joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67f7c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e1a9e
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x75aa5c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 1
jne 0x67f8a5
lea ecx, [ebp - 0x38]
call fcn.0042b810
mov dword [ebp - 4], 0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x3a]
push ecx
movzx edx, word [ebp - 0x3c]
push edx
movzx eax, word [ebp - 0x3e]
push eax
movzx ecx, word [ebp - 0x40]
push ecx
movzx edx, word [ebp - 0x42]
push edx
movzx eax, word [ebp - 0x46]
push eax
movzx ecx, word [ebp - 0x48]
push ecx
push str._d__d__d___d:_d:_d:_d_t_t
lea edx, [ebp - 0x38]
push edx
call fcn.004a4380
add esp, 0x24
cmp dword [0x758a90], 1
jne 0x67f88e
mov eax, dword [ebp + 8]
cmp dword [eax + 0x450], 0
je 0x67f88e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x450]
push edx
push 1
lea ecx, [ebp - 0x38]
call fcn.00405370
push eax
lea ecx, [ebp - 0x38]
call fcn.00405360
push eax
call fcn.005ab8a9
add esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x450]
push ecx
call fcn.005ac658
add esp, 4
jmp 0x67f896
lea ecx, [ebp - 0x38]
call fcn.00405360
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00405300
lea edx, [ebp + 0x14]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.005b0ce5
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x67f8c9
jmp 0x67f976
mov edx, dword [ebp - 0x10]
add edx, 8
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.005a4688
add esp, 4
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x18]
push eax
call fcn.005a7100
add esp, 0xc
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.005b0efe
add esp, 0x10
mov dword [ebp - 0x14], 0
cmp dword [0x758a90], 1
jne 0x67f964
mov edx, dword [ebp + 8]
cmp dword [edx + 0x450], 0
je 0x67f964
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x450]
push ecx
push 1
mov edx, dword [ebp - 0x18]
push edx
call fcn.005a7ce0
add esp, 4
push eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.005ab8a9
add esp, 0x10
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x450]
push edx
call fcn.005ac658
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.005a7656
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005a6f18
mov esp, ebp
pop ebp
ret
Function at 0x686800
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x75aa5c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x34], ecx
mov eax, dword [str.mshtml.dll]
mov dword [ebp - 0x20], eax
mov ecx, dword [0x718cd4]
mov dword [ebp - 0x1c], ecx
mov edx, dword [0x718cd8]
mov dword [ebp - 0x18], edx
mov eax, dword [0x718cdc]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x718ce0]
mov dword [ebp - 0x10], ecx
mov dx, word [0x718ce4]
mov word [ebp - 0xc], dx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x686931
mov edx, dword [ebp - 0x24]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x686931
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x20]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x686927
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x30]
push edx
push 0x718ce8
mov eax, dword [ebp - 0x28]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x686927
cmp dword [ebp - 0x2c], 0
je 0x686927
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 8]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 8]
and eax, 0xffff
movzx ecx, ax
mov edx, dword [ebp - 0x34]
mov dword [edx + 8], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
mov eax, dword [ebp - 0x34]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0xc]
and edx, 0xffff
movzx eax, dx
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 4]
push ecx
push 0x718cf0
call fcn.005b13f9
add esp, 0x14
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005a6f18
mov esp, ebp
pop ebp
ret
Function at 0x686af0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x75aa5c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [str.wmp.dll]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x718de4]
mov dword [ebp - 0x14], ecx
mov edx, dword [0x718de8]
mov dword [ebp - 0x10], edx
mov eax, dword [0x718dec]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x18]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x686c0c
mov eax, dword [ebp - 0x1c]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x686c0c
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x18]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x686c02
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x28]
push eax
push 0x718df0
mov ecx, dword [ebp - 0x20]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x686c02
cmp dword [ebp - 0x24], 0
je 0x686c02
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 8]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov edx, dword [ebp - 0x2c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 8]
and ecx, 0xffff
movzx edx, cx
mov eax, dword [ebp - 0x2c]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0xc]
and eax, 0xffff
movzx ecx, ax
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x10], ecx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
push edx
push str.mshtml.dll_VersionInfo:__n_tMajorVersion_d_n_tMinorVersion_d_n_tBuildNumber_d_n_tRevisionNumber_d_n
call fcn.005b13f9
add esp, 0x14
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005a6f18
mov esp, ebp
pop ebp
ret
Function at 0x69c910
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e3759
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x75aa5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.ENetPlusPeer.0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.0069e8b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0069e8b0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.0069e8b0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xd0
call fcn.0069e9b0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0xec
call fcn.0069eb90
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x108
call fcn.0069edf0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x124
call fcn.0069edf0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x10]
add eax, 0xc
push eax
call fcn.0062e6c0
add esp, 4
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x10], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00692420
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00692420
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.00692420
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x4c], 0
mov eax, dword [ebp - 0x10]
add eax, 0x254
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x254], eax
mov edx, dword [ebp - 0x10]
add edx, 0x254
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x258], edx
xor ecx, ecx
jne 0x69ca01
mov edx, dword [ebp - 0x10]
add edx, 0x25c
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x25c], edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x25c
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x260], ecx
xor eax, eax
jne 0x69ca28
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x69ca70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e37cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x75aa5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.ENetPlusPeer.0
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.0062e620
movzx ecx, al
test ecx, ecx
je 0x69cadc
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.0062e620
movzx edx, al
test edx, edx
je 0x69cadc
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0062e620
movzx eax, al
test eax, eax
jne 0x69cb1b
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
push ecx
call fcn.0062e6f0
add esp, 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00692420
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00692420
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.00692420
mov edx, dword [ebp - 0x10]
add edx, 0xc
push edx
call fcn.0062e710
add esp, 4
mov eax, dword [ebp - 0x10]
add eax, 0xc
push eax
call fcn.0062e730
add esp, 4
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x124
call fcn.0069ee70
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x108
call fcn.0069ee70
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0xec
call fcn.0069ec10
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xd0
call fcn.0069ea30
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.0069e930
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0069e930
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.0069e930
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x69d600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e387a
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x75aa5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x18]
call fcn.00692190
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x20]
add eax, 0xc
push eax
call fcn.0062e6f0
add esp, 4
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x20]
add ecx, 0x30
call fcn.006923e0
mov edx, dword [ebp - 0x20]
add edx, 0xc
push edx
call fcn.0062e710
add esp, 4
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.006921b0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x6a2f50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov byte [eax], 0
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x6a2ef0
push 0
push 0
call fcn.005aa391
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6a2f95
mov edx, dword [ebp - 8]
mov dword [edx + 0x2e2d], 0xffffffff
or eax, 0xffffffff
jmp 0x6a2fa3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x2e2d], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x6a94b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xc
call fcn.005ace68
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x14]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0068f6b2
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x6ac990
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
pop ebp
ret
Function at 0x6c1974
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x6c19a5
call fcn.005b5104
mov dword [eax], esi
call fcn.005b50f1
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005a7823
add esp, 0x14
push 0x16
pop eax
jmp 0x6c19fa
test dword [ebp + 0xc], 0xfffffff9
jne 0x6c1981
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x6c19d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005b5117
pop ecx
call fcn.005b50f1
mov eax, dword [eax]
jmp 0x6c19fa
test al, 0x10
jne 0x6c19f8
test al, 1
je 0x6c19f8
test byte [ebp + 0xc], 2
je 0x6c19f8
call fcn.005b5104
mov dword [eax], 5
call fcn.005b50f1
mov dword [eax], 0xd
jmp 0x6c19c9
xor eax, eax
pop esi
pop ebp
ret
Function at 0x401010
Capabilities:
Access firewall policy via inetfwpolicy2
Access firewall rule properties via inetfwrule

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [ebp - 8]
push eax
push 0x58b74c
xor ebx, ebx
push 1
push ebx
push 0x58b76c
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call esi
test eax, eax
js 0x401117
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ecx + 0x48]
call eax
test eax, eax
js 0x401117
lea ecx, [ebp - 4]
push ecx
push 0x58b73c
push 1
push ebx
push 0x58b75c
call esi
test eax, eax
js 0x401117
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push edi
mov edi, dword [edx]
push eax
call esi
mov ecx, dword [ebp - 4]
mov edx, dword [edi + 0x30]
push eax
push ecx
call edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
push ecx
call esi
mov edx, dword [ebp - 4]
push eax
mov eax, dword [edi + 0x20]
push edx
call eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x98]
call eax
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov edi, dword [ecx]
push edx
call esi
mov ecx, dword [edi + 0x28]
push eax
mov eax, dword [ebp - 4]
push eax
call ecx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
push 0x100
push eax
mov eax, dword [edx + 0x40]
call eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa8]
push 1
push eax
call edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
pop edi
test eax, eax
js 0x401117
mov ebx, 1
mov eax, dword [ebp - 4]
test eax, eax
je 0x401126
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 8]
test eax, eax
je 0x401135
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401490
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x60c9c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
mov ebx, ecx
mov dword [ebp - 0x11c], 0x270f
mov dword [ebp - 0x118], 0
call fcn.00531fb0
add esp, 0xc
test esi, esi
je 0x4015b3
test edi, edi
je 0x4015b3
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4014f0
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x4015b3
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401510
sub eax, edx
sar eax, 1
cmp eax, 0x270f
ja 0x4015b3
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x40154c
pop edi
pop esi
mov eax, 0x7d0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00531f97
mov esp, ebp
pop ebp
ret 8
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x4015ec
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4015cb
cmp dword [ebp - 0x114], 6
mov ecx, ebx
jb 0x40158c
push edi
call fcn.00401280
jmp 0x401592
push esi
call fcn.004011e0
test eax, eax
je 0x4015cb
xor esi, esi
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00531f97
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, 0x3e8
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00531f97
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp - 0x11c]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00531f97
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x11c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00531f97
mov esp, ebp
pop ebp
ret 8
Function at 0x401610
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x60c9c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
push 0x110
mov dword [ebp - 0x120], ecx
lea ecx, [ebp - 0x114]
push 0
push ecx
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x11c], 0x270f
mov dword [ebp - 0x118], 0
call fcn.00531fb0
add esp, 0xc
test edi, edi
je 0x4016d6
test ebx, ebx
je 0x4016d6
cmp dword [ebp - 0x124], 0
je 0x4016d6
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401684
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x4016d6
mov eax, ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4016a0
sub eax, edx
sar eax, 1
cmp eax, 0x270f
ja 0x4016d6
test esi, esi
je 0x4016ee
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4016c0
sub eax, edx
sar eax, 1
cmp eax, 0x270f
jbe 0x4016ee
pop edi
pop esi
mov eax, 0x3e8
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00531f97
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp - 0x124]
push 0x55be6c
push esi
call fcn.005321b4
add esp, 8
test eax, eax
jne 0x40170d
mov esi, 0x7fffffff
jmp 0x401750
push str.DOMAIN
push esi
call fcn.005321b4
add esp, 8
test eax, eax
jne 0x401724
lea esi, [eax + 1]
jmp 0x401750
push str.PRIVATE
push esi
call fcn.005321b4
add esp, 8
test eax, eax
jne 0x40173b
lea esi, [eax + 2]
jmp 0x401750
push str.PUBLIC
push esi
call fcn.005321b4
add esp, 8
test eax, eax
jne 0x4016d6
lea esi, [eax + 4]
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x401772
pop edi
pop esi
mov eax, 0x7d0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00531f97
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x120]
push ebx
push edi
call fcn.00401490
test eax, eax
jne 0x40181c
push 6
push eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x40181c
lea edx, [ebp - 0x118]
push edx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4017fb
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 0x120]
jb 0x4017d3
mov eax, dword [ebp - 0x128]
push eax
push esi
push ebx
push edi
call fcn.00401010
jmp 0x4017da
push ebx
push edi
call fcn.00401340
test eax, eax
je 0x4017fb
xor esi, esi
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00531f97
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp - 0x11c]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00531f97
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x11c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00531f97
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401870
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x60c9c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x401899
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00531f97
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401888
push 3
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
xor eax, eax
test esi, esi
je 0x4018e3
push 5
lea ecx, [ebp - 0x10]
push ecx
push 2
push esi
mov word [ebp - 0x10], ax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
call dword [sym.imp.USER32.dll_LoadStringW]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x10]
push edx
call fcn.00401840
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00531f97
mov esp, ebp
pop ebp
ret

Function at 0x402aa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402abb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402af2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x402aee
jmp 0x402ae0
cmp esi, eax
jae 0x402af2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402ae0
cmp esi, eax
jb 0x402af9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret