joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412a40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x4895f0]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [str.NoDriveAutoRun]
mov edx, dword [0x46d978]
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x18], eax
movzx eax, word [0x46d97c]
mov ecx, 0xf
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
lea edi, [esp + 0x3c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x46d974]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [0x46d97e]
mov dword [esp + 0x20], edx
mov edx, dword [str.NoDriveTypeAutoRun]
mov word [esp + 0x24], ax
mov eax, dword [0x46d924]
mov byte [esp + 0x26], cl
mov ecx, dword [0x46d928]
mov dword [esp + 0x28], edx
mov edx, dword [0x46d92c]
mov dword [esp + 0x2c], eax
movzx eax, word [0x46d930]
mov dword [esp + 0x30], ecx
movzx ecx, byte [0x46d932]
mov dword [esp + 0x34], edx
lea edx, [esp + 0x10]
push edx
mov word [esp + 0x3c], ax
mov byte [esp + 0x3e], cl
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x44]
push ecx
mov ebp, 1
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, ebx
mov esi, ebp
call fcn.00412980
cmp eax, 2
mov edi, 0x3ffffff
je 0x412b12
cmp dword [esp + 0x10], edi
jb 0x412b40
mov dword [esp + 0x14], 0
jmp 0x412b16
mov dword [esp + 0x14], ebp
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x44]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, ebx
call fcn.00412980
cmp eax, 2
je 0x412b57
cmp dword [esp + 0x10], 0xff
jae 0x412b55
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0044ce74
add esp, 0x6c
ret
xor ebp, ebp
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x44]
push ecx
push SysReAllocStringLen
mov ecx, ebx
call fcn.00412980
cmp eax, 2
je 0x412b81
cmp dword [esp + 0x10], edi
jb 0x412bbb
xor edi, edi
jmp 0x412b83
mov edi, esi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x44]
push ecx
push SysReAllocStringLen
mov ecx, ebx
call fcn.00412980
cmp eax, 2
je 0x412bb1
cmp dword [esp + 0x10], 0xff
jb 0x412bbb
xor esi, esi
jmp 0x412bb3
mov edi, esi
or esi, edi
or esi, ebp
or esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x78]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044ce74
add esp, 0x6c
ret
Function at 0x412f60
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
xor ebp, ebp
push esi
mov dword [esp + 0x14], ecx
xor ebx, ebx
mov edi, SysReAllocStringLen
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x412ff6
push 0x80
mov ebp, 1
push esi
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [esp + 0x10]
add edx, 0x2e60c
mov eax, esi
sub edx, esi
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, ebp
test cl, cl
jne 0x412fb0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x412fe4
push str.Reboot
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov eax, dword [esp + 0x24]
mov dword [eax], 0x40000000
mov edi, 0x40000000
jmp 0x412fe9
mov edi, 4
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ebx, ebp
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
push edi
call eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x41300c
mov dword [eax], edi
test ebp, ebp
jne 0x413022
cmp dword [esp + 0x14], ebp
je 0x413022
mov ecx, dword [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret 0xc
Function at 0x414600
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
xor ebx, ebx
call fcn.00414590
mov esi, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push esi
push ebx
push 1
mov ebp, eax
call edi
test eax, eax
je 0x414680
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x41468b
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebp
push esi
push ebx
push 1
call edi
test eax, eax
je 0x414674
cmp ebx, 0x1388
jge 0x414672
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
call ebp
push esi
push 0
push 1
add ebx, 0xc8
call edi
test eax, eax
jne 0x414645
cmp ebx, 0x1388
jg 0x414689
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x414d50
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push eax
xor esi, esi
push esi
push 0x1f0fff
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
cmp ebx, esi
je 0x414e5f
mov ecx, dword [ebp + 0x2e09c]
mov edx, dword [esp + 0x14]
push ecx
push edx
push ebx
mov ecx, ebp
call fcn.004164c0
test eax, eax
je 0x414e1f
push edi
push 0x130
lea edi, [ebp + 0x2e4ac]
push esi
push edi
call fcn.0044cf00
mov eax, dword [ebp + 0x2e09c]
mov esi, eax
add esp, 0xc
add eax, 4
push eax
mov eax, dword [esp + 0x20]
mov ecx, 0x4c
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, ebp
mov dword [ebp + 0x2e4a8], 1
call fcn.004166b0
cmp dword [ebp + 0x2e4a0], 0
pop edi
je 0x414e53
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp]
test eax, eax
mov eax, dword [edx + 0x1c]
mov ecx, ebp
je 0x414e04
push 2
call eax
push ebx
mov esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc
push SysReAllocStringLen
call eax
push ebx
mov esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc
mov ecx, dword [ebp + 0x2e09c]
push 0x130
push esi
push ecx
call fcn.0044cf00
mov ebp, dword [ebp + 0x2e09c]
add esp, 0xc
mov byte [ebp + 4], 0
mov dword [ebp], esi
mov dword [ebp + 0x108], esi
mov dword [ebp + 0x104], esi
mov dword [ebp + 0x10c], esi
push ebx
mov esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x415a40
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
cmp dword [ecx + 0x2e5e0], 0
push esi
mov esi, 1
je 0x415a77
push edi
mov edi, dword [esp + 0xc]
push 0x20
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x415a6b
lea esi, [eax + 2]
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
pop edi
mov eax, esi
pop esi
ret 4
Function at 0x417c30
Capabilities:
Delete registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x417c54
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [esi]
push eax
push edi
call ebx
mov esi, dword [esi + 4]
test esi, esi
jne 0x417c45
pop edi
pop ebx
pop esi
ret 8

Function at 0x417e70
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub esp, 0x404
mov eax, dword [0x4895f0]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
push edi
mov edi, dword [esp + 0x414]
xor ebx, ebx
push 0x3ff
lea eax, [esp + 0xd]
push ebx
push eax
mov byte [esp + 0x14], bl
call fcn.0044cf00
add esp, 0xc
test edi, edi
je 0x417f88
push esi
mov esi, dword [esp + 0x414]
push esi
push edi
push str._PATH_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, esi
jge 0x417f8c
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x417ed0
sub eax, edx
cmp byte [edi + eax - 1], 0x3b
lea esi, [eax + 1]
je 0x417eed
mov byte [edi + esi - 1], 0x3b
add esi, 1
push ebp
push 0x400
lea ecx, [esp + 0x14]
push ecx
lea ebp, [edi + esi - 1]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x417f90
lea ecx, [esp + 0x10]
lea ebx, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x417f11
sub ecx, ebx
mov ebx, dword [esp + 0x418]
add esi, ecx
cmp esi, ebx
jge 0x417f90
push eax
lea edx, [esp + 0x14]
push edx
push ebp
call fcn.0044d660
add esp, 0xc
mov byte [edi + esi - 1], 0x3b
push 0x400
lea eax, [esp + 0x14]
add esi, 1
push eax
lea edi, [edi + esi - 1]
mov byte [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x417f90
lea ecx, [esp + 0x10]
lea ebp, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x417f64
sub ecx, ebp
add esi, ecx
cmp esi, ebx
jg 0x417f90
push eax
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.0044d660
add esp, 0xc
mov eax, esi
jmp 0x417f92
mov eax, ebx
jmp 0x417f94
mov eax, ebx
jmp 0x417f93
xor eax, eax
pop ebp
pop esi
mov ecx, dword [esp + 0x408]
pop edi
pop ebx
xor ecx, esp
call fcn.0044ce74
add esp, 0x404
ret 8
Function at 0x418220
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1008
call fcn.0044ced0
mov eax, dword [0x4895f0]
xor eax, esp
mov dword [esp + 0x1004], eax
push ebx
push ebp
mov ebp, dword [esp + 0x1018]
push esi
push edi
xor ebx, ebx
push 0x7ff
lea eax, [esp + 0x819]
push ebx
push eax
mov dword [esp + 0x1c], ecx
xor esi, esi
mov byte [esp + 0x820], bl
call fcn.0044cf00
push 0x7ff
lea ecx, [esp + 0x25]
push ebx
push ecx
mov byte [esp + 0x2c], bl
call fcn.0044cf00
mov edi, dword [esp + 0x1034]
add esp, 0x18
cmp edi, ebx
je 0x41837e
lea esi, [esp + 0x14]
mov eax, edi
sub esi, edi
mov cl, byte [eax]
mov byte [esi + eax], cl
add eax, 1
cmp cl, bl
jne 0x418293
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4182a4
mov ecx, dword [esp + 0x10]
sub eax, edx
push ebp
add eax, 1
push eax
lea edx, [esp + 0x1c]
push edx
push 0x800
call fcn.00418120
test eax, eax
je 0x418377
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x418377
mov eax, edi
mov cl, byte [eax]
mov byte [esi + eax], cl
add eax, 1
cmp cl, bl
jne 0x4182e5
xor esi, esi
cmp byte [esp + 0x14], bl
je 0x418371
lea esp, [esp]
cmp byte [esp + esi + 0x14], 0x20
jne 0x418368
mov byte [esp + esi + 0x14], bl
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x14]
mov byte [esp + eax + 0x814], cl
add eax, 1
cmp cl, bl
jne 0x418310
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x418327
sub eax, edx
push ebp
add eax, 1
push eax
lea ecx, [esp + 0x81c]
push ecx
mov ecx, dword [esp + 0x1c]
push 0x800
call fcn.00418120
test eax, eax
je 0x418377
lea edx, [esp + 0x814]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x418377
mov byte [esp + esi + 0x14], 0x20
add esi, 1
cmp byte [esp + esi + 0x14], bl
jne 0x418300
cmp byte [esp + esi + 0x14], bl
je 0x418382
mov eax, 1
jmp 0x418384
mov eax, esi
jmp 0x418384
xor eax, eax
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044ce74
add esp, 0x1008
ret 8
Function at 0x4189c0
Capabilities:
Read file on windows

Disassembly:
add ecx, 0x4030
jmp fcn.0041b450

Function at 0x4189d0
Capabilities:
Create thread
Enumerate processes

Disassembly:
sub esp, 0x130
mov eax, dword [0x4895f0]
xor eax, esp
mov dword [esp + 0x12c], eax
push esi
push edi
xor edi, edi
push 0x124
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 0x128
call fcn.0044cf00
add esp, 0xc
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x418adf
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x418afb
push ebx
lea ecx, [ecx]
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
mov ebx, eax
lea eax, [esp + 0x34]
push eax
push str.winlogon.exe
call fcn.0044e806
add esp, 8
test eax, eax
je 0x418a57
test ebx, ebx
jne 0x418a30
mov ecx, dword [esp + 0x18]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x418af8
push str.sfc.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x418af8
push 2
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
test esi, esi
je 0x418af8
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.0044ce74
add esp, 0x130
ret
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.0044ce74
add esp, 0x130
ret
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x134]
pop edi
pop esi
xor ecx, esp
call fcn.0044ce74
add esp, 0x130
ret

Function at 0x418d50
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x463a1c
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4895f0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.KTPELib.0
cmp dword [esi + 0x402c], 0
mov dword [esp + 0x14], 1
je 0x418d94
call fcn.00418c70
cmp dword [esi + 0x4020], 0x10
jb 0x418da5
mov eax, dword [esi + 0x400c]
jmp 0x418dab
lea eax, [esi + 0x400c]
mov ecx, dword [esi + 0x4050]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esi + 0x4030]
mov byte [esp + 0x14], 0
call fcn.0041b4d0
cmp dword [esi + 0x4020], 0x10
jb 0x418de1
mov edx, dword [esi + 0x400c]
push edx
call fcn.004282df
add esp, 4
mov dword [esi + 0x4020], 0xf
mov dword [esi + 0x401c], 0
mov byte [esi + 0x400c], 0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x418e30
Capabilities:
Get file attributes
Parse pe header
Set file attributes

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebp, ebp
mov eax, edi
mov esi, ecx
mov dword [esp + 0x10], ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x418e46
sub eax, edx
push eax
push edi
lea ecx, [esi + 0x4008]
call fcn.0040c030
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0x80
push edi
mov dword [esi + 0x4050], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0x1c]
push 3
push eax
lea ebx, [esi + 0x4030]
push edi
mov ecx, ebx
call fcn.0041b400
test eax, eax
je 0x419031
mov ecx, ebx
call fcn.00410630
cmp eax, 0x200
mov dword [esi + 0x403c], eax
jb 0x419031
push 0x40
lea edi, [esi + 0x4054]
push edi
mov ecx, ebx
call fcn.0041b450
test eax, eax
je 0x419031
cmp word [edi], 0x5a4d
jne 0x419031
mov ecx, dword [esi + 0x4090]
push 0
push ecx
mov ecx, esi
call fcn.004189b0
cmp eax, dword [esi + 0x4090]
jne 0x419031
push 0xf8
lea edi, [esi + 0x4094]
push edi
mov ecx, ebx
call fcn.0041b450
test eax, eax
je 0x419031
cmp dword [edi], 0x4550
jne 0x419031
movzx edx, word [esi + 0x40a8]
movzx eax, word [esi + 0x409a]
mov ecx, dword [esi + 0x4090]
lea edi, [edx + ecx + 0x18]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
add edx, edx
push edx
mov dword [esi + 0x4044], eax
mov dword [esi + 0x4024], edi
call fcn.004282da
add esp, 4
test eax, eax
mov dword [esi + 0x418c], eax
je 0x419031
push 0
push edi
mov ecx, esi
call fcn.004189b0
cmp eax, edi
jne 0x419031
mov eax, dword [esi + 0x4044]
mov ecx, dword [esi + 0x418c]
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push ecx
mov ecx, ebx
call fcn.0041b450
test eax, eax
je 0x419031
mov edx, dword [esi + 0x40c8]
mov eax, dword [esi + 0x40bc]
mov ecx, dword [esi + 0x40e4]
mov dword [esi + 0x4048], edx
lea edx, [esp + 0x10]
push edx
mov dword [esi + 0x404c], ecx
push eax
mov ecx, esi
mov dword [esi + 0x4040], eax
call fcn.004188c0
test eax, eax
je 0x419031
mov edi, dword [esp + 0x10]
push 0
push edi
mov ecx, esi
call fcn.004189b0
cmp eax, edi
jne 0x419031
push 0x4000
lea eax, [esi + 4]
push eax
mov ecx, ebx
call fcn.0041b450
test eax, eax
je 0x419031
mov ecx, dword [esi + 0x4090]
add ecx, 0x78
push 0
push ecx
mov ecx, esi
mov dword [esi + 0x4004], eax
call fcn.004189b0
mov edx, dword [esi + 0x4090]
add edx, 0x78
cmp eax, edx
jne 0x419031
push 0x80
lea eax, [esi + 0x4194]
push eax
mov ecx, ebx
call fcn.0041b450
test eax, eax
je 0x419031
mov ebp, 1
mov dword [esi + 0x402c], ebp
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x419070
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1004
call fcn.0044ced0
mov eax, dword [0x4895f0]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push ebx
mov ebx, dword [esp + 0x1010]
push ebp
push edi
xor ebp, ebp
xor edi, edi
test ebx, ebx
je 0x41912d
push esi
push 0x469b68
push eax
mov dword [ebx], edi
call fcn.0044deec
mov esi, eax
add esp, 8
test esi, esi
je 0x419129
push esi
push 0x1000
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0044e19b
add esp, 0x10
test eax, eax
je 0x4190fc
push eax
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.0040cbb0
push esi
push 0x1000
lea edx, [esp + 0x24]
push 1
push edx
add edi, eax
call fcn.0044e19b
add esp, 0x1c
test eax, eax
jne 0x4190d5
mov dword [ebx], edi
push esi
mov edi, 1
call fcn.0044da9a
add esp, 4
mov eax, edi
pop esi
mov ecx, dword [esp + 0x100c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044ce74
add esp, 0x1004
ret 8
mov eax, ebp
jmp 0x41910e
mov eax, ebp
jmp 0x41910f

Function at 0x419140
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor ebp, ebp
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
mov dword [ebx], ebp
mov dword [ebx + 4], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebp
je 0x4191df
push edi
push esi
call fcn.004282da
mov edi, eax
add esp, 4
cmp edi, ebp
je 0x4191d3
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
push edi
push esi
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4191ca
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0x469140
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4191ca
cmp dword [esp + 0x14], ebp
jbe 0x4191c5
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 8]
mov dword [ebx + 4], ecx
mov edx, dword [eax + 0xc]
mov dword [ebx], edx
mov ebp, 1
push edi
call fcn.004282df
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret 8
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x41aab0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x41b400
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
push esi
push edi
xor edi, edi
push edi
push edi
push eax
push edi
mov esi, ecx
mov ecx, dword [esp + 0x20]
push 3
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x41b43f
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
lea eax, [edi + 1]
pop edi
pop esi
ret 0xc
mov eax, edi
pop edi
pop esi
ret 0xc

Function at 0x41b450
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
ret 8

Function at 0x41b470
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
Function at 0x41b500
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x154]
sub esp, 0x154
push 0xfffffffffffffffe
push 0x47f688
push 0x44eff0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4895f0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x150], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x15c]
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 0xffffffff
mov byte [ebp], bl
push 0x14f
push ebx
lea eax, [ebp + 1]
push eax
call fcn.0044cf00
add esp, 0xc
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, 0xffffffff
jne 0x41b59a
mov dword [ebp - 4], 0xfffffffe
jmp 0x41b6c3
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x28], eax
add eax, 0xffffec78
cmp eax, 0x7ffec78
ja 0x41b58e
push ebx
push ebx
push ebx
push esi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call edi
push ebx
lea ecx, [ebp - 0x1c]
push ecx
push 0x40
lea edx, [ebp]
push edx
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
call ebx
test eax, eax
jne 0x41b5e1
mov dword [ebp - 4], 0xfffffffe
jmp 0x41b6c3
cmp dword [ebp - 0x1c], 0x40
je 0x41b5f3
mov dword [ebp - 4], 0xfffffffe
jmp 0x41b6c3
cmp word [ebp], 0x5a4d
je 0x41b607
mov dword [ebp - 4], 0xfffffffe
jmp 0x41b6c3
mov eax, dword [ebp - 0x28]
lea ecx, [eax - 0x200]
mov eax, dword [ebp + 0x3c]
cmp eax, ecx
jl 0x41b623
mov dword [ebp - 4], 0xfffffffe
jmp 0x41b6c3
push 0
push 0
push eax
push esi
call edi
push 0
lea edx, [ebp - 0x1c]
push edx
push 0xf8
lea eax, [ebp]
push eax
push esi
call ebx
test eax, eax
jne 0x41b64a
mov dword [ebp - 4], 0xfffffffe
jmp 0x41b6c3
cmp dword [ebp - 0x1c], 0xf8
je 0x41b65c
mov dword [ebp - 4], 0xfffffffe
jmp 0x41b6c3
cmp dword [ebp], 0x4550
je 0x41b66e
mov dword [ebp - 4], 0xfffffffe
jmp 0x41b6c3
mov ax, word [ebp + 0x5c]
cmp ax, 1
je 0x41b58e
cmp ax, 8
je 0x41b58e
cmp dword [ebp + 0x88], 0
je 0x41b58e
cmp dword [ebp + 0x8c], 0
je 0x41b58e
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x41b6c3
cmp esi, 0xffffffff
je 0x41b6cf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x150]
xor ecx, ebp
call fcn.0044ce74
add ebp, 0x154
mov esp, ebp
pop ebp
ret
Function at 0x41b700
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x408
mov eax, dword [0x4895f0]
xor eax, esp
mov dword [esp + 0x404], eax
push ebp
push esi
mov esi, dword [esp + 0x414]
push edi
mov edi, dword [esp + 0x41c]
xor ebp, ebp
push 0x3ff
lea eax, [esp + 0x15]
push ebp
push eax
mov dword [esp + 0x18], ebp
mov byte [esp + 0x1c], 0
call fcn.0044cf00
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41b7a6
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ebx, [ebx]
mov eax, dword [esp + 0xc]
push 0x400
lea edx, [esp + 0x14]
push edx
push 0
push eax
call esi
test eax, eax
jne 0x41b78f
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.0041b700
add esp, 8
test eax, eax
jne 0x41b760
jmp 0x41b7a6
mov eax, dword [esp + 0xc]
push 0x479918
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x41b7a6
lea ebp, [eax + 1]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41b7b5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x410]
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.0044ce74
add esp, 0x408
ret

Function at 0x41b7d0
Capabilities:
Delete registry value

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
neg eax
sbb eax, eax
add eax, 1
ret