joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101c6b9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1021004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x100118c
push eax
mov ebx, 0x10012d8
push ebx
mov dword [ebp - 0x41c], eax
mov edi, 0x104
lea eax, [ebp - 0x20c]
push edi
push eax
mov esi, ecx
mov dword [ebp - 0x418], 0x80004005
call fcn.0101c5f9
push 0x10011a8
push dword [ebp - 0x41c]
lea eax, [ebp - 0x414]
push ebx
push edi
push eax
call fcn.0101c5f9
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0x28
lea eax, [ebp - 0x20c]
push eax
call edi
mov dword [esi + 4], eax
lea eax, [ebp - 0x414]
push eax
call edi
mov dword [esi], eax
test eax, eax
je 0x101c82b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10012c8
push eax
call edi
push 0x10012b8
push dword [esi]
mov dword [esi + 0x124], eax
call edi
push 0x10012a8
push dword [esi]
mov dword [esi + 0x228], eax
call edi
push 0x1001298
push dword [esi]
mov dword [esi + 0x128], eax
call edi
push 0x1001288
push dword [esi]
mov dword [esi + 0xe8], eax
call edi
mov ebx, 0x1001278
push ebx
push dword [esi]
mov dword [esi + 0xf4], eax
call edi
push 0x1001264
push dword [esi]
mov dword [esi + 0x4c], eax
call edi
push 0x100124c
push dword [esi]
mov dword [esi + 0x1dc], eax
call edi
push 0x1001234
push dword [esi]
mov dword [esi + 0x1e0], eax
call edi
push 0x1001220
push dword [esi]
mov dword [esi + 0x64], eax
call edi
push 0x100120c
push dword [esi]
mov dword [esi + 0x7c], eax
call edi
push 0x10011f4
push dword [esi]
mov dword [esi + 0x9c], eax
call edi
push 0x10011e4
push dword [esi]
mov dword [esi + 0xa0], eax
call edi
push 0x10011d4
push dword [esi]
mov dword [esi + 0x184], eax
call edi
push 0x10011c0
push dword [esi]
mov dword [esi + 0x140], eax
call edi
push ebx
push dword [esi]
mov dword [esi + 0xf0], eax
call edi
mov dword [esi + 0x4c], eax
mov ecx, esi
call fcn.0101c57a
pop edi
pop esi
pop ebx
test eax, eax
je 0x101c840
and dword [ebp - 0x418], 0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x418]
xor ecx, ebp
call fcn.0101d56a
leave
ret 4

Function at 0x101ce20
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0101d580
mov eax, dword [0x1021004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1021358]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
shl eax, 2
xor edi, edi
test eax, eax
jle 0x101ce74
push 0
lea eax, [ebp - 0x1008]
push eax
push 2
push 0x10019cc
push dword [section..data]
call esi
mov eax, dword [0x1021358]
inc edi
shl eax, 2
cmp edi, eax
jl 0x101ce4f
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1004]
push 0x800
push eax
call fcn.0101cdc0
push 0
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [section..data]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0101d56a
leave
ret
Function at 0x101cec7
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0101d580
mov eax, dword [0x1021004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1021358]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
shl eax, 2
xor edi, edi
test eax, eax
jle 0x101cf1b
push 0
lea eax, [ebp - 0x1008]
push eax
push 2
push 0x10019cc
push dword [section..data]
call esi
mov eax, dword [0x1021358]
inc edi
shl eax, 2
cmp edi, eax
jl 0x101cef6
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1004]
push 0x800
push eax
call fcn.0101cdc0
push 0
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [section..data]
call esi
push 0
lea eax, [ebp - 0x1008]
push eax
push 4
push 0x10019d0
push dword [section..data]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0101d56a
leave
ret

Function at 0x101d55b
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1020190
call fcn.0101dac4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10219d0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x101d370
cmp eax, esi
jne 0x101d363
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x101d373
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x101d34a
xor esi, esi
inc esi
mov eax, dword [0x10219cc]
cmp eax, esi
jne 0x101d386
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x101d3c1
mov eax, dword [0x10219cc]
test eax, eax
jne 0x101d3bb
mov dword [0x10219cc], esi
push 0x100116c
push 0x1001160
call fcn.0101d2c7
pop ecx
pop ecx
test eax, eax
je 0x101d3c1
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x101d48b
mov dword [0x10215e0], esi
mov eax, dword [0x10219cc]
cmp eax, esi
jne 0x101d3e5
push 0x100115c
push 0x1001150
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10219cc], 2
cmp dword [ebp - 0x1c], ebx
jne 0x101d3f2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10219e0], ebx
je 0x101d413
push 0x10219e0
call fcn.0101da39
pop ecx
test eax, eax
je 0x101d413
push ebx
push 2
push ebx
call dword [0x10219e0]
push dword [0x10215c8]
push dword [0x10215cc]
push dword [0x10215c4]
call fcn.0101d225
add esp, 0xc
mov dword [0x10215dc], eax
cmp dword [0x10215d0], ebx
jne 0x101d471
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10215e0], ebx
jne 0x101d47f
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10215dc]
call fcn.0101db09
ret
call fcn.0101dc11
jmp 0x101d328
Function at 0x101f23b
Capabilities:
Check if file exists
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1021004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x5601
push edi
push ebx
mov dword [ebp - 0x218], edi
call fcn.0101f02f
mov dword [ebp - 0x21c], eax
test eax, eax
jl 0x101f320
push esi
mov esi, 0x5610
push esi
push edi
push ebx
call fcn.0101f0d5
inc esi
cmp esi, 0x5613
jbe 0x101f28a
and dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0x5630
mov esi, 0x5631
push dword [ebp - 0x210]
push edi
push ebx
call fcn.0101f1df
test eax, eax
je 0x101f2c8
inc dword [ebp - 0x214]
inc dword [ebp - 0x210]
cmp dword [ebp - 0x210], esi
jbe 0x101f2b1
cmp dword [ebp - 0x214], 2
jl 0x101f31f
lea eax, [ebp - 0x20c]
push eax
call sub.SHLWAPI.dll_PathFileExistsW
test eax, eax
jne 0x101f301
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x101f31f
mov edi, 0x5630
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
push ebx
call fcn.0101f12c
inc edi
cmp edi, esi
jbe 0x101f306
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x21c]
pop edi
xor ecx, ebp
pop ebx
call fcn.0101d56a
leave
ret 8

Function at 0x101f49b
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1021004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x10021d0
xor ebx, ebx
push ebx
mov dword [ebp - 0x214], esi
call fcn.0101ff89
pop ecx
pop ecx
cmp esi, ebx
jne 0x101f4d9
mov dword [ebp - 0x214], 0x80000001
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor esi, esi
lea eax, [ebp - 0x210]
push eax
push 0x20006
push ebx
push dword [esi + 0x1021320]
mov dword [ebp - 0x210], ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101f5c0
test byte [esi + 0x1021328], 1
je 0x101f554
push dword [esi + 0x1021324]
push dword [ebp - 0x210]
call edi
cmp eax, ebx
jne 0x101f53f
push dword [esi + 0x1021324]
push 0x1002150
push ebx
call fcn.0101ff89
add esp, 0xc
jmp 0x101f554
push eax
push dword [esi + 0x1021324]
push 0x10020c0
push ebx
call fcn.0101ff89
add esp, 0x10
test byte [esi + 0x1021328], 2
je 0x101f5b4
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 0x1021324]
call fcn.01020104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call edi
cmp eax, ebx
jne 0x101f59e
lea eax, [ebp - 0x20c]
push eax
push 0x1002150
push ebx
call fcn.0101ff89
add esp, 0xc
jmp 0x101f5b4
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x10020c0
push ebx
call fcn.0101ff89
add esp, 0x10
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xc
cmp esi, 0x24
jb 0x101f4e1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101d56a
leave
ret 4
Function at 0x101f5e2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp + 0xc]
push eax
push 1
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101f643
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], 4
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x101f63a
cmp dword [ebp - 0xc], 4
je 0x101f63a
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xc]
push eax
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x101f686
push 4
pop esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], esi
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x101f67d
cmp dword [ebp - 0xc], esi
je 0x101f67d
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x101f695
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1021004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 0x10c]
push edx
push 1
xor esi, esi
push esi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101f70d
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push edi
push dword [ebp - 0x10c]
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10c]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0101d56a
leave
ret 0xc

Function at 0x101f87b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x10022a0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101f8cd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x1002284
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x101f914
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x1021350]
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x101f998
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x1002360
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101f987
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1002354
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101f97e
cmp dword [ebp - 0xc], 4
jne 0x101f97e
cmp dword [ebp - 0x10], eax
je 0x101f97e
mov dword [0x1021350], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1021350]
cmp eax, 0xffffffff
jne 0x101f998
xor eax, eax
mov dword [0x1021350], eax
leave
ret
Function at 0x403001
Capabilities:
Get geographical location
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
and word [ebp - 0x44], 0
push 0x20
lea eax, [ebp - 0x44]
push eax
push str.LC_ALL
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp word [ebp - 0x44], 0
jne 0x403037
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xb
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp word [ebp - 0x44], 0
lea eax, [ebp - 0x44]
jne 0x403046
mov eax, 0x48ec00
push eax
mov ecx, 0x4a5bf0
call fcn.0043cdc0
push dword [0x4a5bf0]
call fcn.0043377a
cmp eax, 1
pop ecx
jle 0x403068
mov word [0x4a9010], ax
leave
ret

Function at 0x403129
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetLastInputInfo]
lea eax, [ebp - 8]
xor ebx, ebx
push eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], ebx
call edi
mov eax, dword [ebp - 4]
mov ecx, eax
sub ecx, dword [0x4a5b90]
test ecx, ecx
jle 0x40315c
mov dword [0x4a5b90], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [0x4a5b90], eax
jmp 0x403194
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], ebx
call edi
call esi
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jb 0x40318c
sub eax, dword [0x4a5b90]
cmp eax, dword [ebp + 8]
jae 0x40319c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x4a4290], bl
jg 0x40316c
mov eax, dword [ebp - 4]
mov ecx, eax
sub ecx, dword [0x4a5b90]
pop esi
test ecx, ecx
jle 0x4031b1
mov dword [0x4a5b90], eax
xor eax, eax
cmp byte [0x4a4290], bl
pop edi
setg al
pop ebx
leave
ret

Function at 0x403386
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xf
xor eax, eax
cmp byte [ebp + 0x10], bl
pop ecx
lea edi, [ebp - 0x4c]
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x50], ebx
rep stosd dword es:[edi], eax
je 0x4033bc
or dword [ebp - 0x28], 1
mov word [ebp - 0x24], bx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4033fb
push esi
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp byte [ebp + 0xc], bl
je 0x4033f5
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
call esi
pop esi
pop edi
pop ebx
leave
ret

Function at 0x4033ff
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push 0x3ff
lea eax, [ebp - 0x400]
push eax
push str.SHOWEWFMSG
mov byte [ebp - 0x400], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp byte [ebp - 0x400], 0x31
jne 0x403441
push 0
push 0x48ec2c
push dword [ebp + 8]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
leave
ret
Function at 0x403443
Capabilities:
Terminate process

Disassembly:
cmp byte [0x4a4290], 2
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x14
pop esi
je 0x40345a
push esi
call edi
cmp dword [0x4a5b9c], 0
je 0x403475
push 0x1e
pop esi
jmp 0x403475
cmp dword [0x4a5b94], 0
je 0x403478
push 0xa
call edi
dec esi
jns 0x403468
mov eax, dword [0x4a5b94]
test eax, eax
pop edi
pop esi
je 0x403496
push 0
push eax
mov dword [0x4a5b94], 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [0x4a4290], 0xff
ret

Function at 0x40349e
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0xc]
mov esi, 0x8000004
push 0x64
push ebx
push esi
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
cmp edi, ebx
mov byte [ebp - 1], 1
je 0x4034df
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4034f0
mov byte [ebp - 1], bl
jmp 0x4034f0
push dword [ebp + 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edi, eax
cmp edi, ebx
je 0x40352c
push ebx
push ebx
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov dword [0x4a5ba4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4a5ba4]
cmp eax, ebx
je 0x40352c
cmp byte [ebp - 1], bl
je 0x403527
push 0x64
push ebx
push eax
call fcn.00479cf0
mov eax, dword [0x4a5ba4]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403779
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push 0x169
lea ecx, [ebp - 4]
call fcn.00432cd5
mov ebx, dword [ebp - 4]
push 0x104
push dword [ebp + 0xc]
add ebx, 0xc8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 8]
push eax
xor esi, esi
push ebx
mov dword [ebp - 8], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x403837
push edi
push eax
push 2
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 8]
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x48ec68
push edi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0x12]
mov dx, word [eax + 0x10]
mov di, word [eax + 0x16]
movzx eax, word [eax + 0x14]
push eax
movzx eax, di
push eax
movzx eax, dx
push eax
movzx eax, cx
push eax
push 0x48ec50
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
mov dword [esi], eax
call fcn.0042dd2d
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x404585
Capabilities:
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 4], eax
push ebx
lea ecx, [eax + 8]
push edi
mov di, word [eax]
mov dword [ebp - 4], ecx
mov ax, word [ecx]
call fcn.00402b57
test al, al
jne 0x4045aa
inc ecx
inc ecx
mov dword [ebp - 4], ecx
push 0x63
lea eax, [ebp - 0x74]
push eax
xor ebx, ebx
push str.DEBUGMDG
mov byte [ebp - 0x74], bl
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp byte [ebp - 0x74], 0x31
jne 0x4045cd
mov byte [0x4a5b8c], 1
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp - 4]
lea ecx, [ebp - 0x10]
mov dword [0x4a5b90], eax
mov dword [ebp - 0xc], ebx
call fcn.0043ccfc
lea ecx, [ebp - 8]
call fcn.00432cb7
push 1
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
mov ecx, 0x4a5f08
call fcn.00439f34
push dword [ebp - 8]
lea ecx, [ebp - 0xc]
call fcn.0043cdc0
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
mov dword [ebp - 4], eax
call fcn.0042dd2d
lea ecx, [ebp - 0x10]
call fcn.0042dd2d
mov ecx, dword [ebp - 4]
call fcn.004031c0
push 0x1e
push eax
push str._InstallService
mov dword [ebp - 4], eax
mov esi, eax
call fcn.00479e40
add esp, 0xc
test eax, eax
jne 0x40467b
movzx esi, word [esi + 0x1e]
mov eax, esi
call fcn.00402b57
test al, al
jne 0x404659
cmp si, bx
jne 0x40467b
push 0x1e
push 0x48eed4
push dword [ebp - 4]
call fcn.0047a010
mov ecx, dword [ebp - 4]
add esp, 0xc
add ecx, 0x1e
call fcn.004031c0
mov dword [ebp - 4], eax
jmp 0x404692
push 8
lea eax, [ebp - 4]
push eax
push 0x48eec8
call fcn.004349fd
add esp, 0xc
test al, al
je 0x4046d5
cmp di, 0x22
jne 0x4046cb
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 4]
lea ecx, [edx + eax*2 - 2]
cmp ecx, edx
jbe 0x4046cb
mov ax, word [ecx]
call fcn.00402b57
test al, al
je 0x4046be
dec ecx
dec ecx
cmp ecx, edx
ja 0x4046ac
cmp ecx, edx
jbe 0x4046cb
cmp word [ecx], 0x22
jne 0x4046cb
mov word [ecx], bx
push dword [ebp - 4]
call fcn.0040b280
jmp 0x4046f5
push 0xe
lea eax, [ebp - 4]
push eax
push 0x48eeb8
call fcn.004349fd
add esp, 0xc
test al, al
pop esi
je 0x4046fd
push dword [ebp - 4]
call fcn.00405232
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0xc]
call fcn.0042dd2d
pop edi
xor eax, eax
pop ebx
leave
ret

Function at 0x40470b
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, eax
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4a5b94], 0
call ebx
and dword [esi], 0
test edi, edi
je 0x40474a
mov eax, dword [edi]
test eax, eax
je 0x40474a
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
push dword [edi]
call ebx
and dword [edi], 0
cmp byte [esp + 0x10], 0
je 0x404762
push 1
push 0
push str.shutdown__a
call fcn.00403386
add esp, 0xc
push dword [0x4a5bec]
call fcn.00403305
cmp byte [esp + 0x10], 0
pop ecx
je 0x40478e
push 3
pop esi
push 0
call dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
jne 0x404778
pop esi
pop ebx
ret