joyce8/EMBER2024-capa huggingface dataset:
Function at 0x577c5a
Capabilities:
Get file version info

Disassembly:
push 0xc
mov eax, 0x5ac622
call fcn.0052ca12
xor ebx, ebx
push str.make
mov dword [ebp - 0x10], ebx
push dword [0x6509dc]
lea ecx, [ebp - 0x10]
call fcn.005207dc
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x18], 0x10
mov dword [ebp - 4], ebx
lea edi, [esi + 4]
jb 0x577c91
mov eax, dword [edi]
jmp 0x577c93
mov eax, edi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x577cb7
mov esi, dword [ebp + 8]
and dword [esi], eax
and dword [esi + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0051f8d9
mov eax, esi
jmp 0x577d38
push ebx
call fcn.00401009
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.0041efba
cmp dword [esi + 0x18], 0x10
mov byte [ebp - 4], 1
jb 0x577cd3
mov edi, dword [edi]
push dword [ebp - 0x18]
push ebx
xor ebx, ebx
push ebx
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x577cf6
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.0041f00d
jmp 0x577ca8
push 0xc
call fcn.00401009
pop ecx
mov dword [ebp + 0xc], eax
cmp eax, ebx
mov byte [ebp - 4], 2
je 0x577d16
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
call fcn.00577bc3
jmp 0x577d18
xor eax, eax
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 1
call fcn.004a9c1e
lea ecx, [ebp - 0x18]
call fcn.0041f00d
lea ecx, [ebp - 0x10]
call fcn.0051f8d9
mov eax, dword [ebp + 8]
call fcn.0052caea
ret

Function at 0x577d53
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push str.uninstall
push dword [0x650a14]
mov esi, ecx
lea ecx, [ebp - 8]
call fcn.005207dc
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x577d9c
lea ecx, [ebp - 4]
call fcn.00577d3e
lea ecx, [ebp - 8]
call fcn.0051f8d9
xor al, al
pop esi
pop ebx
leave
ret
cmp dword [esi + 0x38], 0x10
jb 0x577da7
mov esi, dword [esi + 0x24]
jmp 0x577daa
add esi, 0x24
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x577dda
lea ecx, [ebp - 0xc]
call fcn.00577d3e
lea ecx, [ebp - 4]
call fcn.00577d3e
lea ecx, [ebp - 8]
call fcn.0051f8d9
mov al, bl
jmp 0x577d98
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
jmp 0x577dbe
Function at 0x577deb
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push str.start
push dword [0x650a14]
mov esi, ecx
lea ecx, [ebp - 8]
call fcn.005207dc
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x577e34
lea ecx, [ebp - 4]
call fcn.00577d3e
lea ecx, [ebp - 8]
call fcn.0051f8d9
xor al, al
pop esi
pop ebx
leave
ret
cmp dword [esi + 0x38], 0x10
jb 0x577e3f
mov esi, dword [esi + 0x24]
jmp 0x577e42
add esi, 0x24
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x577e60
lea ecx, [ebp - 0xc]
call fcn.00577d3e
jmp 0x577e1e
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x577e96
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x577e96
lea ecx, [ebp - 0xc]
call fcn.00577d3e
lea ecx, [ebp - 4]
call fcn.00577d3e
lea ecx, [ebp - 8]
call fcn.0051f8d9
mov al, bl
jmp 0x577e30
mov bl, 1
jmp 0x577e7a

Function at 0x577e9a
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push str.stop
push dword [0x650a14]
mov esi, ecx
lea ecx, [ebp - 8]
call fcn.005207dc
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x577ee3
lea ecx, [ebp - 4]
call fcn.00577d3e
lea ecx, [ebp - 8]
call fcn.0051f8d9
xor al, al
pop esi
pop ebx
leave
ret
cmp dword [esi + 0x38], 0x10
jb 0x577eee
mov esi, dword [esi + 0x24]
jmp 0x577ef1
add esi, 0x24
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x577f21
lea ecx, [ebp - 0xc]
call fcn.00577d3e
lea ecx, [ebp - 4]
call fcn.00577d3e
lea ecx, [ebp - 8]
call fcn.0051f8d9
mov al, bl
jmp 0x577edf
lea ecx, [ebp - 0x28]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
jmp 0x577f05
Function at 0x57818b
Capabilities:
Get disk information

Disassembly:
push 0x10
mov eax, 0x5ac752
call fcn.0052ca12
push str.isValidFileName
push dword [0x650a14]
lea ecx, [ebp - 0x10]
call fcn.005207dc
mov ebx, dword [ebp + 8]
xor esi, esi
push esi
push 0x80
push 3
push esi
push esi
push SysReAllocString
lea eax, [ebp - 0x1c]
push ebx
push eax
mov dword [ebp - 4], esi
call fcn.00526523
add esp, 0x20
cmp dword [ebp - 0x1c], esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
jne 0x5781e4
call fcn.0051499f
jmp 0x57829c
call fcn.0051499f
cmp dword [ebx + 0x18], 0x10
lea eax, [ebx + 4]
mov dword [ebp + 8], eax
jb 0x5781f7
mov eax, dword [eax]
push esi
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push eax
call esi
mov edi, eax
cmp edi, 3
jb 0x57829c
push edi
call fcn.00401009
pop ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.004e6a0b
cmp dword [ebx + 0x18], 0x10
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 2
jb 0x57822d
mov eax, dword [eax]
push 0
push dword [ebp - 0x1c]
lea ecx, [edi + 1]
push ecx
push eax
call esi
inc eax
cmp eax, edi
jne 0x578294
mov esi, dword [ebp - 0x1c]
cmp byte [esi + 1], 0x3a
jne 0x578294
mov ecx, dword [ebp + 0xc]
push esi
call fcn.0040eb76
push esi
mov byte [esi + 3], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x578294
cmp dword [ebx + 0x18], 0x10
mov eax, dword [ebp + 8]
jb 0x57826b
mov eax, dword [eax]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
test eax, eax
je 0x578294
cmp dword [ebp - 0x14], 0
jne 0x578294
lea ecx, [ebp - 0x1c]
call fcn.00477d8a
lea ecx, [ebp - 0x10]
call fcn.0051f8d9
mov al, 1
jmp 0x5782a6
lea ecx, [ebp - 0x1c]
call fcn.00477d8a
lea ecx, [ebp - 0x10]
call fcn.0051f8d9
xor al, al
call fcn.0052caea
ret 8
Function at 0x5782ae
Capabilities:
Create service

Disassembly:
push 0x30
mov eax, 0x5ac77d
call fcn.0052ca7b
push str.install
push dword [0x650a14]
mov esi, ecx
lea ecx, [ebp - 0x38]
call fcn.005207dc
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0xf
call fcn.0040efb9
lea eax, [ebp - 0x2c]
push eax
lea eax, [esi + 4]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0057818b
test al, al
jne 0x578316
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040eb93
lea ecx, [ebp - 0x38]
call fcn.0051f8d9
xor al, al
call fcn.0052cafe
ret
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp - 0x3c], eax
jne 0x57834d
mov byte [ebp - 0x2d], bl
lea ecx, [ebp - 0x3c]
call fcn.00577d3e
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040eb93
lea ecx, [ebp - 0x38]
call fcn.0051f8d9
mov al, byte [ebp - 0x2d]
jmp 0x578310
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [ebp - 0x28]
jae 0x578359
lea ecx, [ebp - 0x28]
cmp dword [esi + 0x38], 0x10
jb 0x578364
mov eax, dword [esi + 0x24]
jmp 0x578367
lea eax, [esi + 0x24]
cmp dword [esi + 0x38], 0x10
jb 0x578372
mov esi, dword [esi + 0x24]
jmp 0x578375
add esi, 0x24
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push 1
push 3
push 1
push 0xf01ff
push eax
push esi
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, ebx
mov dword [ebp - 0x34], eax
jne 0x5783a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x5783b6
lea ecx, [ebp - 0x34]
call fcn.00577d3e
mov byte [ebp - 0x2d], 1
jmp 0x57832d
lea ecx, [ebp - 0x34]
call fcn.00577d3e
jmp 0x57832a
Function at 0x5784d9
Capabilities:
Link many functions at runtime

Disassembly:
cmp byte [0x66022c], 0
jne 0x578615
push esi
push edi
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.NtCancelIoFile
push edi
call esi
push str.NtClose
push edi
mov dword [0x660214], eax
call esi
push str.NtCreateSymbolicLinkObject
push edi
mov dword [0x6601d8], eax
call esi
push str.NtDeviceIoControlFile
push edi
mov dword [0x6601e0], eax
call esi
push str.NtOpenDirectoryObject
push edi
mov dword [0x660204], eax
call esi
push str.NtOpenFile
push edi
mov dword [0x660218], eax
call esi
push str.NtOpenSymbolicLinkObject
push edi
mov dword [0x660220], eax
call esi
push str.NtQueryDirectoryObject
push edi
mov dword [0x66020c], eax
call esi
push str.NtQueryObject
push edi
mov dword [0x6601e8], eax
call esi
push str.NtQuerySymbolicLinkObject
push edi
mov dword [0x6601e4], eax
call esi
push str.NtReadFile
push edi
mov dword [0x6601fc], eax
call esi
push str.NtShutdownSystem
push edi
mov dword [0x6601f8], eax
call esi
push str.NtWaitForSingleObject
push edi
mov dword [0x66021c], eax
call esi
push str.NtWriteFile
push edi
mov dword [0x660208], eax
call esi
push str.RtlEqualUnicodeString
push edi
mov dword [0x6601dc], eax
call esi
push str.RtlInitUnicodeString
push edi
mov dword [0x6601f4], eax
call esi
push str.RtlStringFromGUID
push edi
mov dword [0x660224], eax
call esi
push str.NtOpenSection
push edi
mov dword [0x6601f0], eax
call esi
push str.NtMapViewOfSection
push edi
mov dword [0x660210], eax
call esi
push str.NtUnmapViewOfSection
push edi
mov dword [0x660200], eax
call esi
push str.NtFsControlFile
push edi
mov dword [0x6601ec], eax
call esi
pop edi
mov dword [0x660228], eax
mov byte [0x66022c], 1
pop esi
ret
Function at 0x403e10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eb5e8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x53b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x50]
push 0x40
push 0
push eax
mov dword [ebp - 0x54], 0x44
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x28], 1
lea ecx, [ebp - 0x64]
xor eax, eax
cmp dword [ebp + 0x1c], 8
xorps xmm0, xmm0
mov word [ebp - 0x24], ax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0
push 0x10
push 0
push 0
push 0
push eax
push 0
movups xmmword [ebp - 0x64], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403ebf
imul eax, dword [ebp + 0x20], 0x3e8
push eax
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x65], 1
jmp 0x403ec3
mov byte [ebp - 0x65], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040b220
mov al, byte [ebp - 0x65]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9681
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x404250
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eb6c6
mov eax, dword fs:[0]
push eax
sub esp, 0x8a0
mov eax, dword [0x53b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
lea eax, [ebp - 0x810]
push eax
push 0x509dc4
push str.powershell.exe
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wsearchenv_s]
add esp, 0x1c
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4042c6
xor al, al
jmp 0x40435f
push 0x98
lea eax, [ebp - 0x8a8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 4
lea ecx, [ebp - 0x8a8]
call fcn.0040a890
mov dword [ebp - 4], 0
mov edx, 0x509e7c
lea ecx, [ebp - 0x8a8]
call fcn.0040b550
lea edx, [ebp - 0x810]
mov ecx, eax
call fcn.0040b550
mov edx, 0x509e74
mov ecx, eax
call fcn.0040b550
mov edx, 0x509e80
mov ecx, eax
call fcn.0040b550
push 0x14
sub esp, 0x18
lea ecx, [ebp - 0x8a8]
mov eax, esp
mov dword [ebp - 0x8ac], esp
push eax
call fcn.0040a7a0
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
call fcn.00403e10
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a8]
call fcn.004041d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9681
mov esp, ebp
pop ebp
ret
Function at 0x407e60
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ec183
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x53b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x40]
lea ecx, [eax + 0x26]
call fcn.004ace40
test al, al
je 0x40801e
push 0x16
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push str.2345Soft2345Installer
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0040b290
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x88]
call fcn.004ac8d0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x40]
cmp eax, esi
je 0x407f43
mov ecx, eax
call fcn.0040b220
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x30], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x88]
call fcn.0040b220
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040b220
push 0xf
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
lea ecx, [ebp - 0x70]
push str.InstallCfg.data
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
call fcn.0040b290
mov byte [ebp - 4], 3
lea eax, [ebp - 0x70]
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.004ac8d0
add esp, 4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x70]
call fcn.0040b220
lea ecx, [ebp - 0x58]
call fcn.004cd0d0
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmovae eax, dword [ebp - 0x40]
push eax
call esi
test eax, eax
jne 0x408012
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 6
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.004cd7c0
test al, al
je 0x408006
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
call fcn.0040b220
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.0040b220
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040b220
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9681
mov esp, ebp
pop ebp
ret
Function at 0x411430
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed6e0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x53b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x34]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x18], xmm0
xor esi, esi
mov dword [ebp - 0x18], esi
xor bl, bl
push fcn.00410460
mov byte [ebp - 0x14], bl
push 6
mov dword [ebp - 0x34], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x411519
cmp dword [ebp - 0x34], esi
je 0x411519
xor eax, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov dword [ebp - 4], eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x30]
push str.9CDB4DA2_ACEA_446E_AA3A_D25628140939__d__p
push eax
call fcn.004a7e40
add esp, 0x10
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
cmovae eax, dword [ebp - 0x30]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x41150a
push 0xffffffffffffffff
push esi
call edi
test eax, eax
jne 0x4114f9
mov bl, 1
mov byte [ebp - 0x14], bl
jmp 0x41150a
xor bl, bl
push esi
mov byte [ebp - 0x14], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040b220
mov dword [ebp - 4], 1
cmp byte [0x53ce88], 0
jne 0x411552
mov ecx, dword [0x53ce68]
test ecx, ecx
je 0x41153e
push 0xffffffffffffffff
push ecx
call edi
mov ecx, dword [0x53ce68]
mov eax, dword [0x53ce60]
mov edi, dword [eax]
test ecx, ecx
je 0x411554
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x411554
xor edi, edi
mov dword [ebp - 4], 0xffffffff
test bl, bl
je 0x41156c
test esi, esi
je 0x41157f
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x411570
test esi, esi
je 0x41157f
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
mov dword [ebp - 0x18], 0
mov eax, edi
mov byte [ebp - 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9681
mov esp, ebp
pop ebp
ret
Function at 0x415ea0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ee101
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x53b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor ecx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], cx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x2c], 1
jb 0x415f05
mov eax, dword [eax]
push 0
push eax
push str._s._d.del
push esi
call fcn.004a7e40
add esp, 0x10
cmp dword [esi + 0x10], 0
je 0x415f95
push esi
lea ecx, [ebp - 0x28]
call fcn.0040be30
mov dword [ebp - 4], 1
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.004ac730
lea ecx, [ebp - 0x28]
call fcn.004ccd30
cmp eax, 0xffffffff
je 0x415f89
test al, 0x10
je 0x415f89
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp dword [esi + 0x10], 0
je 0x415f95
mov ecx, esi
call fcn.004cd0d0
test al, al
je 0x415f72
mov ecx, esi
call fcn.004a8870
test al, al
je 0x415f95
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x415f7c
mov eax, dword [esi]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x415f95
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040b220
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9681
mov esp, ebp
pop ebp
ret 8

Function at 0x4160f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x416121
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x416110
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x418ff0
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4191bd
cmp eax, 0x7c
je 0x4191bd
cmp eax, 0x29
jne 0x419031
cmp dword [esi + 0x10], 0
jne 0x4191bd
cmp eax, eax
jne 0x419031
test dword [esi + 0x50], 0x10000000
je 0x4191ca
jmp 0x419176
cmp eax, 0x2e
jne 0x419045
push 5
lea ecx, [esi + 0x24]
call fcn.00419220
jmp 0x4191a1
cmp eax, 0x5c
jne 0x4190a1
mov ecx, esi
call fcn.00418f90
test byte [esi + 0x50], 0x80
je 0x419095
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x419074
push 4
lea ecx, [esi + 0x24]
call fcn.00419220
mov ecx, esi
call fcn.00418f90
jmp 0x4191af
cmp al, 0x42
jne 0x419095
push 4
lea ecx, [esi + 0x24]
call fcn.00419220
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00418f90
jmp 0x4191af
mov ecx, esi
call fcn.0041a470
jmp 0x4191a8
cmp eax, 0x5b
jne 0x419102
mov ecx, esi
call fcn.00418f90
lea ecx, [esi + 0x24]
call fcn.0041b970
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x4190ce
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00418f90
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x4190ec
cmp eax, 0x5d
jne 0x4190ec
push eax
lea ecx, [esi + 0x24]
call fcn.0041ba50
mov ecx, esi
call fcn.00418f90
mov ecx, esi
call fcn.0041b3f0
cmp dword [esi + 0x4c], 0x5d
jne 0x4191d1
jmp 0x4191a1
cmp eax, 0x28
jne 0x419132
mov ecx, esi
call fcn.00418f90
mov ecx, esi
call fcn.0041a620
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4191ca
mov ecx, esi
call fcn.00418f90
test bl, bl
je 0x4191af
jmp 0x4191a8
cmp eax, 0x5e
jne 0x41914a
push 2
lea ecx, [esi + 0x24]
call fcn.00419220
mov ecx, esi
call fcn.00418f90
jmp 0x4191af
cmp eax, 0x24
jne 0x419162
push 3
lea ecx, [esi + 0x24]
call fcn.00419220
mov ecx, esi
call fcn.00418f90
jmp 0x4191af
cmp eax, 0x2a
je 0x4191c3
cmp eax, 0x2b
je 0x4191c3
cmp eax, 0x3f
je 0x4191c3
cmp eax, 0x7b
je 0x4191c3
cmp eax, 0x7d
jne 0x419186
test dword [esi + 0x50], 0x10000000
je 0x4191d8
jmp 0x419194
cmp eax, 0x5d
jne 0x419194
test dword [esi + 0x50], 0x10000000
je 0x4191d1
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0041a880
mov ecx, esi
call fcn.00418f90
mov ecx, esi
call fcn.0041a730
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x419003
pop edi
pop esi
mov al, cl
pop ebx
ret
push 0xa
call fcn.00417b20
push 5
call fcn.00417b20
push 4
call fcn.00417b20
push 6
call fcn.00417b20
int3
Function at 0x42fcb0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f22a0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x53b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
call fcn.004ccf30
mov bl, al
test bl, bl
je 0x42fd8a
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x42fcf8
mov eax, dword [esi]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [0x53b2d4], 0
je 0x42fe4b
push 0
mov ecx, 0x53b2d0
call fcn.0043d750
mov eax, dword [0x53b2d4]
cmp byte [eax + 0x54], 0
je 0x42fe4b
cmp dword [eax + 0x58], 4
jb 0x42fe4b
mov bh, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
cmp dword [edi + 0x14], 8
jb 0x42fd65
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x42fd6d
mov esi, dword [esi]
push edi
push esi
lea eax, [ebp - 0x28]
push str.Move_File_succeed__src__s___dest__s_
push eax
call fcn.004a7e40
add esp, 0x10
push 0x1ce
jmp 0x42fe10
cmp dword [0x53b2d4], 0
je 0x42fe4b
push 0
mov ecx, 0x53b2d0
call fcn.0043d750
mov eax, dword [0x53b2d4]
cmp byte [eax + 0x54], 0
je 0x42fe4b
cmp dword [eax + 0x58], 4
jb 0x42fe4b
mov bh, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 1
cmp dword [edi + 0x14], 8
jb 0x42fdf0
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x42fdf8
mov esi, dword [esi]
push edi
push esi
lea eax, [ebp - 0x28]
push str.Move_File_failed__src__s___dest__s_
push eax
call fcn.004a7e40
add esp, 0x10
push 0x1d2
push str.RC::RCSafeUpdateUtils::MoveFileToCommonFiles
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhino_safe_src_safecommon_safeutilslibupdate_rcsafeupdateutils.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x53b2d0
push eax
push 4
call fcn.0043e8f0
test bh, bh
je 0x42fe3c
lea eax, [ebp - 0x28]
mov ecx, 0x53b2d0
push eax
call fcn.0043eca0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040b220
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9681
mov esp, ebp
pop ebp
ret