joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5485e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x63a404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor al, al
test esi, esi
je 0x54869e
push edi
call fcn.00545f90
push 0x208
mov edi, eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00573560
mov eax, dword [esi + 4]
add eax, eax
push eax
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00572a60
add esp, 0x18
test edi, edi
je 0x548640
push 2
push edi
call fcn.0056ea89
add esp, 8
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x224], eax
xorps xmm0, xmm0
mov eax, 0x614
mov dword [ebp - 0x220], 0
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x22c]
push eax
movlpd qword [ebp - 0x21a], xmm0
mov dword [ebp - 0x212], 0
mov dword [ebp - 0x228], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
pop edi
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0056e5b3
mov esp, ebp
pop ebp
ret

Function at 0x5486b0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6eed
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x63a404]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
test edi, edi
je 0x5487e5
call fcn.00547a60
test al, al
je 0x5487e5
push 8
call fcn.0056e7bf
mov esi, eax
lea ecx, [ebp - 0x26c]
add esp, 4
mov dword [ebp - 0x270], esi
mov dword [esi], 0
push edi
mov dword [esi + 4], 0
call fcn.005448d0
push 0x5c
lea ecx, [ebp - 0x26c]
mov dword [ebp - 4], 0
call fcn.00546670
test al, al
jne 0x548741
push 0x5c
call fcn.005454a0
lea ecx, [ebp - 0x26c]
test ebx, ebx
je 0x548753
push ebx
call fcn.00545810
jmp 0x54875a
push 0x2a
call fcn.005454a0
lea ecx, [ebp - 0x26c]
call fcn.00545f90
mov edi, eax
test edi, edi
je 0x5487d6
lea eax, [ebp - 0x264]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5487cb
push 8
call fcn.0056e7bf
add esp, 4
mov dword [ebp - 0x270], eax
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 1
push ecx
mov ecx, eax
call fcn.00544840
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0
call fcn.005444a0
lea eax, [ebp - 0x264]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x5487cb
cmp dword [esi + 4], 0x3e8
jb 0x548780
push 2
push edi
call fcn.0056ea89
add esp, 8
lea ecx, [ebp - 0x26c]
call fcn.004ffe40
mov eax, esi
jmp 0x5487e7
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0056e5b3
mov esp, ebp
pop ebp
ret
Function at 0x548810
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6f28
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x63a404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor bl, bl
test ecx, ecx
je 0x5488ee
mov eax, dword [ebp + 8]
or eax, dword [ebp + 0xc]
je 0x5488ee
call fcn.00545f90
mov edi, eax
test edi, edi
je 0x5488ee
push 0
push 0x80
push 1
push 0
push 0
push 0x120116
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5488a4
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x54889b
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5488e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CreateFile_failed_with_error_code:__d
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.005447b0
push esi
push eax
push 0x45a
push str.OFileManager::createEmptyFile
push str.d:jenkinsworkspaceclient3.lib.platformlibplatformlib_srcofilemanager.cpp
push 0
mov dword [ebp - 4], 0
call fcn.0054faa0
add esp, 0x18
lea ecx, [ebp - 0x14]
call fcn.004ffe40
push 2
push edi
call fcn.0056ea89
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x54ab80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x38]
mov bl, byte [esi + 0x44]
test eax, eax
jne 0x54ab9c
mov eax, dword [esi + 0x90]
test eax, eax
je 0x54abc4
lea ecx, [ebp - 4]
mov byte [esi + 0x44], 0
push ecx
push eax
mov bl, 1
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x54abf7
cmp dword [ebp - 4], 0x103
je 0x54abf7
xor bl, bl
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x20], 0x20
jle 0x54abba
cmp dword [esi + 0x48], 0
jne 0x54abe1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x48], eax
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x48]
xor ecx, ecx
cmp eax, 0x7530
movzx ebx, bl
cmova ebx, ecx
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54ac00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x647ad0]
push edi
mov edi, dword [eax + 0x38]
test edi, edi
jne 0x54ac1b
mov edi, dword [eax + 0x90]
test edi, edi
je 0x54ac50
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
xor esi, esi
push esi
push edi
call ebx
test eax, eax
jne 0x54ac47
nop dword [eax]
inc esi
cmp esi, 0xa
jg 0x54ac47
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push edi
call ebx
test eax, eax
je 0x54ac30
pop esi
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x54b9e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov esi, ecx
lea eax, [ebp + 8]
push 1
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x54ba10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov esi, ecx
lea eax, [ebp + 8]
push 2
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x54ba40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov esi, ecx
lea eax, [ebp + 8]
push 4
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x54ba70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov esi, ecx
lea eax, [ebp + 8]
push 8
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x54baa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x54c540
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2378
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x63a404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor bl, bl
cmp dword [edi], 0
je 0x54c621
mov ecx, dword [ebp + 8]
call fcn.00545f90
lea ecx, [ebp + 8]
mov dword [ebp - 0x14], eax
push ecx
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x54c616
mov eax, dword [ebp - 0x10]
cmp eax, 1
je 0x54c5a6
cmp eax, 2
jne 0x54c616
mov eax, dword [ebp + 8]
mov bl, 1
add eax, 2
push eax
call fcn.0056ea97
mov esi, eax
add esp, 4
test esi, esi
je 0x54c614
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 0x14]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x54c616
mov eax, dword [ebp + 8]
cmp word [esi + eax - 2], 0
je 0x54c5e8
xor ecx, ecx
mov word [esi + eax], cx
push esi
lea ecx, [ebp - 0x1c]
call fcn.00544840
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 4], 0
call fcn.005449c0
lea ecx, [ebp - 0x1c]
call fcn.004ffe40
push esi
call fcn.0056ee0c
add esp, 4
jmp 0x54c616
xor bl, bl
push dword [ebp - 0x14]
call fcn.0056ee0c
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x54c640
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
xor cl, cl
mov dword [ebp - 4], eax
cmp dword [eax], 0
je 0x54c6a4
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
call fcn.00545f90
mov esi, dword [ebp + 0xc]
mov ebx, eax
mov ecx, esi
call fcn.00545f90
mov edi, eax
mov eax, dword [esi + 4]
lea eax, [eax*2 + 2]
push eax
mov eax, dword [ebp - 4]
push edi
push 1
push 0
push ebx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
mov esi, eax
call fcn.0056ee0c
push edi
call fcn.0056ee0c
add esp, 8
test esi, esi
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov al, cl
mov esp, ebp
pop ebp
ret 8
Function at 0x54ca20
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b75d7
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x63a404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor bl, bl
cmp dword [ecx + 4], 0
je 0x54cbed
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
push 0x20119
lea edx, [ebp - 0x224]
mov dword [ebp - 4], 0
call fcn.0054cd10
add esp, 4
mov dword [ebp - 0x214], eax
test eax, eax
je 0x54cb71
lea ecx, [ebp - 0x224]
call fcn.00545f90
mov esi, eax
push esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push esi
mov dword [ebp - 0x214], eax
call fcn.0056ee0c
mov eax, dword [ebp - 0x214]
add esp, 4
test eax, eax
sete bl
test eax, eax
je 0x54cbde
test edi, edi
je 0x54cbde
push 0
push 0x100
lea ecx, [ebp - 0x210]
push ecx
push 0
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x54cb2d
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00544840
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00545420
lea ecx, [ebp - 0x21c]
call fcn.004ffe40
jmp 0x54cbde
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.FormatMessage_failed_with_error_code:__d
lea ecx, [ebp - 0x21c]
mov esi, eax
call fcn.005447b0
push esi
push eax
push 0x305
push str.ORegistry::DeleteKey
push str.d:jenkinsworkspaceclient3.lib.platformlibplatformlib_srcoregistry.cpp
push 0
mov byte [ebp - 4], 2
call fcn.0054faa0
add esp, 0x18
lea ecx, [ebp - 0x21c]
call fcn.004ffe40
jmp 0x54cbde
test edi, edi
je 0x54cbde
push 0x34
mov dword [ebp - 0x214], 0
mov esi, 0x19
call fcn.0056ea97
push 0xffffffffffffffff
push str.The_registry_root_is_NULL
push 0x1a
push eax
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x214]
push eax
call fcn.00584f75
xor ecx, ecx
add esp, 0x18
test eax, eax
cmovne esi, ecx
mov dword [ebp - 0x218], esi
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.00545420
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x54cbde
push 2
push eax
call fcn.0056ea89
add esp, 8
mov ecx, dword [ebp - 0x224]
test ecx, ecx
je 0x54cc5d
push 2
push ecx
jmp 0x54cc55
test edi, edi
je 0x54cc5d
push 0x36
mov dword [ebp - 0x214], 0
mov esi, 0x1a
call fcn.0056ea97
push 0xffffffffffffffff
push str.The_registry_path_is_empty
push 0x1b
push eax
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x214]
push eax
call fcn.00584f75
xor ecx, ecx
add esp, 0x18
test eax, eax
cmovne esi, ecx
mov dword [ebp - 0x218], esi
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 4
push eax
mov ecx, edi
call fcn.00545420
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x54cc5d
push 2
push eax
call fcn.0056ea89
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e5b3
mov esp, ebp
pop ebp
ret
Function at 0x54d310
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x63a404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x80
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], 0
push eax
push str.Client_SID
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x54d382
lea eax, [ebp - 0x108]
or esi, 0x20006
push eax
push esi
push 0
lea eax, [ebp - 0x104]
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0x108]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056e5b3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, reloc.WS2_32.dll_accept
xor ecx, ebp
pop esi
call fcn.0056e5b3
mov esp, ebp
pop ebp
ret
Function at 0x54d750
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b77b8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x63a404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
push 0x20119
lea edx, [ebp - 0x3c]
mov dword [ebp - 4], 0
call fcn.0054cd10
add esp, 4
test eax, eax
jne 0x54d7aa
xor bl, bl
jmp 0x54d962
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x20119
call fcn.0054cc80
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x3c]
call fcn.0054d1e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
test al, al
jne 0x54d7fd
xor bl, bl
jmp 0x54d8f5
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x20119
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x2c]
call fcn.0054c370
test al, al
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x1c]
je 0x54d833
push 1
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0054bfa0
jmp 0x54d83d
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0054c1e0
push eax
lea ecx, [ebp - 0x24]
call fcn.0054bc10
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x54d87a
cmp eax, 0x80000000
je 0x54d87a
cmp eax, 0x80000005
je 0x54d87a
cmp eax, reloc.WS2_32.dll_accept
je 0x54d87a
cmp eax, reloc.WS2_32.dll_bind
je 0x54d87a
cmp eax, 0x80000004
je 0x54d87a
cmp eax, reloc.WS2_32.dll_closesocket
je 0x54d87a
push eax
call esi
mov eax, dword [ebp - 0x24]
xor bl, bl
mov dword [ebp - 0x10], edi
test eax, eax
je 0x54d8f5
lea ecx, [ebp - 0x34]
call fcn.00545f90
push 4
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push edi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call fcn.0056ee0c
mov eax, dword [ebp - 0x24]
add esp, 4
test esi, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sete bl
test eax, eax
je 0x54d8f5
cmp eax, 0x80000000
je 0x54d8ee
cmp eax, 0x80000005
je 0x54d8ee
cmp eax, reloc.WS2_32.dll_accept
je 0x54d8ee
cmp eax, reloc.WS2_32.dll_bind
je 0x54d8ee
cmp eax, 0x80000004
je 0x54d8ee
cmp eax, reloc.WS2_32.dll_closesocket
je 0x54d8ee
push eax
call esi
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x54d907
push 2
push eax
call fcn.0056ea89
add esp, 8
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x54d920
push 2
push eax
call fcn.0056ea89
add esp, 8
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
test eax, eax
je 0x54d962
cmp eax, 0x80000000
je 0x54d95b
cmp eax, 0x80000005
je 0x54d95b
cmp eax, reloc.WS2_32.dll_accept
je 0x54d95b
cmp eax, reloc.WS2_32.dll_bind
je 0x54d95b
cmp eax, 0x80000004
je 0x54d95b
cmp eax, reloc.WS2_32.dll_closesocket
je 0x54d95b
push eax
call esi
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x54d974
push 2
push eax
call fcn.0056ea89
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x54de40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b782f
mov eax, dword fs:[0]
push eax
sub esp, 0x94
push ebx
push esi
push edi
mov eax, dword [0x63a404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1c], 0
test ebx, ebx
je 0x54dfdf
call fcn.00545f90
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 2
push esi
mov edi, eax
call fcn.0056ea89
add esp, 8
cmp edi, 0xffffffff
je 0x54dfdf
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 2
push 0x400
call fcn.00545f90
push eax
push 1
call dword [sym.imp.CRYPT32.dll_CryptQueryObject]
test eax, eax
je 0x54dfdf
mov edi, dword [sym.imp.CRYPT32.dll_CryptMsgGetParam]
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 6
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x54dfdf
push dword [ebp - 0x14]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x54dfdf
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 6
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x54dfdf
mov eax, dword [esi + 4]
mov dword [ebp - 0x88], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x84], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x9c], eax
mov eax, dword [esi + 0x10]
push 0
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0xa0]
push eax
push 0xb0000
push 0
push 0x10001
push dword [ebp - 0x18]
call dword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x54dfdf
mov ebx, dword [sym.imp.CRYPT32.dll_CertGetNameStringW]
push 0
push 0
push 0
push 0
push 4
push eax
call ebx
mov edi, eax
test edi, edi
je 0x54dfdf
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x54dfdf
push edi
push esi
push 0
push 0
push 4
push dword [ebp - 0x20]
call ebx
test eax, eax
je 0x54dfd8
push 8
call fcn.0056e7bf
add esp, 4
mov dword [ebp - 0x20], eax
push esi
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00544840
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x54e1e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x63a404]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x210], ebx
push esi
test ecx, ecx
je 0x54e21c
call fcn.00545f90
mov esi, eax
jmp 0x54e239
push 0x208
call fcn.0056ea97
add esp, 4
mov esi, eax
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test esi, esi
je 0x54e34b
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x214], eax
test eax, eax
je 0x54e342
push edi
push eax
call fcn.0056ea97
add esp, 4
mov edi, eax
push edi
push dword [ebp - 0x214]
push dword [ebp - 0x20c]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x54e341
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x21c]
push eax
push str.VarFileInfoTranslation
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov eax, dword [ebp - 0x218]
cmp eax, 3
ja case.default.0x54e2ae
jmp dword [eax*4 + 0x54e360]
mov eax, 0x625cb4
jmp 0x54e2cf
mov eax, 0x625d0c
jmp 0x54e2cf
mov eax, 0x625cec
jmp 0x54e2cf
mov eax, str.SupportFlags
mov ecx, dword [ebp - 0x21c]
push eax
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04x_s
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.00547880
add esp, 0x18
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je case.default.0x54e2ae
cmp dword [ebp - 0x208], ebx
jbe case.default.0x54e2ae
mov ecx, dword [ebp - 0x210]
call fcn.00544ce0
mov ebx, eax
mov ecx, ebx
call fcn.00546730
test edi, edi
je 0x54e341
push edi
call fcn.0056ee0c
add esp, 4
pop edi
push esi
call fcn.0056ee0c
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0056e5b3
mov esp, ebp
pop ebp
ret
Function at 0x54f770
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov byte [esi + 9], 1
test eax, eax
jne 0x54f79f
push eax
push 4
push esi
push 0x54f620
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [esi + 0xc]
mov dword [esi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 4]
pop esi
test eax, eax
je 0x54f7ab
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret

Function at 0x54f7b0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x54f859
cmp byte [esi + 8], 0
mov ecx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jne 0x54f82d
push ebx
push edi
mov byte [esi + 8], 1
mov edi, 0x64
nop word [eax + eax]
lea ebx, [edi - 1]
mov dword [ebp - 8], ebx
xor bl, bl
cmp byte [esi + 9], bl
je 0x54f811
mov eax, dword [esi + 4]
test eax, eax
je 0x54f811
lea edx, [ebp - 4]
push edx
push eax
call ecx
test eax, eax
je 0x54f811
cmp dword [ebp - 4], 0x103
mov eax, 1
movzx ebx, bl
cmovne ebx, eax
xor edi, edi
test bl, bl
push 0x64
cmove edi, dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test edi, edi
jne 0x54f7e0
pop edi
pop ebx
cmp byte [esi + 9], 0
je 0x54f84e
mov eax, dword [esi + 4]
test eax, eax
je 0x54f84e
lea edx, [ebp - 8]
push edx
push eax
call ecx
test eax, eax
je 0x54f84e
cmp dword [ebp - 8], 0x103
jne 0x54f859
push 1
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
mov esp, ebp
pop ebp
ret