cca5
lea edi, [ebp - 0x348]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x348]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
lea edx, [ebp - 0x348]
push edx
push 0x48e59a
push 0x48a444
call fcn.00480484
add esp, 0xc
push 0x48a444
call fcn.0040418c
pop ecx
push 1
call fcn.00403490
pop ecx
jmp 0x404887
lea esi, [ecx + edx - 7]
pop ebp
lea ebp, [ebp + edi + 0x24]
sub ebp, edi
lea esi, [edi + eax*2 + 0x3d]
lea esi, [ecx + edx - 0x19]
sub esi, edx
lea esi, [ebp + 0x7a]
lea esi, [esi - 0x7a]
lea ebp, [ebp + ecx + 0x2e3]
sub ebp, ecx
sub edi, dword [esi]
lea esi, [esi + eax + 1]
sub esi, eax
cmp esi, ebp
jb 0x40485c
pop esi
cmp edi, 0xa9d2569f
pop ebp
pop edi
nop
jmp 0x404547
jmp 0x4048be
mov ecx, dword [ebp - 0x30]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x404934
Capabilities:
Get disk information

Disassembly:
push ebp
clc
mov eax, dword [sym.Project1.exe__Form1]
call fcn.00404934
pop ecx
pop ecx
pop ebp
ret
push ebp
mov ebp, esp
add esp, 0xfffff3d0
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push edi
push ebp
push esi
or edi, 0xffffffff
inc edi
call fcn.00404e01
dec edx
dec edx
pop edx
jp 0x40490a
cld
sti
xchg ebp, eax
arpl dx, sp
test dword [edi + 0x4c], esp
lodsb al, byte [esi]
mov dl, dh
pop edi
sbb al, 0xd4
dec edi
shl ebx, 1
pop ds
shl byte [ecx + edx*4 - 0x55], 0xfb
dec edi
jns 0x4049a5
stosd dword es:[edi], eax
popfd
or bl, byte [ebp - 0x2cb1174c]
invalid
nop
lahf
sub dh, cl
push 0x84835
mov ebx, 0x47011a
rol ebx, 0x49
pop ebx
lea esi, [esi + ebx*2 + 0x7a]
lea esi, [esi + ebp - 0x7a]
sub esi, ebp
sub esi, ebx
xor ebx, ebx
push dword [esi]
xor ebx, dword [esp + 8]
sbb ebx, 0x25
pop ebx
and ebx, 0xff
mov esi, 0x47f72e
sbb esi, 0xffffffb3
push 0x3cee90e2
lea esi, [ebx + ecx + 0x1a]
sub esi, ecx
pop esi
lea ebx, [ebx - 0x3cee91ca]
lea ebx, [ebx + esi]
test ebx, ebx
je fcn.00404a1b
xor ebp, dword [esp + 0x28]
or ebp, 0xffffffb1
sbb esi, ebp
add edi, dword [esp + 0x38]
rcr edi, 0x7b
push 0x47d6ae
jmp fcn.00404a1b

Function at 0x404e01
Capabilities:
Get disk information

Disassembly:
lea esi, [ecx + edx - 7]
pop ebp
lea ebp, [ebp + edi + 0x24]

Function at 0x404ea4
Capabilities:
Get disk information

Disassembly:
call fcn.00401cc8
test eax, eax
jne 0x404986
push 1
call fcn.00483c58
pop ecx
push esi
push ebx
jmp fcn.00404a1b
lodsb al, byte [esi]
cmp eax, 0x24
sub ebp, edi
lea esi, [edi + eax*2 + 0x3d]
lea esi, [ecx + edx - 0x19]
sub esi, edx
lea esi, [ebp + 0x7a]
lea esi, [esi - 0x7a]
lea ebp, [ebp + ecx + 0x483]
sub ebp, ecx
sub edi, dword [esi]
lea esi, [esi + eax + 1]
sub esi, eax
cmp esi, ebp
jb 0x404e2a
pop esi
cmp edi, 0x98c5789d
pop ebp
pop edi
nop
jmp 0x404975
jle 0x404e07
sbb dh, ah
and byte [eax + 0x5e5f719e], 0x8b
in eax, 0x5d
push ebp
mov ebp, esp
add esp, 0xfffffdbc
push esi
push edi
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov eax, 0x48ecdc
call fcn.0047eb88
push edi
push ebp
push esi
or edi, 0xffffffff
inc edi
call fcn.004051d7
dec edx
dec edx
pop edx
jp 0x404e84
cld
sti
xchg ebp, eax
arpl dx, sp
test dword [edi + 0x4c], esp
lodsb al, byte [esi]
mov dl, dh
pop edi
sbb al, 0xd4
dec edi
shl ebx, 1
pop ds
shl byte [ecx + edx*4 - 0x55], 0xfb
dec edi
jns 0x404f1f
stosd dword es:[edi], eax
popfd
or bl, byte [ebp - 0x322b174c]
invalid
lea edx, [edi + 0x48d3ac]
push 0x8424d
mov edx, 0x49a00e
add edx, dword [esp + 0x18]
pop edx
lea ecx, [ecx + edx*2 + 4]
lea ecx, [ecx + edi - 4]
sub ecx, edi
sub ecx, edx
and edx, ebp
push dword [ecx]
mov edx, 0x4acc06
mov edx, 0x4750be
pop edx
and edx, 0xff
mov ecx, 0x412d42
xor ecx, dword [esp + 0x28]
add ecx, dword [esp + 0x18]
or ecx, 0xffffffc7
lea ecx, [edx + 0x4c68f75d]
sub ecx, edx
lea edx, [edx + eax - 0x4c68f845]
sub edx, eax
lea edx, [edx + ecx]
test edx, edx
je fcn.00404faa
mov ebp, 0x47c05e
add ebp, dword [esp + 0x18]
lea esi, [edi + eax]
mov edi, 0x45ed76
or edi, 0xffffff97
push dword fs:[0]
jmp fcn.00404faa
Function at 0x4052d4
Capabilities:
Read file on windows

Disassembly:
hlt
push ebp
mov ebp, esp
add esp, 0xfffffac4
push ebx
push esi
push edi
push edi
push ebp
push esi
or edi, 0xffffffff
inc edi
call fcn.004058ae
dec edx
dec edx
pop edx
jp 0x4052a5
cld
sti
xchg ebp, eax
arpl dx, sp
test dword [edi + 0x4c], esp
lodsb al, byte [esi]
mov dl, dh
pop edi
sbb al, 0xd4
dec edi
shl ebx, 1
pop ds
shl byte [ecx + edx*4 - 0x55], 0xfb
dec edi
jns 0x405340
stosd dword es:[edi], eax
popfd
or bl, byte [ebp - 0x364c174c]
invalid
push eax
or byte ds:[eax], al
sub edi, 0x4bb0e7c2
pop edi
lea edx, [edx + edi]
rcl edi, 0x47
add edi, dword [esp + 0x18]
mov edi, dword [edx]
and edi, 0xff
add edx, dword [esp + 0x18]
mov edx, 0x47f06e
push 0x6984b89e
add edx, edi
pop edx
lea edi, [edi + ebx - 0x6984b986]
sub edi, ebx
lea edi, [edi + edx*2 + 0x3e]
lea edi, [edi + ebx - 0x3e]
sub edi, ebx
sub edi, edx
or edi, edi
je 0x4053ae
lea ebp, [edi + 0x42b8dc]
mov esi, 0x46b446
add esi, dword [esp + 0x38]
add edi, ebx
push 0xffffffffffffffd8
push esi
jmp 0x4053ae
pop edi
pop edx
jmp 0x405431
mov esi, 0x48dbb7
lea edi, [ebp - 0x238]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [ebp - 8], eax
mov byte [ebp - 0x15], 0
push dword [ebp + 0xc]
call fcn.0047e904
pop ecx
add eax, 0x1f
push eax
call fcn.0047e1d8
pop ecx
mov dword [ebp - 0x1c], eax
push dword [ebp + 0xc]
call fcn.0047e904
pop ecx
add eax, 0x1f
push eax
push 0
push dword [ebp - 0x1c]
call fcn.0047e7f4
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 0xc]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x4054b3
push 0
push 0
push 0x48e694
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
jmp 0x405939
push 0
push 0
push pe_nt_image_headers32
push dword [ebp - 0x20]
call sub.kernel32.dll_SetFilePointer
push 0
lea edx, [ebp - 4]
push edx
push pe_nt_image_headers32
lea ecx, [ebp - 0x238]
push ecx

Function at 0x4058ae
Capabilities:
Read file on windows

Disassembly:
call fcn.00401cc8
test eax, eax
jne 0x405321
push 1
call fcn.00483c58
pop ecx
push edx
push edi
jmp 0x4053ae
lea esi, [ecx + edx - 7]
pop ebp
lea ebp, [ebp + edi + 0x24]
sub ebp, edi
lea esi, [edi + eax*2 + 0x3d]
lea esi, [ecx + edx - 0x19]
sub esi, edx
lea esi, [ebp + 0x7a]
lea esi, [esi - 0x7a]
lea ebp, [ebp + ecx + 0x595]
sub ebp, ecx
sub edi, dword [esi]
lea esi, [esi + eax + 1]
sub esi, eax
cmp esi, ebp
jb 0x4058d7
pop esi
cmp edi, 0x3e74c3f2
pop ebp
pop edi
nop
jmp 0x405310
Function at 0x405dce
Capabilities:
Read file on windows

Disassembly:
call fcn.00401cc8
test eax, eax
jne 0x40598d
push 1
call fcn.00483c58
pop ecx
push ecx
push edx
jmp 0x405a36
lea esi, [ecx + edx - 7]
pop ebp
lea ebp, [ebp + edi + 0x24]
sub ebp, edi
lea esi, [edi + eax*2 + 0x3d]
lea esi, [ecx + edx - 0x19]
sub esi, edx
lea esi, [ebp + 0x7a]
lea esi, [esi - 0x7a]
lea ebp, [ebp + ecx + 0x449]
sub ebp, ecx
sub edi, dword [esi]
lea esi, [esi + eax + 1]
sub esi, eax
cmp esi, ebp
jb 0x405df7
pop esi
cmp edi, 0xa5e2a425
pop ebp
pop edi
nop
jmp 0x40597c

Function at 0x406013
Capabilities:
Create process on windows

Disassembly:
call fcn.00401cc8
test eax, eax
jne 0x405ead
push 1
call fcn.00483c58
pop ecx
push esi
push ebx
jmp 0x405f65
pop ebx
pop esi
jmp 0x405fbd
push 0x44
push 0
lea eax, [ebp - 0x5c]
push eax
call fcn.0047e7f4
add esp, 0xc
mov dword [ebp - 0x5c], 0x44
mov word [ebp - 0x2c], 6
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x5c]
push ecx
push 0
push 0
push 0x10
push 0
push 0
push 0
push 0x48e7a3
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x40600e
push dword [ebp - 0x14]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x18]
call sub.kernel32.dll_CloseHandle
jmp 0x406067
lea esi, [ecx + edx - 7]
pop ebp
lea ebp, [ebp + edi + 0x24]
sub ebp, edi
lea esi, [edi + eax*2 + 0x3d]
lea esi, [ecx + edx - 0x19]
sub esi, edx
lea esi, [ebp + 0x7a]
lea esi, [esi - 0x7a]
lea ebp, [ebp + ecx + 0x16e]
sub ebp, ecx
sub edi, dword [esi]
lea esi, [esi + eax + 1]
sub esi, eax
cmp esi, ebp
jb 0x40603c
pop esi
cmp edi, 0x357f89bb
pop ebp
pop edi
nop
jmp 0x405e9c
jmp 0x40609e
mov esp, ebp
pop ebp
ret

Function at 0x406ed4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push esi
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x406efb
xor eax, eax
jmp 0x406fb4
push dword [ebp - 8]
call fcn.0047deb4
pop ecx
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push 0
push dword [ebp + 0xc]
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x406fa9
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0x10]
push ecx
push 0x48fd30
push dword [ebp - 0xc]
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x406fa9
mov esi, 0x48f1c0
lea edi, [ebp - 0x118]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
push dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
movzx edx, word [eax + 2]
push edx
mov ecx, dword [ebp - 0x10]
movzx eax, word [ecx]
push eax
push 0x48fd49
lea edx, [ebp - 0x118]
push edx
call fcn.00480484
add esp, 0x14
lea ecx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x118]
push edx
push dword [ebp - 0xc]
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x406fa9
push dword [ebp - 0x10]
push dword [ebp + 0x14]
call fcn.0047e8d4
add esp, 8
push dword [ebp - 0xc]
call fcn.0047dcdc
pop ecx
mov eax, 1
jmp 0x406fb4
push dword [ebp - 0xc]
call fcn.0047dcdc
pop ecx
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407828
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4078df
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.0042f5f0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x40786a
call fcn.0042ee4c
jmp 0x4078e6
mov eax, ebx
call fcn.0042d518
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.0042f5f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x407893
call fcn.0042ee4c
jmp 0x4078e6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4078f0
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x4078b4
call fcn.0042ee4c
jmp 0x4078e6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4078e6
mov eax, dword [ebp - 8]
call fcn.0042d538
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417784
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x494ec8
cmp dword [edi], 0
jne 0x417800
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x494ec4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x490104
mov ecx, 2
call fcn.0042d77c
mov edx, 0x41775c
lea eax, [esi + 5]
call fcn.0041777c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041777c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4177d5
mov dword [0x494ec4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x418bcc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00418908
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0042f5f0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x418c2a
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x494820]
mov dl, 1
mov eax, dword [0x41882c]
call fcn.0041ff24
call fcn.0042eda0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8