joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44714e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4926d8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4bea34]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x4bea34]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push 0x1000
mov edi, ecx
mov esi, edx
mov dword [esp + 0x18], eax
call fcn.0046fb9a
push dword [esp + 0x18]
mov ebx, eax
push esi
push 0x800
push ebx
mov dword [esp + 0x2c], ebx
call fcn.00478365
add esp, 0x14
test eax, eax
jle 0x447311
and word [ebx + eax*2], 0
mov eax, dword [edi + 0x18]
add edi, 0x10
cmp dword [edi + 4], eax
mov dword [esp + 0x14], eax
jbe 0x4471d4
call fcn.0047122b
mov ebx, dword [edi + 4]
cmp ebx, dword [edi + 8]
jbe 0x4471e1
call fcn.0047122b
test edi, edi
je 0x4471e9
cmp edi, edi
je 0x4471ee
call fcn.0047122b
cmp ebx, dword [esp + 0x14]
je 0x44724e
push dword [esp + 0x18]
lea eax, [esp + 0x20]
call fcn.004040e1
and dword [esp + 0x80], 0
test edi, edi
jne 0x447212
call fcn.0047122b
cmp ebx, dword [edi + 8]
jb 0x44721c
call fcn.0047122b
mov ecx, dword [ebx]
mov eax, dword [ecx]
lea edx, [esp + 0x1c]
push edx
push dword [ebp + 8]
call dword [eax]
or dword [esp + 0x80], 0xffffffff
push 0
push 1
lea esi, [esp + 0x24]
call fcn.004012a8
cmp ebx, dword [edi + 8]
jb 0x447249
call fcn.0047122b
add ebx, 4
jmp 0x4471e1
and dword [esp + 0x68], 0
and word [esp + 0x58], 0
mov dword [esp + 0x6c], 7
mov al, byte [ebp + 8]
xor edi, edi
inc edi
test al, 1
mov dword [esp + 0x80], edi
je 0x447279
mov esi, str.DEBUG
jmp 0x447298
test al, 2
je 0x447284
mov esi, str.INFO
jmp 0x447298
test al, 4
je 0x44728f
mov esi, str.WARNING
jmp 0x447298
test al, 8
je 0x4472aa
mov esi, str.ERROR
push esi
call fcn.0047137a
pop ecx
mov ecx, esi
lea esi, [esp + 0x54]
call fcn.00404a96
push 0
lea eax, [esp + 0x3c]
push eax
call fcn.004473a4
cmp dword [esp + 0x6c], 8
mov ecx, dword [esp + 0x58]
jae 0x4472c5
lea ecx, [esp + 0x58]
cmp dword [eax + 0x18], 8
jb 0x4472d0
mov eax, dword [eax + 4]
jmp 0x4472d3
add eax, 4
push dword [esp + 0x18]
push ecx
push eax
push str.__s____8s_s
call fcn.004735d3
add eax, 0x20
push eax
call fcn.00475af1
add esp, 0x14
push 0
push edi
lea esi, [esp + 0x40]
call fcn.004012a8
push dword [esp + 0x18]
call fcn.00470b5f
pop ecx
push 0
push edi
lea esi, [esp + 0x5c]
call fcn.004012a8
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00470af5
mov esp, ebp
pop ebp
ret 8
Function at 0x4475d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4bea34]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push esi
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov edi, ecx
mov esi, edx
call fcn.00471300
add esp, 0xc
cmp dword [edi + 0x1c], 8
jb 0x44761a
mov edi, dword [edi + 8]
jmp 0x44761d
add edi, 8
lea eax, [ebp - 0x20c]
push eax
push 0
push str.divx
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x44763a
xor al, al
jmp 0x447654
lea eax, [ebp - 0x20c]
push eax
call fcn.0047137a
pop ecx
lea ecx, [ebp - 0x20c]
call fcn.00404a96
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00470af5
leave
ret

Function at 0x447662
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x1b0]
sub esp, 0x230
mov eax, dword [0x4bea34]
xor eax, ebp
mov dword [ebp + 0x1ac], eax
cmp dword [esi + 0x18], 8
push ebx
push edi
lea ebx, [esi + 4]
jb 0x44768c
mov eax, dword [ebx]
jmp 0x44768e
mov eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0
lea ecx, [ebp - 0x5c]
push ecx
push eax
call edi
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x60], eax
jb 0x4476a8
mov ebx, dword [ebx]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
call edi
mov ecx, dword [ebp - 0x60]
xor eax, eax
mov word [ebp + ecx*2 - 0x5c], ax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6e], eax
mov dword [ebp - 0x6a], eax
lea eax, [ebp - 0x80]
lea ecx, [ebp - 0x5c]
push eax
mov dword [ebp - 0x7c], 3
mov dword [ebp - 0x78], ecx
mov word [ebp - 0x70], 0x494
mov dword [ebp - 0x66], 0x49fc6c
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp + 0x1ac]
pop edi
xor ecx, ebp
pop ebx
call fcn.00470af5
add ebp, 0x1b0
leave
ret
Function at 0x447701
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x493fd0
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x4bea34]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
push esi
push edi
mov eax, dword [0x4bea34]
xor eax, esp
push eax
lea eax, [esp + 0x2a8]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push ebx
lea edi, [esp + 0x20]
mov dword [esp + 0x30], ecx
call fcn.0044243d
and dword [esp + 0x2b0], 0
push 0x4a5968
lea esi, [esp + 0x18]
call fcn.004423fd
mov eax, esi
push eax
mov ecx, edi
mov byte [esp + 0x2b4], 1
call fcn.00442544
mov eax, esi
mov byte [esp + 0x2b0], 0
call fcn.004424c3
lea eax, [esp + 0x4c]
push eax
mov eax, edi
call fcn.004427cc
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x78]
push 0x4a45c4
push eax
call fcn.004786a5
test eax, eax
pop ecx
pop ecx
je 0x4478f8
lea eax, [esp + 0x78]
push 0x4a5970
push eax
call fcn.004786a5
test eax, eax
pop ecx
pop ecx
je 0x4478f8
test byte [esp + 0x4c], 0x10
push ebx
je 0x447867
lea edi, [esp + 0x1c]
call fcn.0044243d
lea eax, [esp + 0x78]
push eax
lea esi, [esp + 0x28]
mov byte [esp + 0x2b4], 2
call fcn.004423fd
mov eax, esi
push eax
mov ecx, edi
mov byte [esp + 0x2b4], 3
call fcn.00442544
mov eax, esi
mov byte [esp + 0x2b0], 2
call fcn.004424c3
mov eax, edi
call fcn.004427cc
push eax
lea eax, [esp + 0x34]
call fcn.004040e1
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x2b4], 4
call fcn.00447701
push 0
push 1
lea esi, [esp + 0x38]
call fcn.004012a8
mov eax, edi
call fcn.004427cc
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, edi
jmp 0x4478eb
lea edi, [esp + 0x18]
call fcn.0044243d
lea eax, [esp + 0x78]
push eax
lea esi, [esp + 0x24]
mov byte [esp + 0x2b4], 5
call fcn.004423fd
mov eax, esi
push eax
mov ecx, edi
mov byte [esp + 0x2b4], 6
call fcn.00442544
mov eax, esi
mov byte [esp + 0x2b0], 5
call fcn.004424c3
test byte [esp + 0x4c], 1
je 0x4478c2
push 0x80
mov eax, edi
call fcn.004427cc
push eax
call fcn.004786d7
pop ecx
pop ecx
lea eax, [esp + 0x14]
call fcn.004427cc
push eax
lea eax, [esp + 0x34]
call fcn.004040e1
lea esi, [esp + 0x30]
call fcn.00447662
push 0
push 1
call fcn.004012a8
lea eax, [esp + 0x14]
mov byte [esp + 0x2b0], 0
call fcn.004424c3
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4477a0
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x1c]
call fcn.004424c3
mov ecx, dword [esp + 0x2a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x290]
xor ecx, esp
call fcn.00470af5
mov esp, ebp
pop ebp
ret 4
Function at 0x447995
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x491a16
call fcn.00479dd6
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [edi], vtable.AsyncDownloadImplWin.0
lea esi, [edi + 8]
mov dword [edi + 4], ebx
call fcn.004011a0
mov eax, dword [ebp + 0x10]
lea esi, [edi + 0x24]
mov byte [ebp - 4], 1
call fcn.004011a0
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], 1
mov dword [edi + 0x64], 7
mov dword [edi + 0x60], ebx
lea eax, [edi + 0x70]
mov word [edi + 0x50], bx
push eax
mov byte [edi + 0x68], bl
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ebx
push ebx
push edi
push 0x447a76
push ebx
push ebx
call fcn.00470a47
mov dword [edi + 0x6c], eax
add esp, 0x18
mov eax, edi
call fcn.00479eae
ret 0xc

Function at 0x4483da
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [ebp + 0xc]
mov byte [ebp - 1], 0
call fcn.00404123
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jne 0x4483fe
xor al, al
jmp 0x448484
cmp dword [ebx + 0x18], 8
lea esi, [ebx + 4]
jb 0x44840b
mov ecx, dword [esi]
jmp 0x44840d
mov ecx, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 8]
push edx
push 0
lea edx, [ebp - 0x10]
push edx
push 0
push ecx
push eax
call edi
test eax, eax
jne 0x448481
cmp dword [ebp - 0x10], 1
jne 0x448481
mov eax, dword [ebp - 8]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046fb9a
test eax, eax
pop ecx
mov dword [ebp - 0xc], eax
je 0x448481
cmp dword [ebx + 0x18], 8
jb 0x448454
mov esi, dword [esi]
lea ecx, [ebp - 8]
push ecx
push eax
mov eax, dword [ebp + 8]
push 0
push 0
push esi
push dword [eax]
call edi
test eax, eax
jne 0x448478
push dword [ebp - 0xc]
mov esi, dword [ebp + 0xc]
call fcn.0040410d
mov byte [ebp - 1], 1
push dword [ebp - 0xc]
call fcn.00470b5f
pop ecx
mov al, byte [ebp - 1]
pop edi
pop esi
leave
ret 8

Function at 0x44848a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebx], 0
push esi
push edi
mov esi, eax
mov edi, ecx
mov byte [ebp - 1], 0
jne 0x4484a2
xor al, al
jmp 0x44850b
mov eax, dword [esi + 0x14]
xor ecx, ecx
push 2
lea eax, [eax + eax + 2]
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046fb9a
cmp dword [esi + 0x18], 8
pop ecx
mov dword [ebp - 8], eax
jb 0x4484cc
mov eax, dword [esi + 4]
jmp 0x4484cf
lea eax, [esi + 4]
push eax
push dword [ebp - 8]
call fcn.00475ad5
cmp dword [edi + 0x18], 8
mov esi, dword [esi + 0x14]
pop ecx
pop ecx
jb 0x4484e8
mov edi, dword [edi + 4]
jmp 0x4484eb
add edi, 4
lea eax, [esi + esi + 2]
push eax
push dword [ebp - 8]
push 1
push 0
push edi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x448508
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop edi
pop esi
leave
ret
Function at 0x44850f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor edx, edx
mov dword [esi], edx
mov ecx, dword [ecx]
cmp ecx, edx
mov byte [ebp - 1], dl
je 0x44856b
cmp dword [eax + 0x14], edx
je 0x44856b
cmp dword [eax + 0x18], 8
mov dword [ebp - 8], 4
jb 0x448539
mov eax, dword [eax + 4]
jmp 0x44853c
add eax, 4
push ebx
lea ebx, [ebp - 8]
push ebx
lea ebx, [ebp - 0x10]
push ebx
lea ebx, [ebp - 0xc]
push ebx
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
pop ebx
jne 0x448566
cmp dword [ebp - 0xc], 4
jne 0x448566
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
leave
ret
xor al, al
leave
ret

Function at 0x44856f
Capabilities:
Set registry value

Disassembly:
mov eax, dword [eax]
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x44857c
xor al, al
jmp 0x4485a4
cmp dword [ecx + 0x18], 8
jb 0x448587
mov ecx, dword [ecx + 4]
jmp 0x44858a
add ecx, 4
push 4
lea edx, [esp + 0xc]
push edx
push 4
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4485a2
mov bl, 1
mov al, bl
pop ebx
ret 4

Function at 0x449c4d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49ba5b
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4bea34]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
push 0x10c
call fcn.004708e3
pop ecx
mov dword [esp + 0x10], eax
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x20], ebx
je 0x449cbf
push dword [esi + 0xa8]
lea ecx, [esi + 0xac]
push ecx
lea ecx, [esi + 0x124]
push ecx
push dword [ebp + 0x10]
lea ecx, [esi + 0x48]
push dword [ebp + 0xc]
push ecx
push dword [ebp + 8]
lea ecx, [esi + 0x58]
push eax
call fcn.004577a1
mov ebx, eax
or dword [esp + 0x20], 0xffffffff
lea edi, [esi + 0x198]
mov ecx, dword [edi]
test ecx, ecx
je 0x449cd7
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x449cda
and dword [edi], 0
test ebx, ebx
mov dword [edi], ebx
je 0x449ce7
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov edi, dword [esi + 0x198]
mov ecx, edi
call fcn.00457af4
test al, al
jne 0x449cfd
push 0x10
pop eax
jmp 0x449d63
push edi
call fcn.00457d6f
mov ecx, edi
call fcn.00457e16
mov ecx, edi
call fcn.00458246
xor ebx, ebx
cmp dword [edi + 0xdc], ebx
je 0x449d20
push 5
pop eax
jmp 0x449d45
push ebx
push ebx
push edi
push 0x457f39
push ebx
push ebx
call fcn.00470a47
mov ecx, dword [edi + 0xf8]
add esp, 0x18
mov dword [edi + 0xdc], eax
call fcn.00460e20
xor eax, eax
cmp eax, ebx
jne 0x449d63
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x449d61
mov ecx, dword [esi + 0x198]
cmp ecx, ebx
mov dword [eax], ecx
je 0x449d61
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x449d78
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49ba36
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4bea34]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, ecx
push 0xb8
call fcn.004708e3
pop ecx
mov dword [esp + 0x10], eax
xor edi, edi
cmp eax, edi
mov dword [esp + 0x28], edi
je 0x449dec
sub esp, 0x1c
lea eax, [ebx + 0xf8]
mov esi, esp
mov dword [esp + 0x30], esp
call fcn.004011a0
push dword [ebx + 0xa8]
mov edx, dword [ebp + 8]
lea ecx, [ebx + 0x78]
mov ebx, dword [esp + 0x30]
call fcn.0045c0c5
mov esi, eax
jmp 0x449dee
xor esi, esi
cmp esi, edi
mov dword [esp + 0x28], 1
mov dword [esp + 0x14], vtable.dxtl::RefCountedPtr_class_dxi::IInstallSession_.0
mov dword [esp + 0x18], esi
je 0x449e0d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push esi
mov dword [esp + 0x2c], 2
call fcn.0045c2d7
mov ecx, esi
call fcn.0045d889
cmp dword [esi + 0x9c], edi
jne 0x449e54
push edi
push edi
push esi
push 0x45d918
push edi
push edi
call fcn.00470a47
mov dword [esi + 0x9c], eax
mov eax, dword [ebp + 0xc]
add esp, 0x18
cmp eax, edi
je 0x449e57
mov dword [eax], esi
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
jmp 0x449e57
push 5
pop edi
or dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0042abfc
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x454a57
Capabilities:
Download url
Receive data

Disassembly:
push 4
mov eax, 0x490ec7
call fcn.00479dd6
mov ebx, ecx
push 0x10
call fcn.004708e3
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
test esi, esi
je 0x454a92
lea eax, [esi + 4]
push eax
mov dword [esi], vtable.BindStatusCallback.0
call fcn.00454ace
mov dword [esi + 0xc], 1
jmp 0x454a94
xor esi, esi
cmp dword [ebx + 0x18], 8
jb 0x454a9f
mov ebx, dword [ebx + 4]
jmp 0x454aa2
add ebx, 4
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x454ab0
mov eax, dword [eax + 4]
jmp 0x454ab3
add eax, 4
push esi
push 0
push ebx
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileW
xor ecx, ecx
test eax, eax
setge cl
mov al, cl
call fcn.00479eae
ret

Function at 0x461926
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x49685a
call fcn.00479dd6
mov edi, dword [ebp + 8]
lea eax, [edi + 4]
xor ebx, ebx
push eax
mov dword [edi], ebx
call fcn.0045902a
push 0xcc
mov dword [ebp - 4], ebx
call fcn.004708e3
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x461993
push esi
lea ecx, [edi + 4]
call fcn.0045902a
lea eax, [esi + 0xb4]
push eax
mov dword [esi + 0xac], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ebx
push ebx
push esi
push 0x461835
push ebx
push ebx
call fcn.00470a47
add esp, 0x18
mov dword [esi + 0xb0], eax
jmp 0x461995
xor esi, esi
mov dword [edi], esi
mov eax, edi
call fcn.00479eae
ret 4
Function at 0x462029
Capabilities:
Create pipe
Create thread
Create two anonymous pipes

Disassembly:
push 0x2c
push 0x4af080
call fcn.00479bd8
mov edi, dword [ebp + 8]
lea eax, [edi + 0x14]
push eax
call fcn.00462385
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x3c], 0xc
mov dword [ebp - 0x38], ebx
xor esi, esi
inc esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x462161
push 2
push esi
push ebx
lea eax, [ebp - 0x24]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
push eax
push dword [ebp - 0x1c]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x462161
push 2
push ebx
push ebx
lea eax, [edi + 0x1c]
push eax
call esi
push eax
push dword [ebp - 0x20]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x462161
push ebx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x462161
push 2
push ebx
push ebx
lea eax, [edi + 0x18]
push eax
call esi
push eax
push dword [ebp - 0x28]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x462161
lea esi, [ebp - 0x20]
call fcn.0046240f
lea esi, [ebp - 0x28]
call fcn.0046240f
push dword [ebp - 0x24]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.004621d7
lea esi, [ebp - 0x1c]
call fcn.0046240f
lea esi, [ebp - 0x2c]
call fcn.0046240f
lea esi, [ebp - 0x24]
call fcn.0046240f
push ebx
push ebx
xor esi, esi
inc esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 8], eax
lea eax, [edi + 0xc]
push eax
push ebx
push edi
push 0x462313
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 4], eax
cmp eax, ebx
je 0x462161
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.00462185
mov eax, dword [edi + 0x14]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x30]
call fcn.00479c1d
ret 0x10
Function at 0x4621d7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push 0x10
xor esi, esi
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00471300
push 0x44
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00471300
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
or dword [ebp - 0x28], 0x100
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x8000000
push 1
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x54], 0x44
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
pop esi
jne 0x462243
xor eax, eax
jmp 0x462258
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
push dword [ebp - 0xc]
mov dword [ecx + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
leave
ret 0x18

Function at 0x46225c
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x4bea34]
xor eax, ebp
mov dword [ebp + 0x88], eax
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor ebx, ebx
jmp 0x4622ca
cmp dword [ebp - 0x7c], ebx
je 0x4622f5
mov eax, 0xff
cmp dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], ebx
ja 0x462298
mov eax, dword [ebp - 0x7c]
push ebx
lea ecx, [ebp - 0x80]
push ecx
push eax
lea eax, [ebp - 0x78]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4622de
mov eax, dword [ebp - 0x80]
cmp eax, ebx
je 0x4622de
mov byte [ebp + eax - 0x78], bl
lea eax, [ebp - 0x78]
push eax
push 0x4a6e94
call fcn.004733d8
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push ebx
push dword [esi + 0x1c]
mov dword [ebp - 0x7c], ebx
call edi
test eax, eax
jne 0x462283
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x4622fa
cmp eax, 0xe8
je 0x4622fa
or eax, 0xffffffff
jmp 0x4622fc
xor eax, eax
inc eax
jmp 0x4622fc
xor eax, eax
mov ecx, dword [ebp + 0x88]
pop edi
xor ecx, ebp
pop ebx
call fcn.00470af5
add ebp, 0x8c
leave
ret

Function at 0x462385
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
push 0xffffffffffffffff
lea ebx, [edi + 0x20]
push dword [ebx]
call ebp
lea esi, [edi + 0x14]
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esi]
mov ecx, dword [esp + 0x10]
lea esi, [edi + 4]
mov dword [ecx], eax
cmp dword [esi], 0
je 0x4623e6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [edi + 0xc]
je 0x4623e1
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1388
push dword [esi]
call ebp
cmp eax, 0x102
jne 0x4623e1
push 0xfffffffffffffffe
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
call fcn.0046240f
lea esi, [edi + 8]
call fcn.0046240f
mov esi, ebx
call fcn.0046240f
lea esi, [edi + 0x18]
call fcn.0046240f
lea esi, [edi + 0x1c]
call fcn.0046240f
and dword [edi + 0xc], 0
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4626e8
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x4194]
mov eax, 0x4214
call fcn.00484b00
mov eax, dword [0x4bea34]
xor eax, ebp
mov dword [ebp + 0x4190], eax
mov eax, dword [ebp + 0x419c]
push ebx
push esi
push edi
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x7c]
mov ebx, ecx
push eax
xor esi, esi
push ebx
mov dword [ebp - 0x7c], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
je 0x462805
mov edi, 0x2000
cmp eax, edi
ja 0x462805
push edi
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.00471300
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push edi
push dword [ebp - 0x7c]
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x462805
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
push str.VarFileInfoTranslation
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x78], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x462805
cmp dword [ebp - 0x74], 4
jne 0x462805
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov ecx, eax
shr ecx, 0x10
and ecx, 0xff
push ecx
mov ecx, eax
shr ecx, 0x18
push ecx
movzx ecx, al
push ecx
movzx eax, ah
push eax
push str.StringFileInfo_02X_02X_02X_02XCompanyName
mov ecx, 0x100
lea edi, [ebp + 0x3f90]
call fcn.00462699
add esp, 0x14
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
mov eax, edi
push eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x74], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x462805
mov ebx, dword [ebp - 0x74]
cmp ebx, esi
jbe 0x462805
mov eax, 0x208
cmp ebx, eax
jae 0x462805
push eax
push esi
push dword [ebp - 0x80]
call fcn.00471300
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x80]
add esp, 0xc
call fcn.0046264d
mov al, 1
jmp 0x462807
xor al, al
mov ecx, dword [ebp + 0x4190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00470af5
add ebp, 0x4194
leave
ret