joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b493
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov byte [ebp - 1], bl
cmp dword [esi + 0x4c], ebx
je 0x41b4c5
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x64
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41b4c0
mov byte [ebp - 1], 1
cmp dword [esi + 0x4c], ebx
jne 0x41b4c9
mov byte [ebp - 1], 1
cmp byte [ebp - 1], bl
je 0x41b4e9
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push esi
push 0x41c9c4
push ebx
push ebx
call fcn.0046e1f5
add esp, 0x18
mov dword [esi + 0x4c], eax
pop esi
pop ebx
leave
ret

Function at 0x41b4ed
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov eax, 0x4d9bc0
call fcn.0046d048
sub esp, 0x58
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0xc], bl
je 0x41b50c
xor eax, eax
jmp 0x41b63a
push edi
mov edi, 0x521388
lea ecx, [esi + 0xc4]
push edi
call fcn.004ce0b5
lea ecx, [esi + 0xc8]
push edi
call fcn.004ce0b5
lea ecx, [ebp - 0x64]
call fcn.0042588d
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], ebx
call fcn.004259e0
test eax, eax
je 0x41b550
lea eax, [ebp - 0x38]
lea ecx, [esi + 0xc4]
push eax
call fcn.004ce065
lea ecx, [ebp - 0x64]
call fcn.00425a66
test eax, eax
je 0x41b56b
lea eax, [ebp - 0x38]
lea ecx, [esi + 0xc8]
push eax
call fcn.004ce065
push ebx
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
lea ecx, [ebp - 0x10]
push 4
push ecx
push 0x1006
push 0xffff
push eax
mov dword [esi + 8], eax
mov dword [ebp - 0x10], 0xbb8
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x24]
pop edi
push edi
push ebx
push eax
call fcn.0046d250
add esp, 0xc
mov word [ebp - 0x24], 2
push 0x76c
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x24]
push edi
push eax
push dword [esi + 8]
mov dword [ebp - 0x20], ebx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x41b60a
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
call esi
push eax
push 0x514cb0
push 0x523c78
call fcn.0041cf6f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041ccf4
mov esi, eax
push 0xa
mov ecx, esi
call fcn.0041ce14
mov ecx, esi
call fcn.0048091a
jmp 0x41b62b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_getsockname]
push 1
mov ecx, esi
pop ebx
mov byte [esi + 0xc], bl
call fcn.0041b493
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.00425939
mov eax, ebx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41b4fb
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov eax, 0x4d9bc0
call fcn.0046d048
sub esp, 0x58
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0xc], bl
je 0x41b50c
xor eax, eax
jmp 0x41b63a
push edi
mov edi, 0x521388
lea ecx, [esi + 0xc4]
push edi
call fcn.004ce0b5
lea ecx, [esi + 0xc8]
push edi
call fcn.004ce0b5
lea ecx, [ebp - 0x64]
call fcn.0042588d
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], ebx
call fcn.004259e0
test eax, eax
je 0x41b550
lea eax, [ebp - 0x38]
lea ecx, [esi + 0xc4]
push eax
call fcn.004ce065
lea ecx, [ebp - 0x64]
call fcn.00425a66
test eax, eax
je 0x41b56b
lea eax, [ebp - 0x38]
lea ecx, [esi + 0xc8]
push eax
call fcn.004ce065
push ebx
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
lea ecx, [ebp - 0x10]
push 4
push ecx
push 0x1006
push 0xffff
push eax
mov dword [esi + 8], eax
mov dword [ebp - 0x10], 0xbb8
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x24]
pop edi
push edi
push ebx
push eax
call fcn.0046d250
add esp, 0xc
mov word [ebp - 0x24], 2
push 0x76c
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x24]
push edi
push eax
push dword [esi + 8]
mov dword [ebp - 0x20], ebx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x41b60a
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
call esi
push eax
push 0x514cb0
push 0x523c78
call fcn.0041cf6f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041ccf4
mov esi, eax
push 0xa
mov ecx, esi
call fcn.0041ce14
mov ecx, esi
call fcn.0048091a
jmp 0x41b62b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_getsockname]
push 1
mov ecx, esi
pop ebx
mov byte [esi + 0xc], bl
call fcn.0041b493
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.00425939
mov eax, ebx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41b84f
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, 0x4d9be8
call fcn.0046d048
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
push 0x521388
lea ecx, [ebp - 0x10]
mov eax, dword [esi + 8]
mov dword [ebp - 0x14], eax
call fcn.004cdf9a
mov eax, dword [esi + 0xc4]
and dword [ebp - 4], 0
lea edi, [esi + 0xc4]
mov ebx, dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [eax - 8]
cmp ecx, 4
jle 0x41b8a2
push eax
call ebx
cmp al, 0xa
je 0x41b8c7
cmp al, 0xc0
jne 0x41b8a2
cmp ah, 0xa8
je 0x41b8c7
mov eax, dword [esi + 0xc8]
add esi, 0xc8
cmp dword [eax - 8], 4
jle 0x41b8d3
push dword [edi]
call ebx
cmp al, 0xa
je 0x41b8ca
cmp al, 0xc0
jne 0x41b8d3
cmp ah, 0xa8
je 0x41b8ca
jmp 0x41b8d3
push edi
jmp 0x41b8cb
push esi
lea ecx, [ebp - 0x10]
call fcn.004ce065
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
jne 0x41b8e9
push 0x514d84
lea ecx, [ebp - 0x10]
call fcn.004ce0b5
push 0x10
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0046d250
add esp, 0xc
push dword [ebp - 0x10]
call ebx
push 0x76c
mov dword [ebp - 0x20], eax
mov word [ebp - 0x24], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x24]
push 0x10
push eax
push 0
push dword [ebp + 8]
call fcn.0046d440
pop ecx
push eax
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004cdf2c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x41cbec
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
lea eax, [ebp - 0x104]
push 0x100
push eax
xor edi, edi
xor ebx, ebx
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x41cc6a
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
cmp esi, edi
je 0x41cc6a
cmp word [esi + 0xa], 4
jne 0x41cc6a
mov eax, dword [esi + 0xc]
cmp dword [eax], edi
je 0x41cc6a
movsx ecx, word [esi + 0xa]
push ecx
push dword [edi + eax]
lea eax, [ebp - 4]
push eax
call fcn.0046d4c0
add esp, 0xc
cmp byte [ebp - 4], 0xa
je 0x41cc59
cmp byte [ebp - 4], 0xc0
je 0x41cc59
cmp byte [ebp - 3], 0xa8
jne 0x41cc67
mov eax, dword [esi + 0xc]
add edi, 4
cmp dword [edi + eax], 0
jne 0x41cc33
jmp 0x41cc6a
push 1
pop ebx
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x41cc71
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
lea eax, [ebp - 0x104]
push 0x100
push eax
or ebx, 0xffffffff
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x41cced
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x41cced
cmp word [esi + 0xa], 4
jne 0x41cced
mov eax, dword [esi + 0xc]
cmp dword [eax], edi
je 0x41cced
movsx ecx, word [esi + 0xa]
push ecx
push dword [edi + eax]
lea eax, [ebp - 4]
push eax
call fcn.0046d4c0
mov eax, dword [ebp - 4]
add esp, 0xc
cmp al, 0xa
je 0x41cceb
cmp al, 0xc0
jne 0x41ccdd
cmp ah, 0xa8
je 0x41cceb
mov eax, dword [esi + 0xc]
add edi, 4
cmp dword [edi + eax], 0
jne 0x41ccb9
jmp 0x41cced
mov ebx, eax
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x41e450
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
lea eax, [ebp - 0x108]
xor edi, edi
push 0x100
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x41e4db
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
cmp esi, edi
je 0x41e4db
cmp word [esi + 0xa], 4
jne 0x41e4db
mov eax, dword [esi + 0xc]
cmp dword [eax], edi
je 0x41e4db
push ebx
mov ebx, dword [ebp + 8]
movsx ecx, word [esi + 0xa]
push ecx
push dword [edi + eax]
lea eax, [ebp - 8]
push eax
call fcn.0046d4c0
mov eax, dword [ebx + 4]
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp + 8]
mov ecx, ebx
push eax
call fcn.0041e53a
cmp dword [ebp - 4], 0
jne 0x41e4ce
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xc]
add edi, 4
cmp dword [edi + eax], 0
jne 0x41e49b
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x41ecd3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4d9ff4
call fcn.0046d048
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
call fcn.004d4518
mov esi, dword [eax + 0xc]
push 0x515420
movzx eax, word [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x41ed1b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x41ed1f
xor eax, eax
jmp 0x41ed4b
push 0
push ebx
push eax
lea ecx, [ebp - 0x38]
call fcn.004d2a22
mov ecx, dword [ebp - 0x10]
and dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
call fcn.0041edc4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
mov esi, eax
call fcn.004d2a5e
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x422aca
Capabilities:
Get disk information

Disassembly:
mov eax, 0x4da68c
call fcn.0046d048
sub esp, 0x34
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
push 0
push 0
mov dword [ebp - 0x20], edi
call esi
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x422c93
inc eax
push eax
call fcn.004ce490
pop ecx
mov ebx, eax
push ebx
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x422b1c
push ebx
call fcn.004ce4b9
pop ecx
jmp 0x422c93
lea ecx, [ebp - 0x40]
call fcn.004c9733
xor esi, esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jae 0x422b76
cmp dword [ebp - 0x14], esi
mov byte [ebp - 4], 1
je 0x422b69
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x422b69
push dword [ebp - 0x14]
lea ecx, [ebp - 0x40]
push dword [ebp - 0x38]
call fcn.004c990f
jmp 0x422b69
add dword [ebp - 0x14], 4
add dword [ebp - 0x18], 4
mov dword [ebp - 4], esi
jmp 0x422b2f
push dword [ebp - 0x24]
call fcn.004ce4b9
mov eax, dword [0x521508]
pop ecx
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call fcn.004cee80
push esi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.004cee80
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
call fcn.00417ce4
push 0x805c
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00417d26
lea esi, [ebp - 0x2c]
lea eax, [ebp - 0x28]
neg esi
sbb esi, esi
mov ebx, dword [sym.imp.USER32.dll_AppendMenuA]
and esi, eax
push dword [esi]
push 0x2c6ca
push 1
push dword [edi + 0x5c]
call ebx
push 0x8059
lea ecx, [ebp - 0x2c]
call fcn.00417d26
mov eax, dword [esi]
mov ecx, dword [edi + 0x5c]
push eax
mov eax, dword [ebp - 0x1c]
push ecx
push 0x410
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_InsertMenuA]
cmp dword [ebp - 0x38], 0
jne 0x422c27
push 0x805d
lea ecx, [ebp - 0x2c]
call fcn.00417d26
push dword [esi]
push 0x2c6ca
push 1
push dword [edi + 0x54]
call ebx
xor eax, eax
cmp dword [ebp - 0x38], eax
mov dword [ebp - 0x14], eax
jle 0x422c54
jmp 0x422c36
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x3c]
push dword [ecx + eax*4]
add eax, 0x9100
push eax
push 0
push dword [edi + 0x54]
call ebx
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x38]
jl 0x422c33
push 0x805a
lea ecx, [ebp - 0x2c]
call fcn.00417d26
mov esi, dword [esi]
mov edi, dword [edi + 0x54]
mov eax, dword [ebp - 0x1c]
push esi
push edi
push 0x410
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_InsertMenuA]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00417d12
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004c9766
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4242d3
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
cmp edi, ebx
mov dword [esi + 0x1c], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
jne 0x42436f
lea eax, [ebp - 4]
push eax
push 0x5157b8
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x42436a
lea eax, [ebp - 8]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push ebx
mov dword [ebp - 8], 0x104
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42435d
cmp dword [ebp + 8], 2
je 0x42434d
cmp dword [ebp + 8], 1
jne 0x42435d
mov eax, dword [ebp - 8]
lea edi, [ebp - 0x10c]
mov byte [ebp + eax - 0x10c], bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x42436f
mov edi, 0x5157b0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [esi + 0x1c], eax
je 0x42438d
push 0x5157a4
push eax
call edi
mov dword [esi], eax
mov eax, dword [esi + 0x1c]
cmp eax, ebx
je 0x42439f
push 0x515794
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
cmp eax, ebx
je 0x4243e5
push 0x515784
push eax
call edi
push 0x515778
mov dword [esi + 8], eax
push dword [esi + 0x1c]
call edi
push 0x515768
mov dword [esi + 0xc], eax
push dword [esi + 0x1c]
call edi
push 0x51575c
mov dword [esi + 0x10], eax
push dword [esi + 0x1c]
call edi
push 0x51574c
mov dword [esi + 0x14], eax
push dword [esi + 0x1c]
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi]
cmp eax, ebx
je 0x4243ed
call eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x424634
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4da8ec
call fcn.0046d048
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
xor esi, esi
push eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
cmp eax, esi
jl 0x4246a9
lea eax, [ebp - 0x1c]
push eax
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, esi
je 0x42467d
mov dword [ebp - 0x18], esi
jmp 0x42468c
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
je 0x4246b8
push 0x5157c8
push dword [ebp + 8]
call fcn.0046d140
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4246d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp + 0xc]
push esi
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x424729
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x4247d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
lea eax, [ebp - 0x25c]
push edi
push eax
mov edi, SysReAllocStringLen
push 0x5157f0
push edi
call fcn.004246d0
add esp, 0xc
xor ebx, ebx
test eax, eax
jne 0x4248e4
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x25c]
push 0x5157dc
push eax
call esi
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x25c]
push eax
push edi
call fcn.004246d0
add esp, 0xc
test eax, eax
jne 0x4248e4
lea eax, [ebp - 0x25c]
push 0x5157d4
push eax
call fcn.0046f61a
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x42487f
lea eax, [ebp - 0x25c]
push 0x5149a8
push eax
call fcn.0046e850
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x42487f
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax - 0x25d]
jmp 0x424881
mov byte [edi], bl
push 0x513800
push edi
call esi
push dword [ebp + 8]
push edi
call esi
push 0x44
lea eax, [ebp - 0x54]
pop esi
push esi
push ebx
push eax
call fcn.0046d250
push 0x10
lea eax, [ebp - 0x10]
push ebx
push eax
mov dword [ebp - 0x54], esi
call fcn.0046d250
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x25c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4248e4
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
push 1
pop eax
jmp 0x424901
push dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp + 8]
push 0x5146ec
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x425530
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push 0x94
lea eax, [ebp - 0x94]
push 0
push eax
call fcn.0046d250
add esp, 0xc
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x42556e
xor eax, eax
leave
ret
cmp dword [ebp - 0x84], 1
je 0x42556a
cmp dword [ebp - 0x90], 6
sbb eax, eax
inc eax
leave
ret
Function at 0x425cf3
Capabilities:
Get file version info

Disassembly:
mov eax, 0x4daa6c
call fcn.0046d048
sub esp, 0x124
push ebx
push esi
mov esi, ecx
xor eax, eax
mov ecx, dword [esi + 0x68]
push edi
lea ebx, [esi + 0x68]
mov dword [ebp - 0x20], esi
cmp dword [ecx - 8], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
jne 0x425e03
lea ecx, [ebp - 0x130]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x130]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x425e03
and dword [ebp - 0x1c], 0
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
lea eax, [ebp - 0x130]
push esi
push edi
push dword [ebp - 0x2c]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x513a0c
push esi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 0x18]
mov esi, dword [eax + 0x10]
mov cx, word [eax + 0x10]
mov edi, dword [eax + 0x14]
mov ax, word [eax + 0x14]
mov word [ebp - 0x22], ax
mov eax, dword [0x518cb0]
shr esi, 0x10
mov word [ebp - 0x26], cx
mov dword [ebp - 0x10], eax
shr edi, 0x10
and dword [ebp - 4], 0
push 0x809d
lea ecx, [ebp - 0x10]
call fcn.004cef20
movzx eax, word [ebp - 0x22]
push eax
movzx eax, di
push eax
movzx eax, word [ebp - 0x26]
push eax
movzx eax, si
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004c7e63
add esp, 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004cdf2c
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x14]
add esi, 0x64
mov ecx, dword [ebp + 8]
neg esi
sbb esi, esi
and esi, ebx
push esi
call fcn.004cdca1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x425d04
Capabilities:
Get file version info

Disassembly:
mov eax, 0x4daa6c
call fcn.0046d048
sub esp, 0x124
push ebx
push esi
mov esi, ecx
xor eax, eax
mov ecx, dword [esi + 0x68]
push edi
lea ebx, [esi + 0x68]
mov dword [ebp - 0x20], esi
cmp dword [ecx - 8], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
jne 0x425e03
lea ecx, [ebp - 0x130]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x130]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x425e03
and dword [ebp - 0x1c], 0
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
lea eax, [ebp - 0x130]
push esi
push edi
push dword [ebp - 0x2c]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x513a0c
push esi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 0x18]
mov esi, dword [eax + 0x10]
mov cx, word [eax + 0x10]
mov edi, dword [eax + 0x14]
mov ax, word [eax + 0x14]
mov word [ebp - 0x22], ax
mov eax, dword [0x518cb0]
shr esi, 0x10
mov word [ebp - 0x26], cx
mov dword [ebp - 0x10], eax
shr edi, 0x10
and dword [ebp - 4], 0
push 0x809d
lea ecx, [ebp - 0x10]
call fcn.004cef20
movzx eax, word [ebp - 0x22]
push eax
movzx eax, di
push eax
movzx eax, word [ebp - 0x26]
push eax
movzx eax, si
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004c7e63
add esp, 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004cdf2c
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x14]
add esi, 0x64
mov ecx, dword [ebp + 8]
neg esi
sbb esi, esi
and esi, ebx
push esi
call fcn.004cdca1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x429d24
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
call fcn.0043f605
test eax, eax
je 0x429d3a
push 0
push 1
jmp 0x429d9e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, esi
push eax
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 4]
push ecx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0xc]
push eax
push 0x515f28
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [ebp - 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0x1c]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x429da4
push esi
push 0xc
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop esi
leave
ret
Function at 0x42e3b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x42e41c
lea eax, [ebp - 0x140]
push eax
call fcn.0042460b
test eax, eax
pop ecx
je 0x42e41c
lea eax, [ebp - 0x140]
push 0x513980
push eax
call fcn.0046d140
lea eax, [ebp - 0x140]
pop ecx
mov dword [ebp - 0x2c], eax
pop ecx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x3c
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x42e42a
push 5
push 0x51626c
call fcn.004247d4
pop ecx
pop ecx
pop esi
leave
ret 4