joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401540
Capabilities:
Terminate process

Disassembly:
push edx
lea edx, [esp + 0xc]
mov eax, dword [esp + 8]
call fcn.004021c0
push 0x401513
call fcn.004021e0
add esp, 4
mov eax, 1
jmp 0x4021f8

Function at 0x401650
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push ebp
sub esp, 0x20
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x1c], ecx
mov edx, 0x4010b3
call fcn.00402aa0
mov ebp, eax
test eax, eax
je 0x40186b
call fcn.00402ba0
mov dword [esp + 0x18], eax
test eax, eax
jne 0x40169b
mov eax, ebp
call fcn.00402dc0
push 0x4013e1
call fcn.00401540
add esp, 4
mov ebx, 2
mov edx, 0xfffffff6
mov eax, ebp
call fcn.00402e60
test eax, eax
je 0x4016c9
mov eax, ebp
mov edx, dword [esp + 0x10]
call fcn.00402dc0
push edx
push 0x401089
call fcn.00401540
add esp, 8
mov ebx, 0xa
mov edx, 1
mov eax, esp
mov ecx, ebp
call fcn.00402350
cmp eax, 0xa
je 0x4016fa
mov eax, ebp
mov ecx, dword [esp + 0x10]
call fcn.00402dc0
push ecx
push 0x401489
call fcn.00401540
add esp, 8
mov ecx, 8
mov edi, 0x4014d8
mov esi, esp
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x401711
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401882
cmp byte [0x40b004], 0
je 0x40173b
mov eax, ebp
mov esi, dword [esp + 0x10]
call fcn.00402dc0
push esi
push 0x4012b0
call fcn.00401540
add esp, 8
mov eax, ebp
xor ebx, ebx
xor edx, edx
call fcn.00402e60
test eax, eax
je 0x401763
mov eax, ebp
mov edi, dword [esp + 0x10]
call fcn.00402dc0
push edi
push 0x40142c
call fcn.00401540
add esp, 8
mov ebx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
mov eax, ebp
call fcn.00401590
mov ebx, eax
mov eax, ebp
call fcn.00402dc0
test ebx, ebx
je 0x401792
mov eax, dword [esp + 0x18]
call fcn.00402dc0
mov eax, 1
jmp 0x4021f8
cmp byte [0x40b004], 0
jne 0x40181f
movzx ebp, word [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, 1
mov eax, dword [esp + 0xc]
mov ebx, ebp
call fcn.00402630
cmp eax, ebp
je 0x4017ce
mov ebp, dword [esp + 0x10]
push ebp
push 0x4012da
call fcn.00401540
add esp, 8
mov ecx, 8
mov esi, 0x4014d8
mov edi, esp
mov ebx, 0xa
mov edx, 1
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov word [esp + 8], ax
mov eax, esp
call fcn.00402630
cmp eax, 0xa
je 0x40181f
mov eax, dword [esp + 0x10]
push eax
push 0x401404
call fcn.00401540
add esp, 8
mov edx, 0x401051
mov eax, dword [esp + 0x14]
call fcn.00402aa0
mov ebp, eax
test eax, eax
je 0x401893
mov eax, dword [esp + 0x18]
call fcn.00402f90
mov ebx, eax
mov eax, dword [esp + 0x18]
mov edx, ebp
call fcn.00403000
mov eax, dword [esp + 0x18]
call fcn.00401590
mov eax, ebp
call fcn.00402dc0
mov eax, dword [esp + 0x18]
call fcn.00402dc0
add esp, 0x20
pop ebp
pop edi
pop esi
ret 4
mov eax, dword [esp + 0x10]
push eax
push 0x4014f6
call fcn.00401540
add esp, 8
jmp 0x40167a
movzx eax, word [esp + 8]
add eax, 0xa
sub dword [esp + 0x30], eax
jmp 0x40173b
mov edx, dword [esp + 0x14]
push edx
push 0x4014f6
call fcn.00401540
add esp, 8
jmp 0x401833
Function at 0x4035d4
Capabilities:
Get disk information

Disassembly:
push ebx
push ecx
push esi
push edi
enter 0x348, 0
sub ebp, 0x39a
mov edi, eax
mov esi, edx
xor ecx, ecx
cmp byte [eax], 0
je 0x4035fb
mov edx, 0x4034cf
call fcn.00405450
test eax, eax
je 0x403612
call dword [0x40b280]
mov dword [eax + 4], 1
mov eax, 0xffffffff
jmp 0x403773
mov edx, 0x104
lea eax, [ebp + 0x296]
mov ebx, 0x104
call fcn.00405030
lea eax, [ebp + 0x192]
mov edx, edi
call fcn.00405540
test eax, eax
je 0x403668
movzx eax, byte [ebp + 0x192]
test byte [eax + 0x403781], 0xc0
je 0x403668
cmp byte [ebp + 0x193], 0x3a
jne 0x403668
cmp byte [ebp + 0x194], 0x5c
jne 0x403668
cmp byte [ebp + 0x195], 0
jne 0x403668
mov ecx, 1
mov eax, edi
mov edx, edi
call fcn.004052f0
cmp byte [eax], 0x3a
jne 0x403679
lea edx, [edi + 2]
mov al, byte [edx]
cmp al, 0x2f
je 0x403683
cmp al, 0x5c
jne 0x403689
cmp byte [edx + 1], 0
je 0x40368d
test ecx, ecx
je 0x4036ba
lea eax, [ebp + 0x192]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
test eax, eax
je 0x4035fb
mov ebx, 0x140
lea eax, [ebp + 0x52]
xor edx, edx
call fcn.004055b0
mov dword [ebp + 0x52], 0x10
jmp 0x4036da
lea edx, [ebp + 0x52]
mov eax, edi
call fcn.004055d0
cmp eax, 0xffffffff
jne 0x4036d3
call fcn.00405650
jmp 0x403773
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, edi
call fcn.004052f0
cmp byte [eax], 0x3a
jne 0x4036eb
movzx eax, byte [edi]
jmp 0x4036f2
movzx eax, byte [ebp + 0x296]
call fcn.00404960
movsx eax, al
sub eax, 0x61
mov dword [esi], eax
mov eax, dword [esi]
mov dword [esi + 0x12], eax
mov eax, dword [ebp + 0x72]
lea edx, [ebp + 0x7e]
mov dword [esi + 0x16], eax
mov ebx, edi
mov eax, dword [ebp + 0x52]
call fcn.004034e1
mov word [esi + 8], ax
lea eax, [ebp + 0x66]
call fcn.00405680
mov dword [esi + 0x1e], eax
lea eax, [ebp + 0x56]
call fcn.00405680
mov dword [esi + 0x22], eax
lea eax, [ebp + 0x5e]
call fcn.00405680
mov word [esi + 0x10], 0
mov dword [esi + 0x1a], eax
mov ax, word [esi + 0x10]
mov word [esi + 0xa], 1
cwde
mov dword [esi + 0xc], eax
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x52]
mov dword [esi + 0x2e], 0
mov dword [esi + 0x32], 0
mov word [esi + 0x36], 0
mov byte [esi + 0x38], 0
mov dword [esi + 0x2a], eax
xor eax, eax
lea esp, [ebp + 0x39a]
pop ebp
pop edi
pop esi
pop ecx
pop ebx
ret
Function at 0x403cf0
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov esi, ebx
mov dword [0x40c428], eax
mov dword [0x40b27c], edx
call fcn.00406940
xor eax, eax
mov dword [0x40ca50], eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov edx, eax
mov byte [0x40b2e1], al
shr eax, 0x10
mov word [0x40b2e3], ax
xor eax, eax
mov ax, word [0x40b2e3]
and edx, 0xffff
mov dword [0x40b2e5], eax
xor eax, eax
sar edx, 8
mov al, byte [0x40b2e1]
and edx, 0xff
mov dword [0x40b2e9], eax
xor eax, eax
mov al, dl
mov byte [0x40b2e2], dl
mov dword [0x40b2ed], eax
mov eax, dword [0x40b2e9]
mov edx, dword [0x40b2ed]
shl eax, 8
or eax, edx
mov dword [0x40b2f1], eax
cmp byte [0x40b2e1], 4
jae 0x403e17
mov eax, 0x403c88
push eax
xor edx, edx
push 0x403cb5
mov dword [0x40b2dd], edx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edx, eax
test eax, eax
je 0x403daa
call edx
mov dword [0x40b2dd], eax
push 0x104
push 0x40c42c
push 0
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x40c530
xor eax, eax
mov dword [0x40b2ac], 0x40c42c
call fcn.00406a70
mov dword [0x40b2b8], 0x40c530
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00406b10
mov edx, eax
mov bl, byte [eax]
mov dword [0x40c420], eax
cmp bl, 0x22
je 0x403e21
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x403781], 2
je 0x403e39
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x403781], 2
je 0x403e40
inc eax
jmp 0x403e07
mov eax, 0x403c9e
jmp 0x403d82
inc eax
cmp bl, byte [eax]
je 0x403e31
cmp byte [eax], 0
je 0x403e31
inc eax
cmp byte [eax], 0x22
jne 0x403e26
cmp byte [eax], 0
je 0x403e07
inc eax
jmp 0x403e07
test dl, dl
je 0x403e07
inc eax
jmp 0x403dfa
mov dword [0x40b2a8], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
test eax, eax
je 0x403eb6
call fcn.00406b50
mov edx, eax
mov bx, word [eax]
mov dword [0x40c424], eax
cmp bx, 0x22
je 0x403e89
xor eax, eax
mov ax, word [edx]
call fcn.00406b77
test eax, eax
je 0x403eab
xor eax, eax
mov ax, word [edx]
call fcn.00406b77
test eax, eax
je 0x403ebb
add edx, 2
jmp 0x403e76
lea edx, [eax + 2]
cmp bx, word [edx]
je 0x403ea0
cmp word [edx], 0
je 0x403ea0
add edx, 2
cmp word [edx], 0x22
jne 0x403e91
cmp word [edx], 0
je 0x403e76
add edx, 2
jmp 0x403e76
cmp word [edx], 0
je 0x403e76
add edx, 2
jmp 0x403e68
mov edx, 0x403cc2
mov dword [0x40b2b4], edx
test edi, edi
jne 0x403ece
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x104
push 0x40c738
push esi
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x40c83c
mov eax, esi
mov dword [0x40b2b0], 0x40c738
call fcn.00406a70
mov dword [0x40b2bc], 0x40c83c
mov eax, 1
pop edi
pop esi
pop ecx
ret

Function at 0x4043e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edx
push 0x40
push 0x1000
mov edx, dword [eax]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
pop edx
pop ecx
ret
Function at 0x404490
Capabilities:
Read file on windows

Disassembly:
push ecx
sub esp, 4
test eax, eax
jl 0x4044c1
cmp eax, dword [0x40b424]
jae 0x4044c1
push 0
lea ecx, [esp + 4]
push ecx
push ebx
push edx
call fcn.00406870
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4044d8
mov eax, dword [esp]
add esp, 4
pop ecx
ret
call dword [0x40b280]
mov dword [eax + 4], 4
mov eax, 0xffffffff
add esp, 4
pop ecx
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
call fcn.00405600
cmp edx, 0x6d
jne 0x4044f0
cmp dword [esp], 0
je 0x4044b9
mov eax, 0xffffffff
add esp, 4
pop ecx
ret

Function at 0x404770
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
push ebp
sub esp, 8
mov esi, eax
mov ebp, edx
mov edi, ebx
test eax, eax
jl 0x404804
cmp eax, dword [0x40b424]
jae 0x404804
call fcn.00406870
mov edx, eax
mov dword [esp + 4], eax
mov eax, esi
xor ebx, ebx
call fcn.00407a40
test al, 0x80
je 0x4047c8
mov eax, esi
call dword [0x40b23c]
push 2
push 0
push 0
push edx
mov ebx, 1
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
je 0x404818
push 0
lea eax, [esp + 4]
push eax
push edi
push ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x404822
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
cmp ebx, 1
jne 0x4047f5
mov eax, esi
call dword [0x40b240]
mov eax, edx
call fcn.00405600
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret
call dword [0x40b280]
mov dword [eax + 4], 4
mov eax, 0xffffffff
jmp 0x4047fc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
jmp 0x4047ed
cmp edi, dword [esp]
je 0x404834
call dword [0x40b280]
mov dword [eax + 4], 0xc
cmp ebx, 1
jne 0x404841
mov eax, esi
call dword [0x40b240]
mov eax, dword [esp]
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret

Function at 0x405030
Capabilities:
Get common file path

Disassembly:
push ebx
push ecx
push esi
push edi
sub esp, 0x104
mov edi, eax
mov ebx, edx
mov eax, esp
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
mov ecx, eax
test eax, eax
je 0x405082
inc eax
test edi, edi
jne 0x405089
cmp ebx, eax
jbe 0x40505d
mov eax, ebx
call fcn.00402260
mov edi, eax
test eax, eax
jne 0x40509c
call dword [0x40b280]
mov dword [eax + 4], 5
xor eax, eax
add esp, 0x104
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.00405650
jmp 0x405075
cmp eax, ebx
jbe 0x40509c
call dword [0x40b280]
mov dword [eax + 4], 0xe
jmp 0x405075
mov esi, esp
inc ecx
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edi
add esp, 0x104
pop edi
pop esi
pop ecx
pop ebx
ret
Function at 0x4081a0
Capabilities:
Terminate process

Disassembly:
mov ecx, eax
call dword [0x40b018]
cmp dword [0x40c428], 0
je 0x402235
cmp dword [0x40b278], 0
je 0x402222
mov edx, 0xff
mov eax, 0x10
call dword [0x40b278]
call dword [0x40b018]
call dword [0x40b01c]
mov eax, ecx
jmp fcn.00403ff0
mov edx, 0xff
mov eax, 0x10
call fcn.004040b0
jmp 0x402222
push edx
push ebp
mov ebp, esp
mov eax, dword [0x40b2c8]
add eax, 3
and al, 0xfc
mov edx, dword [0x40b2c8]
sub esp, eax
mov eax, esp
add eax, edx
mov dword [0x40b2cc], eax
call fcn.00408f90
mov edx, dword [0x40cb6c]
mov eax, dword [0x40cb68]
call fcn.004019b0
jmp 0x4021f8
Function at 0x401010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 3
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 6
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 7
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 9
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xa
mov dword [ebp - 4], edx
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3c30
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x534068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40546e
cmp byte [eax + 0x54], 0
je 0x40546e
add eax, 0x1c
lea ecx, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x1c], xmm0
call fcn.004042b0
mov dword [ebp - 4], 0
mov eax, dword [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x40538a
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40543b
push 0
mov edx, edi
lea ecx, [ebp - 0x34]
call fcn.0047ca30
add esp, 4
push 2
push 0
push 0
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x20], 0x10
lea ecx, [ebp - 0x38]
push 0
push ecx
push dword [ebp - 0x24]
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x405425
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40541b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40548b
push edx
push ecx
call fcn.004bc9aa
add esp, 8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov byte [ebp - 4], 0
mov dword [ebp - 4], 7
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x405460
cmp byte [ebp - 0x18], 0
je 0x405460
mov eax, dword [esi]
test eax, eax
je 0x40545c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bc969
mov esp, ebp
pop ebp
ret 4
call fcn.004c2549
int3
Function at 0x407e90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3eb1
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x534068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0x208
xor esi, esi
push esi
push eax
call fcn.004bf410
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x103
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x407f6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x5349fc], 0
mov esi, eax
je 0x4080cf
push ecx
mov ecx, 0x5349f8
call fcn.004043d0
mov eax, dword [0x5349fc]
cmp byte [eax + 0x54], 0
je 0x4080cf
cmp dword [eax + 0x58], 2
jb 0x4080cf
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x234]
push 0x50bdcc
push eax
call fcn.0046e620
add esp, 0xc
push 0x132
jmp 0x408092
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.2345InstDll.dll
lea eax, [ebp - 0x21c]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x40800d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x5349fc], 0
mov esi, eax
je 0x4080cf
push ecx
mov ecx, 0x5349f8
call fcn.004043d0
mov eax, dword [0x5349fc]
cmp byte [eax + 0x54], 0
je 0x4080cf
cmp dword [eax + 0x58], 2
jb 0x4080cf
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
push esi
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push 0x50be54
push eax
call fcn.0046e620
add esp, 0xc
push 0x13b
jmp 0x408092
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4080cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x5349fc], 0
mov esi, eax
je 0x4080cf
push ecx
mov ecx, 0x5349f8
call fcn.004043d0
mov eax, dword [0x5349fc]
cmp byte [eax + 0x54], 0
je 0x4080cf
cmp dword [eax + 0x58], 2
jb 0x4080cf
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
push edi
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 2
push 0x50be7c
push eax
call fcn.0046e620
add esp, 0xc
push 0x142
push str.RC::RCInstExecuter::GetDllPath
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_src2345instdll_rcinstexecuter.cpp
lea eax, [ebp - 0x234]
mov ecx, 0x5349f8
push eax
push 2
call fcn.00404fd0
test bl, bl
je 0x4080c4
lea eax, [ebp - 0x234]
mov ecx, 0x5349f8
push eax
call fcn.00405320
lea ecx, [ebp - 0x234]
call fcn.00402880
test esi, esi
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bc969
mov esp, ebp
pop ebp
ret 4
Function at 0x41af50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7748
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x534068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [esi + 0x10], eax
call fcn.004c5f72
mov ecx, dword [esi]
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
test ecx, ecx
je 0x41b02a
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x1c], edx
call fcn.00414620
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00405520
test al, al
jne 0x41b01b
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x38]
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41b01b
test esi, esi
je 0x41b01b
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 8
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004027f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bc969
mov esp, ebp
pop ebp
ret 4
Function at 0x41e450
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7e0d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x534068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00402850
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00402850
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00402850
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00402850
mov byte [ebp - 4], 3
lea ecx, [esi + 0x60]
call fcn.00402850
mov byte [ebp - 4], 4
lea ecx, [esi + 0x78]
call fcn.00402850
mov byte [ebp - 4], 5
lea ecx, [esi + 0x90]
call fcn.00402850
mov byte [ebp - 4], 6
lea ecx, [esi + 0xa8]
call fcn.00402850
mov byte [ebp - 4], 7
lea ecx, [esi + 0xc0]
call fcn.00402850
mov byte [ebp - 4], 8
lea ecx, [esi + 0xd8]
call fcn.00402850
mov byte [ebp - 4], 9
lea ecx, [esi + 0xf0]
call fcn.00402850
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x108]
call fcn.00402850
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x120]
call fcn.00402850
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x138]
call fcn.00402850
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0x150]
call fcn.00402850
mov byte [ebp - 4], 0xe
lea ecx, [esi + 0x168]
call fcn.00402850
mov byte [ebp - 4], 0xf
lea ecx, [esi + 0x180]
call fcn.00402850
mov byte [ebp - 4], 0x10
lea ecx, [esi + 0x198]
call fcn.00402850
mov byte [ebp - 4], 0x11
lea ecx, [esi + 0x1b0]
call fcn.00402850
mov byte [ebp - 4], 0x12
lea ecx, [esi + 0x1c8]
call fcn.00402850
mov byte [ebp - 4], 0x13
lea ecx, [esi + 0x1e0]
call fcn.00402850
mov byte [ebp - 4], 0x14
lea ecx, [esi + 0x1f8]
call fcn.00402850
mov byte [ebp - 4], 0x15
lea ecx, [esi + 0x210]
call fcn.00402850
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41e5e0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7e0d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x534068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0x15
lea ecx, [esi + 0x210]
call fcn.004027f0
mov byte [ebp - 4], 0x14
lea ecx, [esi + 0x1f8]
call fcn.004027f0
mov byte [ebp - 4], 0x13
lea ecx, [esi + 0x1e0]
call fcn.004027f0
mov byte [ebp - 4], 0x12
lea ecx, [esi + 0x1c8]
call fcn.004027f0
mov byte [ebp - 4], 0x11
lea ecx, [esi + 0x1b0]
call fcn.004027f0
mov byte [ebp - 4], 0x10
lea ecx, [esi + 0x198]
call fcn.004027f0
mov byte [ebp - 4], 0xf
lea ecx, [esi + 0x180]
call fcn.004027f0
mov byte [ebp - 4], 0xe
lea ecx, [esi + 0x168]
call fcn.004027f0
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0x150]
call fcn.004027f0
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x138]
call fcn.004027f0
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x120]
call fcn.004027f0
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x108]
call fcn.004027f0
mov byte [ebp - 4], 9
lea ecx, [esi + 0xf0]
call fcn.004027f0
mov byte [ebp - 4], 8
lea ecx, [esi + 0xd8]
call fcn.004027f0
mov byte [ebp - 4], 7
lea ecx, [esi + 0xc0]
call fcn.004027f0
mov byte [ebp - 4], 6
lea ecx, [esi + 0xa8]
call fcn.004027f0
mov byte [ebp - 4], 5
lea ecx, [esi + 0x90]
call fcn.004027f0
mov byte [ebp - 4], 4
lea ecx, [esi + 0x78]
call fcn.004027f0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x60]
call fcn.004027f0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.004027f0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.004027f0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.004027f0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004027f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret