joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436440
Capabilities:
Get hostname
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x532421
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa7c
push ebp
push esi
push edi
mov ecx, 0x108
xor eax, eax
lea edi, [esp + 0x60]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x584]
mov esi, 0x104
push eax
push ecx
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [esp + 0xc]
lea eax, [esp + 0x480]
push edx
push eax
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov ebp, dword [esp + 0xa98]
mov ecx, dword [ebp + 0x114]
mov edx, dword [ebp + 0x110]
mov eax, dword [ebp + 0x20]
push ecx
push edx
push eax
lea ecx, [esp + 0x694]
push 0x592710
push ecx
call fcn.00462318
lea edx, [esp + 0x69c]
lea eax, [esp + 0x74]
push edx
push eax
call fcn.004365e0
add esp, 0x1c
test eax, eax
je 0x4365c2
mov ecx, 0xa
mov esi, 0x592718
lea edi, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x18]
call fcn.0043d690
lea edx, [esp + 0x60]
push 0x420
mov dword [esp + 0xa94], 0
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0x420
call fcn.0043d830
test eax, eax
jne 0x436546
lea ecx, [esp + 0x14]
mov dword [esp + 0xa90], 0xffffffff
call fcn.0043d700
xor eax, eax
jmp 0x4365c2
lea eax, [esp + 0x60]
lea ecx, [ebp + 0x1c]
push eax
call fcn.00512074
push ecx
lea edx, [esp + 0x168]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.00511f59
mov ecx, ebp
mov byte [esp + 0xa94], 0
call fcn.0043c900
lea eax, [esp + 0x268]
lea ecx, [ebp + 0x18]
push eax
call fcn.00512074
push ecx
lea edx, [esp + 0x370]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.00511f59
mov ecx, ebp
mov byte [esp + 0xa94], 0
call fcn.0043ca10
lea ecx, [esp + 0x14]
mov dword [esp + 0xa90], 0xffffffff
call fcn.0043d700
mov eax, 1
mov ecx, dword [esp + 0xa88]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0xa88
ret

Function at 0x4365e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
lea eax, [esp + 0xc]
push 0x592740
push eax
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp]
lea edx, [esp + 0xc]
push ecx
push 0xf003f
push 0
push edx
push reloc.oledlg.dll_OleUIAddVerbMenuA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x436627
xor eax, eax
add esp, 0x110
ret
mov ecx, dword [esp + 0x114]
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x11c]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x20], 3
mov dword [esp + 0x1c], 0x420
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [esp]
je 0x43667a
test eax, eax
je 0x436671
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x110
ret
test eax, eax
je 0x436685
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0x110
ret
Function at 0x436c10
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
push ebx
push esi
push edi
call fcn.00438120
test eax, eax
je 0x436c34
xor eax, eax
lea esp, [ebp - 0xa24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5a1be8]
xor ebx, ebx
cmp eax, ebx
jne 0x436c55
call fcn.004374f0
test eax, eax
jne 0x436c55
lea esp, [ebp - 0xa24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
lea ecx, [ebp - 0x114]
mov esi, 0x104
push eax
push ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [ebp - 4]
lea eax, [ebp - 0x218]
push edx
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov edi, dword [ebp + 8]
mov ecx, edi
cmp edi, ebx
mov dword [ebp + 8], ecx
je 0x436cb6
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.00461830
mov eax, esp
push esi
push edi
push eax
call fcn.005124b5
mov ebx, eax
mov ecx, edi
mov al, byte [edi]
test al, al
je 0x436ccb
cmp al, 0x5c
jne 0x436ccb
mov al, byte [ecx + 1]
inc ecx
cmp al, 0x5c
je 0x436cc0
mov dword [ebp + 8], ecx
mov ax, word [ebx]
test ax, ax
je 0x436ce2
cmp ax, 0x5c
jne 0x436ce2
add ebx, 2
cmp word [ebx], 0x5c
je 0x436cd9
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x218]
push ecx
xor esi, esi
call edi
xor ecx, ecx
test eax, eax
jle 0x436d08
movsx edx, byte [ebp + ecx - 0x218]
add esi, edx
inc ecx
cmp ecx, eax
jl 0x436cf9
lea eax, [ebp - 0x114]
push eax
call edi
xor ecx, ecx
test eax, eax
jle 0x436d26
movsx edx, byte [ebp + ecx - 0x114]
add esi, edx
inc ecx
cmp ecx, eax
jl 0x436d17
push ebx
push esi
lea eax, [ebp - 0xa18]
push 0x59279c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0xa18]
lea edx, [ebp - 0x10]
push ecx
push edx
call fcn.00437400
lea eax, [ebp - 8]
push eax
push 0x20
push 0
call fcn.00437470
add esp, 0x24
test eax, eax
je 0x436d6d
xor eax, eax
lea esp, [ebp - 0xa24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x10]
push 0
push ecx
push edx
call dword [fcn.005a1bf8]
mov esi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x436d8d
push eax
call dword [fcn.005a1bf4]
call fcn.005269f5
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
push 0
push ecx
push 0x592784
mov ecx, eax
call fcn.0051a11e
lea esp, [ebp - 0xa24]
xor eax, eax
test esi, esi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4374f0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x5a1be8]
sub esp, 0x104
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
jne 0x437553
mov eax, dword [0x586880]
mov ecx, dword [0x586884]
mov edx, dword [0x586888]
mov dword [esp + 8], eax
mov al, byte [0x58688c]
push edi
mov dword [esp + 0x10], ecx
mov byte [esp + 0x18], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x19]
mov dword [esp + 0x14], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x5a1be8], eax
pop edi
je 0x437602
mov ecx, dword [fcn.005a1bec]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp ecx, ebx
jne 0x437579
push 0x5927f4
push eax
call esi
mov dword [fcn.005a1bec], eax
cmp eax, ebx
mov eax, dword [0x5a1be8]
je 0x4375f1
cmp dword [fcn.005a1bf0], ebx
jne 0x437597
push 0x5927e4
push eax
call esi
mov dword [fcn.005a1bf0], eax
cmp eax, ebx
mov eax, dword [0x5a1be8]
je 0x4375f1
cmp dword [fcn.005a1bf4], ebx
jne 0x4375b5
push 0x5927d8
push eax
call esi
mov dword [fcn.005a1bf4], eax
cmp eax, ebx
mov eax, dword [0x5a1be8]
je 0x4375f1
cmp dword [fcn.005a1bf8], ebx
jne 0x4375d3
push 0x5927c4
push eax
call esi
mov dword [fcn.005a1bf8], eax
cmp eax, ebx
mov eax, dword [0x5a1be8]
je 0x4375f1
cmp dword [fcn.005a1bfc], ebx
jne 0x43760d
push 0x5927ac
push eax
call esi
cmp eax, ebx
mov dword [fcn.005a1bfc], eax
jne 0x43760d
mov eax, dword [0x5a1be8]
cmp eax, ebx
je 0x437602
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x5a1be8], ebx
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret
Function at 0x437850
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call ebx
mov eax, dword [0x5a1c40]
test eax, eax
je 0x437879
call ebx
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret
mov al, byte [0x5a17b0]
push edi
mov byte [esp + 0xc], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
push 0x104
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [esp + eax + 0xb]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp cl, 0x5c
pop edi
je 0x4378ca
lea eax, [esp + 8]
push 0x5909e8
push eax
call esi
lea ecx, [esp + 8]
push 0x5924c8
push ecx
call esi
push 8
lea edx, [esp + 0xc]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test eax, eax
mov dword [0x5a1c40], eax
jne 0x43790f
push 0x5924c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x5a1c40], eax
jne 0x43790f
call ebx
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x591550
push eax
call esi
mov dword [fcn.005a1c14], eax
mov eax, dword [0x5a1c40]
push 0x5924b4
push eax
call esi
mov ecx, dword [0x5a1c40]
push 0x592518
push ecx
mov dword [fcn.005a1c18], eax
call esi
mov edx, dword [0x5a1c40]
push 0x592508
push edx
mov dword [fcn.005a1c1c], eax
call esi
mov dword [fcn.005a1c20], eax
mov eax, dword [0x5a1c40]
push 0x5928a8
push eax
call esi
mov ecx, dword [0x5a1c40]
push 0x592898
push ecx
mov dword [0x5a1c24], eax
call esi
mov edx, dword [0x5a1c40]
push 0x592888
push edx
mov dword [0x5a1c28], eax
call esi
mov dword [fcn.005a1c2c], eax
mov eax, dword [0x5a1c40]
push 0x592878
push eax
call esi
mov ecx, dword [0x5a1c40]
push 0x592860
push ecx
mov dword [fcn.005a1c30], eax
call esi
mov edx, dword [0x5a1c40]
push 0x592854
push edx
mov dword [0x5a1c34], eax
call esi
mov dword [0x5a1c38], eax
mov eax, dword [0x5a1c40]
push 0x592844
push eax
call esi
mov ecx, dword [fcn.005a1c14]
mov dword [0x5a1c3c], eax
test ecx, ecx
je 0x437a52
mov ecx, dword [fcn.005a1c18]
test ecx, ecx
je 0x437a52
mov ecx, dword [fcn.005a1c1c]
test ecx, ecx
je 0x437a52
mov ecx, dword [fcn.005a1c20]
test ecx, ecx
je 0x437a52
mov ecx, dword [0x5a1c24]
test ecx, ecx
je 0x437a52
mov ecx, dword [0x5a1c28]
test ecx, ecx
je 0x437a52
mov ecx, dword [fcn.005a1c2c]
test ecx, ecx
je 0x437a52
mov ecx, dword [fcn.005a1c30]
test ecx, ecx
je 0x437a52
mov ecx, dword [0x5a1c34]
test ecx, ecx
je 0x437a52
mov ecx, dword [0x5a1c38]
test ecx, ecx
je 0x437a52
test eax, eax
je 0x437a52
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret
call ebx
push 0
mov esi, eax
call fcn.00437a80
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret
Function at 0x437a80
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov esi, dword [esp + 0x10]
xor ebx, ebx
cmp esi, ebx
je 0x437b89
call edi
cmp dword [esi + 0x218], ebx
je 0x437aba
cmp dword [0x5a1c38], ebx
je 0x437aba
call edi
mov eax, dword [esi + 0x218]
push eax
call dword [0x5a1c38]
mov eax, dword [esi + 0x25c]
push ebp
cmp eax, ebx
je 0x437b3c
lea ecx, [esp + 0x14]
mov ebp, 0x103
push ecx
push eax
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x14], ebp
jne 0x437b29
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
inc ebx
call edi
push 0x64
call edi
push 0
call edi
cmp dword [esp + 0x14], ebp
jne 0x437b27
cmp ebx, 5
jge 0x437b18
mov eax, dword [esi + 0x25c]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x14], ebp
je 0x437ae6
jmp 0x437b27
mov ecx, dword [esi + 0x25c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
xor ebx, ebx
mov edx, dword [esi + 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x25c], ebx
mov eax, dword [esi + 0x21c]
mov ebp, dword [esi]
cmp eax, ebx
je 0x437b5c
mov ecx, dword [fcn.005a1c30]
cmp ecx, ebx
je 0x437b5c
push ebx
push eax
call ecx
mov dword [esi + 0x21c], ebx
mov eax, dword [esi + 0x214]
cmp eax, ebx
je 0x437b79
mov ecx, dword [fcn.005a1c18]
cmp ecx, ebx
je 0x437b79
push eax
call ecx
mov dword [esi + 0x214], ebx
mov ecx, 0x98
xor eax, eax
mov edi, esi
xor ebx, ebx
rep stosd dword es:[edi], eax
mov dword [esi], ebp
pop ebp
mov eax, dword [0x5a1c40]
cmp eax, ebx
je 0x437b9f
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x5a1c40], ebx
pop edi
mov dword [fcn.005a1c14], ebx
mov dword [fcn.005a1c18], ebx
mov dword [fcn.005a1c1c], ebx
mov dword [fcn.005a1c20], ebx
mov dword [0x5a1c24], ebx
mov dword [0x5a1c28], ebx
mov dword [fcn.005a1c2c], ebx
mov dword [0x5a1c34], ebx
mov dword [0x5a1c38], ebx
mov dword [0x5a1c3c], ebx
pop esi
pop ebx
ret
Function at 0x437de0
Capabilities:
Check for time delay via gettickcount
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x5324e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [esp + 0x34]
push ebp
push esi
push edi
mov ecx, dword [eax]
mov dword [esp + 0xc], 0
test ecx, ecx
je 0x437f2e
call fcn.005269f5
mov ecx, dword [eax + 4]
call fcn.0051196c
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, dword [esp + 0x48]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [esp + 0x10], eax
push 0
call esi
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx]
test eax, eax
je 0x437f19
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x437f19
cmp dword [esp + 0xc], 0x103
jne 0x437f19
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x44]
sub eax, edx
cmp eax, ecx
jae 0x437edf
push 1
push 0
push 0
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
je 0x437ecf
cmp dword [esp + 0x18], 0x12
je 0x437f19
test ebp, ebp
jne 0x437ebc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x437e9b
push 0
call esi
push 0xfa
call esi
jmp 0x437e40
mov ecx, dword [esp + 0x40]
push 0
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.005269f5
mov ecx, dword [eax + 4]
call fcn.00511981
mov eax, esi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
mov dword [esp + 0x38], 0xffffffff
call fcn.005269f5
mov ecx, dword [eax + 4]
call fcn.00511981
mov ecx, dword [esp + 0x30]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x30
ret

Function at 0x438160
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x4381a1
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
je 0x4381ca
mov eax, dword [esp + 0x18]
sub eax, 2
jne 0x4381ca
mov eax, dword [esp + 0xc]
cmp eax, 5
jb 0x4381ca
jne 0x4381bc
cmp dword [esp + 0x10], 1
jb 0x4381ca
pop edi
mov eax, 1
pop esi
add esp, 0x9c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x9c
ret
Function at 0x4381e0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x334
push esi
call fcn.005269f5
mov eax, dword [eax + 8]
lea ecx, [esp + 0x34]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x34]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x4382e6
push edi
push esi
call fcn.00511c2c
add esp, 4
mov edi, eax
lea ecx, [esp + 0x38]
push edi
push esi
push 0
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4382cf
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push eax
push 0x592630
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4382cf
mov eax, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [eax]
mov dx, word [eax]
shr ecx, 0x10
push ecx
push edx
lea eax, [esp + 0x144]
push 0x592608
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
lea eax, [esp + 0x13c]
push ecx
push edx
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
cmp byte [eax], 0
je 0x4382b9
cmp byte [eax], 0x2c
jne 0x4382a7
mov byte [eax], 0x2e
mov cl, byte [eax]
cmp cl, 0x20
je 0x4382b1
mov byte [edx], cl
inc edx
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x43829f
mov byte [edx], 0
mov edx, dword [esp + 0x340]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call fcn.00511c55
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x334
ret
xor eax, eax
pop esi
add esp, 0x334
ret

Function at 0x4382f0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x110
push ebx
push esi
call fcn.005269f5
mov eax, dword [eax + 8]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [esp + 0x11c]
lea edx, [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
mov dword [ebx], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x438394
push edi
push esi
call fcn.00511c2c
add esp, 4
mov edi, eax
lea ecx, [esp + 0x18]
push edi
push esi
push 0
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
mov esi, eax
test esi, esi
je 0x43837f
lea edx, [esp + 0x14]
lea eax, [esp + 0xc]
push edx
push eax
push 0x592630
push edi
call sub.VERSION.dll_VerQueryValueA
mov esi, eax
test esi, esi
je 0x43837f
mov ecx, dword [esp + 0xc]
cmp word [ecx], 0x409
jne 0x43837f
mov dword [ebx], 1
push edi
call fcn.00511c55
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x110
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
Function at 0x4383f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x438431
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
je 0x438457
mov eax, dword [esp + 0x18]
sub eax, 2
jne 0x438457
cmp dword [esp + 0xc], 6
jne 0x438457
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x438457
pop edi
mov eax, 1
pop esi
add esp, 0x9c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x9c
ret

Function at 0x43a070
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x532748
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x598d50]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x40]
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0
push ecx
push edi
call ebx
mov eax, dword [esi + 0x284]
test eax, eax
je 0x43a113
push 0x1d
lea ecx, [esp + 0x10]
call fcn.00512508
mov edx, dword [esi + 0x280]
mov eax, dword [esi + 0x278]
mov ecx, dword [esp + 0x14]
sub edx, eax
mov eax, dword [esi + 0x27c]
push 1
push edx
mov edx, dword [esi + 0x274]
sub eax, edx
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
push edi
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [esp + 0xc]
mov ecx, esi
push eax
push 0x4bf
call fcn.00511355
mov dword [esi + 0x284], 0
jmp 0x43a171
push 0x1e
lea ecx, [esp + 0x10]
call fcn.00512508
lea ecx, [esp + 0x20]
push ecx
push 0x4c0
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call ebx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
sub edx, eax
sub edx, 4
push 1
push edx
mov edx, dword [esp + 0x20]
sub edx, ecx
push edx
push eax
push ecx
push edi
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [esp + 0xc]
mov ecx, esi
push eax
push 0x4bf
call fcn.00511355
mov dword [esi + 0x284], 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.00511eeb
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 4
Function at 0x43ac40
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x53293a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov ecx, dword [0x598d50]
xor eax, eax
lea edx, [esi + 4]
mov dword [esp + 0x1c], eax
mov dword [edx], ecx
mov ecx, dword [0x598d50]
lea ebp, [esi + 8]
mov byte [esp + 0x1c], 1
mov dword [ebp], ecx
mov ecx, dword [0x598d50]
lea ebx, [esi + 0xc]
mov byte [esp + 0x1c], 2
mov dword [ebx], ecx
mov ecx, dword [0x598d50]
mov byte [esp + 0x1c], 3
mov dword [esi + 0x14], ecx
mov ecx, dword [0x598d50]
mov byte [esp + 0x1c], 4
mov dword [esi + 0x18], ecx
mov ecx, dword [0x598d50]
mov byte [esp + 0x1c], 5
mov dword [esi + 0x1c], ecx
mov byte [esp + 0x1c], 6
mov ecx, 0x51
lea edi, [esi + 0x38]
mov dword [esi], 0x5469e0
mov dword [esi + 0x34], eax
push 0x5a17b0
rep stosd dword es:[edi], eax
mov ecx, edx
call fcn.00512074
push 0x5a17b0
mov ecx, ebp
call fcn.00512074
push 0x5a17b0
mov ecx, ebx
call fcn.00512074
push 0x5a17b0
lea ecx, [esi + 0x14]
mov dword [esi + 0x10], 1
call fcn.00512074
push 0x592f68
lea ecx, [esi + 0x18]
call fcn.00512074
push 0x592f60
lea ecx, [esi + 0x1c]
call fcn.00512074
xor eax, eax
mov dword [esi + 0x30], 2
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
call fcn.005269f5
mov eax, dword [eax + 4]
push 1
push 0x592f50
push 0x592f38
mov ecx, eax
call fcn.00526483
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x10], eax
mov eax, esi
pop edi
pop esi
pop ebp
mov dword [esp + 0x10], 0xffffffff
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x43b0c0
Capabilities:
Connect network resource

Disassembly:
push 0xffffffffffffffff
push 0x532a4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x330
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi + 0xc]
push eax
lea eax, [esp + 0x38]
push eax
call edi
mov eax, dword [esi + 8]
lea ecx, [esp + 0x23c]
push eax
push ecx
call edi
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.0043b280
mov eax, dword [eax]
xor ebx, ebx
push eax
lea eax, [esp + 0x13c]
push eax
mov dword [esp + 0x350], ebx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x348], 0xffffffff
call fcn.00511eeb
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x14]
push 0x5909e8
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
call edi
lea edx, [esp + 0x34]
push 0x592fb0
push edx
call edi
lea eax, [esp + 0x34]
push 0x592fac
push eax
call edi
lea ecx, [esp + 0x34]
push 0x592fa8
push ecx
call edi
lea edx, [esp + 0x34]
push 0x592fa4
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esp + 0x34]
push ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], ebx
call ebp
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esi + 4]
call fcn.00512074
lea edx, [esp + 0x23c]
push ebx
lea eax, [esp + 0x13c]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.MPR.dll_WNetAddConnection2A
test eax, eax
mov ecx, 0x41
jne 0x43b203
mov edx, dword [0x5a1eb8]
xor eax, eax
lea edi, [esp + 0x138]
push esi
rep stosd dword es:[edi], eax
push edx
mov ecx, 0x5a1eb0
call fcn.0050ccf6
cmp dword [esi + 0x10], ebx
je 0x43b1fc
mov ecx, esi
call fcn.0043aeb0
push ebx
call ebp
xor eax, eax
jmp 0x43b214
xor eax, eax
lea edi, [esp + 0x138]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x340]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x33c
ret