joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ef2c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40f0bb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x57e9e0], 0
je 0x40ef62
mov eax, ebx
call dword [0x57e9e0]
movzx eax, byte [edi]
sub al, 2
jae 0x40f008
mov eax, ebx
call fcn.00405308
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405794
mov eax, ebx
call fcn.00405308
test eax, eax
jns 0x40ef8e
call fcn.00403edc
push eax
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.user32.dll_CharToOemBuffA
test eax, eax
jne 0x40efb3
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004050c4
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405308
test eax, eax
jns 0x40efca
call fcn.00403edc
push eax
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
push esi
call sub.kernel32.dll_WriteConsoleA
test eax, eax
je 0x40efe4
cmp dword [ebp - 0x10], 0
jne 0x40effc
mov eax, 0x40f0d8
call fcn.0040ee50
test al, al
je 0x40eff7
mov byte [edi], 3
jmp 0x40f008
mov byte [edi], 2
jmp 0x40f008
mov byte [ebp - 9], 0
mov byte [edi], 1
jmp 0x40f0a0
mov byte [ebp - 9], 1
cmp byte [edi], 3
jne 0x40f050
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, ebx
call fcn.00405308
test eax, eax
jns 0x40f027
call fcn.00403edc
push eax
mov eax, 1
dec eax
test ebx, ebx
je 0x40f037
cmp eax, dword [ebx - 4]
jb 0x40f03c
call fcn.00403edc
inc eax
lea eax, [ebx + eax - 1]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_FlushFileBuffers
jmp 0x40f0a0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004050c4
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00405308
test eax, eax
jns 0x40f071
call fcn.00403edc
push eax
lea eax, [ebp - 4]
call fcn.00405564
mov edx, 1
dec edx
test eax, eax
je 0x40f089
cmp edx, dword [eax - 4]
jb 0x40f08e
call fcn.00403edc
inc edx
lea eax, [eax + edx - 1]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_FlushFileBuffers
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f0c2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405050
ret
Function at 0x40f1b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406a54
test eax, eax
jne 0x40f1d4
push 0x57
call sub.kernel32.dll_SetLastError
jmp 0x40f253
lea eax, [ebp - 0xc]
push eax
push 0x40
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40f253
xor eax, eax
push ebp
push 0x40f245
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 8]
test ecx, ecx
jns 0x40f205
call fcn.00403edc
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00403348
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f24c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4146b8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
call fcn.0041456c
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.004038b8
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
push 0x10
push 0x3000
mov eax, dword [ebp - 0x24]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x414719
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
mov eax, ebx
call fcn.004146b4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x414725
push 0x8000
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualFree_1
test bl, bl
je 0x414741
mov eax, dword [0x57ad70]
or dword [eax], 0x10
xor ebx, ebx
xor eax, eax
test al, al
je 0x4147c5
push 4
push 0x3000
mov eax, dword [ebp - 0x24]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
mov esi, fcn.004146b4
mov eax, esi
mov edx, 0x32
call fcn.00414298
mov ebx, eax
test ebx, ebx
jns 0x41477a
call fcn.00403edc
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, ebx
call fcn.00403348
mov eax, dword [ebp - 4]
xor edx, edx
push ebp
push 0x4147a9
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, eax
mov eax, ebx
call esi
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4147b5
push 0x8000
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualFree_1
test bl, bl
je 0x4147de
mov eax, dword [0x57aed0]
mov eax, dword [eax]
or eax, 2
or eax, 4
mov edx, dword [0x57aed0]
mov dword [edx], eax
call fcn.00414660
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415ec0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov edi, eax
mov ebx, dword [ebp + 8]
test bl, bl
je 0x415fe0
mov eax, ebx
cmp al, 7
ja 0x415eec
and eax, 0x7f
bt dword [0x573130], eax
jb 0x415fe0
mov esi, 0xcc
movzx eax, bl
cmp eax, 6
ja case.0x415f03.0
jmp dword [eax*4 + 0x415f0a]
push 0x415fec
call sub.kernel32.dll_OutputDebugStringA
jmp 0x415fa4
push 0x416004
call sub.kernel32.dll_OutputDebugStringA
jmp 0x415fa4
push 0x41601c
call sub.kernel32.dll_OutputDebugStringA
jmp 0x415fa4
push 0x416038
call sub.kernel32.dll_OutputDebugStringA
jmp 0x415fa4
push 0x41604c
call sub.kernel32.dll_OutputDebugStringA
jmp 0x415fa4
push 0x416068
call sub.kernel32.dll_OutputDebugStringA
mov esi, 0xcb
mov eax, dword [0x67ef48]
call fcn.0040e524
test al, al
je 0x415fa4
push 0x8000
push 0
mov eax, dword [0x67ef48]
push eax
call sub.kernel32.dll_VirtualFree_1
xor eax, eax
mov dword [0x67ef48], eax
jmp 0x415fa4
push 0x416084
call sub.kernel32.dll_OutputDebugStringA
cmp dword [0x573134], 0
jne 0x415fc2
mov eax, esi
cmp eax, 0xff
jbe 0x415fbb
call fcn.00403edc
call fcn.00404f4c
jmp 0x415fe0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov ecx, dword [ebp - 8]
movzx edx, byte [ebp - 1]
mov eax, edi
call dword [0x573134]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0x14

Function at 0x419f30
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00419c9c
pop ecx
lea eax, [ebp - 0x2c]
call fcn.00402c98
cmp dword [ebp - 0x20], 0
je 0x419f69
mov ecx, 0x242010
mov edx, 0x41a030
mov eax, 0x41a064
call fcn.00415e0c
jmp 0x41a020
xor eax, eax
push ebp
push 0x41a019
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x419ff8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov esi, eax
mov edi, 0x573188
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 0x5731a0
mov esi, eax
mov edi, edx
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
call fcn.00419ae8
mov eax, 0x573188
call fcn.00403134
mov byte [0x67ef0e], 1
mov byte [0x67ef0f], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419fff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a174
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00419c9c
pop ecx
lea eax, [ebp - 0x2c]
call fcn.00402c98
cmp dword [ebp - 0x20], 0
je 0x41a1ae
mov ecx, 0x242010
mov edx, 0x41a368
mov eax, 0x41a39c
call fcn.00415e0c
jmp 0x41a356
xor eax, eax
push ebp
push 0x41a345
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41a324
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.0040ea5c
test al, al
je 0x41a205
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 0xc
call fcn.0040ea5c
test al, al
jne 0x41a214
mov eax, 0x5731a0
call fcn.00403120
jmp 0x41a2f5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 0x18
call fcn.0040ea5c
test al, al
je 0x41a2ac
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov esi, eax
mov edi, 0x573188
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [0x573194]
test ebx, ebx
je 0x41a258
mov edx, 1
mov eax, ebx
call fcn.0040eaa8
test al, al
jne 0x41a262
mov dword [0x573194], 0x418160
mov ebx, dword [0x573198]
test ebx, ebx
je 0x41a27c
mov edx, 1
mov eax, ebx
call fcn.0040eaa8
test al, al
jne 0x41a286
mov dword [0x573198], 0x418184
mov ebx, dword [0x57319c]
test ebx, ebx
je 0x41a2a0
mov edx, 1
mov eax, ebx
call fcn.0040eaa8
test al, al
jne 0x41a2e4
mov dword [0x57319c], 0x4181d0
jmp 0x41a2e4
mov eax, 0x573188
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov dword [0x573194], 0x418160
mov dword [0x573198], 0x418184
mov dword [0x57319c], 0x4181d0
mov esi, 0x573188
mov edi, 0x5731a0
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov eax, 0x573188
call fcn.00403134
mov byte [0x67ef0e], 1
mov byte [0x67ef0f], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a32b
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bdac
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, eax
test esi, esi
jne 0x41bdc2
call fcn.0040f60c
mov esi, eax
xor ebx, ebx
xor ecx, ecx
push ebp
push 0x41be42
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, esi
cmp word [edx], 0x5a4d
jne 0x41be38
mov eax, edx
add eax, 0x3c
mov eax, dword [eax]
test eax, eax
je 0x41be38
mov edi, edx
add edi, eax
mov edx, dword [edi]
cmp edx, 0x4550
jne 0x41be38
lea edx, [ebp - 0x14]
add edi, 4
mov eax, edi
mov ecx, 0x14
call fcn.00403348
test byte [ebp - 1], 0x20
je 0x41be36
push 0xa
push 0x41be58
push esi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x41be32
push 0xa
push 0x41be64
push esi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x41be32
mov bl, 3
jmp 0x41be38
mov bl, 2
jmp 0x41be38
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41be4e
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41c01c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
test eax, eax
jns 0x41c036
call fcn.00403edc
push eax
push 0x41bfdc
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop ebp
ret
Function at 0x41d694
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
xor esi, esi
mov edx, 0x40
mov eax, ebx
call fcn.0041c660
test al, al
je 0x41d6db
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x41d6db
cmp dword [eax + 0x3c], 0
je 0x41d6db
mov esi, dword [eax + 0x3c]
add esi, ebx
mov edx, 0xf8
mov eax, esi
call fcn.0041c660
test al, al
je 0x41d6d9
cmp dword [esi], 0x4550
je 0x41d6db
xor esi, esi
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x427c6c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x427cfc
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x427cfc
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x427caf
test edx, 3
jne 0x427c9e
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x427ca9
jmp 0x427caf
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x427caf
cmp dword [ecx - 8], 1
je 0x427cb9
mov edx, ebx
or edx, 3
call fcn.00405794
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x427ccb
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.0040502c

Function at 0x427d08
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x427d98
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x427d98
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x427d4b
test edx, 3
jne 0x427d3a
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x427d45
jmp 0x427d4b
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x427d4b
cmp dword [ecx - 8], 1
je 0x427d55
mov edx, ebx
or edx, 3
call fcn.00405794
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x427d67
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.0040502c

Function at 0x428bec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x428c05
test al, 0x10
je 0x428c09
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x428c10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x428c29
test al, 0x10
jne 0x428c2d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x42bf2c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x42bf65
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040511c
jmp 0x42bf6e
mov eax, ebx
mov edx, esi
call fcn.00405080
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42bf78
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x42bf9a
movzx eax, byte [esp]
jmp 0x42bf9c
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x42c62c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x42c4a4
mov eax, dword [0x57b268]
cmp byte [eax], 0
je 0x42c6a8
mov eax, dword [0x57ae80]
call fcn.00403708
call fcn.00403230
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00429320
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x42c6f0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x42c6de
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x57adec]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x57e7f8]
call fcn.00406acc
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x42cfa8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42d07e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004050c4
lea eax, [ebp - 4]
call fcn.0040555c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x42d068
mov eax, ebx
call fcn.0040309c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x42d061
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x42d04b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x42d090
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x42d04b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d068
mov eax, dword [ebp - 0x10]
call fcn.004030b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d085
lea eax, [ebp - 4]
call fcn.0040502c
ret

Function at 0x42e6d0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.0040502c
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.0040550c
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x42e715
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.0040511c
jmp 0x42e72e
mov edx, ebx
dec edx
mov eax, esi
call fcn.00405794
push ebx
mov eax, dword [esi]
call fcn.0040550c
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x444db0
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00444ac0
dec esi
jne 0x444dd2
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x445f44
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x67fed4
cmp dword [edi], 0
jne 0x445fc0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x67fed0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x573790
mov ecx, 2
call fcn.00403348
mov edx, 0x445f1c
lea eax, [esi + 5]
call fcn.00445f3c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00445f3c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x445f95
mov dword [0x67fed0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4461cc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4461ec
test al, 0x10
sete al
jmp 0x446213
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x44620d
cmp ebx, 3
je 0x44620d
cmp ebx, 0x7b
je 0x44620d
mov eax, esi
call fcn.0044618c
test al, al
jne 0x446211
xor eax, eax
jmp 0x446213
mov al, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x446244
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x446260
test al, 0x10
jne 0x446265
xor eax, eax
pop ebx
pop ebp
ret
mov al, 1
pop ebx
pop ebp
ret
Function at 0x447df0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
add eax, 0x10
test eax, eax
jns 0x447e00
call fcn.00403edc
push eax
push 8
mov eax, dword [0x68001c]
push eax
call sub.kernel32.dll_HeapAlloc
mov ebx, eax
test ebx, ebx
jne 0x447e2f
mov eax, 0x447e48
call fcn.00447198
call sub.kernel32.dll_GetLastError_1
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [str.PLEH]
mov dword [ebx], eax
add ebx, 0x10
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x448078
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0
push 0x500000
push 0
call sub.kernel32.dll_HeapCreate
mov dword [0x68001c], eax
cmp dword [0x68001c], 0
jne 0x4480aa
push 0
push 0
push 0
call sub.kernel32.dll_HeapCreate
mov dword [0x68001c], eax
cmp dword [0x68001c], 0
jne 0x4480ce
mov eax, 0x44810c
call fcn.00447198
call sub.kernel32.dll_GetLastError_1
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 0x18], fcn.00447df0
mov dword [ebp - 0x14], 0x447e68
mov dword [ebp - 0x10], 0x447ed0
mov dword [ebp - 0xc], 0x448000
mov dword [ebp - 8], 0x448070
mov dword [ebp - 4], 0x448074
lea eax, [ebp - 0x18]
call fcn.00403134
mov esp, ebp
pop ebp
ret
Function at 0x44aa6c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x40
call fcn.004038b8
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x10
call fcn.004038b8
mov dword [ebp - 0x50], 0x67452301
mov dword [ebp - 0x4c], 0xefcdab89
mov dword [ebp - 0x48], 0x98badcfe
mov dword [ebp - 0x44], 0x10325476
mov eax, ebx
shr eax, 0x1d
add dword [ebp - 0x5c], eax
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
add dword [ebp - 0x60], eax
cmp eax, dword [ebp - 0x60]
jbe 0x44aae0
inc dword [ebp - 0x5c]
test ebx, ebx
jbe 0x44ab5c
mov edi, 0x40
sub edi, dword [ebp - 0x54]
cmp ebx, edi
jb 0x44ab30
mov eax, dword [ebp - 0x54]
cmp eax, 0x3f
jbe 0x44aafd
call fcn.00403edc
lea edx, [ebp + eax - 0x40]
mov ecx, edi
test ecx, ecx
jns 0x44ab0c
call fcn.00403edc
mov eax, esi
call fcn.00403348
mov eax, 0x40
sub eax, dword [ebp - 0x54]
sub ebx, eax
mov eax, 0x40
sub eax, dword [ebp - 0x54]
add esi, eax
push ebp
call fcn.0044a1b0
pop ecx
jmp 0x44ab58
mov eax, dword [ebp - 0x54]
cmp eax, 0x3f
jbe 0x44ab3d
call fcn.00403edc
lea edx, [ebp + eax - 0x40]
mov ecx, ebx
test ecx, ecx
jns 0x44ab4c
call fcn.00403edc
mov eax, esi
call fcn.00403348
add dword [ebp - 0x54], ebx
xor ebx, ebx
test ebx, ebx
ja 0x44aae4
mov eax, dword [ebp - 0x54]
cmp eax, 0x3f
jbe 0x44ab69
call fcn.00403edc
mov byte [ebp + eax - 0x40], 0x80
cmp dword [ebp - 0x54], 0x38
jb 0x44ab7b
push ebp
call fcn.0044a1b0
pop ecx
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x5c]
mov dword [eax], edx
push ebp
call fcn.0044a1b0
pop ecx
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x50]
mov ecx, 0x10
call fcn.00403348
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret