joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420218
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 0xc]
call fcn.004049f0
mov eax, dword [ebp + 8]
call fcn.004049f0
xor eax, eax
push ebp
push 0x420350
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x42032b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push edi
push esi
call sub.advapi32.dll_RegCreateKeyA
cmp ebx, 4
jne 0x420297
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.00417454
mov dword [ebp - 0xc], eax
push 4
lea eax, [ebp - 0xc]
push eax
push ebx
push 0
mov eax, dword [ebp + 0xc]
call fcn.00404a00
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 1]
jmp 0x42030f
cmp ebx, 7
jne 0x4202de
lea eax, [ebp + 8]
mov edx, 0x42036c
call fcn.0040483c
lea eax, [ebp + 8]
call fcn.00404a60
mov edi, eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x4202bf
sub esi, 4
mov esi, dword [esi]
push esi
push edi
push ebx
push 0
mov eax, dword [ebp + 0xc]
call fcn.00404a00
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 1]
jmp 0x42030f
mov esi, dword [ebp + 8]
test esi, esi
je 0x4202ea
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebp + 8]
call fcn.00404a00
push eax
push ebx
push 0
mov eax, dword [ebp + 0xc]
call fcn.00404a00
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 1]
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegFlushKey
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x420335
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420357
lea eax, [ebp + 8]
mov edx, 2
call fcn.00404594
ret

Function at 0x420370
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004049f0
xor eax, eax
push ebp
push 0x42042b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x420415
xor edx, edx
push ebp
push 0x42040e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404a00
push eax
push 0
push 2
push 0x120
push 0xf01ff
push esi
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceA
test eax, eax
jne 0x4203f1
call fcn.00403fdc
jmp 0x420415
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420415
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420432
lea eax, [ebp - 4]
call fcn.00404570
ret
Function at 0x420cbc
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov eax, dword [ebp + 8]
call fcn.004049f0
xor eax, eax
push ebp
push 0x420e48
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp + 8]
mov edx, 0x420e60
call fcn.0040483c
lea eax, [ebp - 4]
push eax
push 0x420e64
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x420e25
lea eax, [ebp - 8]
mov ecx, 0x420e90
mov edx, dword [ebp + 8]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404a00
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
lea eax, [ebp - 0xc]
mov ecx, 0x420ea0
mov edx, dword [ebp + 8]
call fcn.00404888
mov eax, dword [ebp - 0xc]
call fcn.00404a00
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
lea eax, [ebp - 0x10]
mov ecx, 0x420eb4
mov edx, dword [ebp + 8]
call fcn.00404888
mov eax, dword [ebp - 0x10]
call fcn.00404a00
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
lea eax, [ebp - 0x14]
mov ecx, 0x420ec8
mov edx, dword [ebp + 8]
call fcn.00404888
mov eax, dword [ebp - 0x14]
call fcn.00404a00
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
lea eax, [ebp - 0x18]
mov ecx, 0x420ea0
mov edx, dword [ebp + 8]
call fcn.00404888
mov eax, dword [ebp - 0x18]
call fcn.00404a00
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
push dword [ebp + 8]
push 0x420edc
push dword [ebp + 8]
push 0x420ef0
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404904
mov eax, dword [ebp - 0x1c]
call fcn.00404a00
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
lea eax, [ebp - 0x20]
mov ecx, 0x420f04
mov edx, dword [ebp + 8]
call fcn.00404888
mov eax, dword [ebp - 0x20]
call fcn.00404a00
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [ebp + 8]
call fcn.00404a00
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420e4f
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00404594
lea eax, [ebp + 8]
call fcn.00404570
ret
Function at 0x4210b0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov esi, eax
xor eax, eax
push ebp
push 0x421179
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x421159
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 3
push 0x80000000
mov eax, dword [0x4420dc]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004213a4
lea eax, [ebp - 0x18]
mov edx, 0x421194
call fcn.0040483c
mov eax, dword [ebp - 0x18]
call fcn.00404a00
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42114f
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
call sub.kernel32.dll_GetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x421163
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421180
lea eax, [ebp - 0x18]
call fcn.00404570
ret

Function at 0x4213a4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
mov eax, dword [ebp + 0xc]
call fcn.004049f0
xor eax, eax
push ebp
push 0x421406
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00404a00
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.004047e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42140d
lea eax, [ebp + 0xc]
call fcn.00404570
ret
Function at 0x421738
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004049f0
mov eax, dword [ebp - 8]
call fcn.004049f0
xor eax, eax
push ebp
push 0x421892
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404570
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.00404a00
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
cmp dword [ebp - 0xc], 0
je 0x421877
xor eax, eax
push ebp
push 0x42185b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp + 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404a00
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00404c90
cmp dword [ebp + 0xc], 4
jne 0x42180e
mov eax, ebx
mov edx, 0x4218ac
call fcn.004045c4
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x421851
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.00406eb4
jmp 0x421851
lea eax, [ebp - 0x10]
push eax
mov eax, ebx
call fcn.00404a60
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x421851
cmp dword [ebp + 0xc], 7
jne 0x421841
mov edx, dword [ebp - 0x10]
dec edx
mov eax, ebx
call fcn.00404c90
jmp 0x421851
mov eax, dword [ebx]
call fcn.00404a00
mov edx, eax
mov eax, ebx
call fcn.00404768
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x421865
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegFlushKey
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421899
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404594
ret
Function at 0x4218b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 0xc]
call fcn.004049f0
mov eax, dword [ebp + 8]
call fcn.004049f0
xor eax, eax
push ebp
push 0x4219f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push edi
push esi
call sub.advapi32.dll_RegCreateKeyA
cmp dword [ebp - 8], 0
je 0x4219d7
xor eax, eax
push ebp
push 0x4219bb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 4
jne 0x421939
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.00406fa4
mov dword [ebp - 0xc], eax
push 4
lea eax, [ebp - 0xc]
push eax
push ebx
push 0
mov eax, dword [ebp + 0xc]
call fcn.00404a00
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 1]
jmp 0x4219b1
cmp ebx, 7
jne 0x421980
lea eax, [ebp + 8]
mov edx, 0x421a10
call fcn.0040483c
lea eax, [ebp + 8]
call fcn.00404a60
mov edi, eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x421961
sub esi, 4
mov esi, dword [esi]
push esi
push edi
push ebx
push 0
mov eax, dword [ebp + 0xc]
call fcn.00404a00
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 1]
jmp 0x4219b1
mov esi, dword [ebp + 8]
test esi, esi
je 0x42198c
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebp + 8]
call fcn.00404a00
push eax
push ebx
push 0
mov eax, dword [ebp + 0xc]
call fcn.00404a00
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4219c5
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegFlushKey
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4219f9
lea eax, [ebp + 8]
mov edx, 2
call fcn.00404594
ret
Function at 0x421f60
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
call fcn.004049f0
xor eax, eax
push ebp
push 0x42209c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x422074
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [ebx + 4]
mov eax, dword [ebp + 0xc]
call fcn.00410a1c
test al, al
jne 0x422054
mov eax, dword [ebp + 0xc]
call fcn.00404a00
mov esi, eax
push esi
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp + 0xc]
call fcn.004078d8
test al, al
je 0x421ffa
lea eax, [ebp - 4]
call fcn.00421414
cmp byte [ebp + 0x10], 0
je 0x421fe3
call fcn.00422b64
mov eax, dword [ebp - 4]
call fcn.00404a00
mov edi, eax
push edi
push esi
call sub.kernel32.dll_MoveFileA
push edi
call sub.kernel32.dll_DeleteFileA
push 0
push 0x80000000
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 0xc]
call fcn.00404a00
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x422054
mov eax, esi
call fcn.004210b0
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.004077b0
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00407784
push esi
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
push eax
call fcn.004125ec
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [ebx + 4]
mov eax, dword [ebp + 0xc]
call fcn.00410a1c
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42207e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4220a3
lea eax, [ebp - 4]
call fcn.00404570
lea eax, [ebp + 0xc]
call fcn.00404570
ret
Function at 0x4220b0
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4220b8
push ecx
push ebx
xor eax, eax
push ebp
push 0x422230
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, 0x422248
call fcn.00404608
lea eax, [ebp - 0x10]
mov edx, 0x422290
call fcn.00404608
lea edx, [ebp - 8]
mov eax, 0x4222dc
call fcn.00407058
push 0x4222dc
lea eax, [ebp - 0x18]
push eax
call fcn.004213a4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0xc]
call fcn.00407058
push 2
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404a00
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.00404768
mov edx, dword [ebp - 0x1c]
mov ecx, 0x422300
mov eax, 0x80000002
call fcn.00421738
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00407058
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.00404b4c
test eax, eax
jg 0x422171
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00407058
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00404b4c
test eax, eax
jg 0x422171
xor ebx, ebx
jmp 0x422173
mov bl, 1
test bl, bl
jne 0x4221b1
push 0x422300
push dword [ebp - 4]
push 0x422310
push dword [ebp - 8]
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00404904
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404a00
mov edx, eax
mov ecx, 2
mov eax, 0x80000002
call fcn.004218b0
push 2
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404a00
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404768
mov edx, dword [ebp - 0x2c]
mov ecx, 0x422300
mov eax, 0x80000002
call fcn.00421738
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.00407058
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.00404b4c
test eax, eax
jg 0x422213
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.00407058
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xc]
call fcn.00404b4c
test eax, eax
jg 0x422213
xor ebx, ebx
jmp 0x422215
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422237
lea eax, [ebp - 0x34]
mov edx, 0xd
call fcn.00404594
ret
Function at 0x4225b4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4226cb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x28]
mov edx, esi
call fcn.00404768
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x4226e4
call fcn.00404888
mov eax, dword [ebp - 0x24]
call fcn.00404a00
push eax
push 0
push 0xf001f
call sub.kernel32.dll_OpenFileMappingA
test eax, eax
jne 0x42269d
push 1
lea eax, [ebp - 0x20]
push eax
call sub.advapi32.dll_InitializeSecurityDescriptor
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push eax
call sub.advapi32.dll_SetSecurityDescriptorDacl
mov dword [ebp - 0xc], 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
mov edx, esi
call fcn.00404768
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x4226e4
call fcn.00404888
mov eax, dword [ebp - 0x2c]
call fcn.00404a00
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
test eax, eax
je 0x4226b0
push 0
push 0
push 0
push 0xf001f
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 4
call fcn.00403308
jmp 0x4226b0
push 0
push 0
push 0
push 0xf001f
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4226d2
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00404594
ret

Function at 0x4226ec
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 4]
cmp eax, 6
jae 0x42270d
cmp eax, 5
jae 0x422711
xor eax, eax
jmp 0x422713
mov al, 1
add esp, 0x94
ret
Function at 0x422a00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x422b3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
push ebp
push 0x422b11
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov edx, eax
lea ecx, [ebp - 0x10]
mov eax, dword [ebx + 4]
call fcn.00410998
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x422b5c
call fcn.00404888
mov eax, dword [ebp - 0xc]
call fcn.00404a00
push eax
push 0
push 0
call fcn.00406388
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x422b03
mov eax, dword [ebx + 4]
call fcn.00421f20
test al, al
jne 0x422a87
mov eax, ebx
call fcn.0040e578
mov eax, dword [ebx + 4]
call fcn.00421f20
test al, al
je 0x422b07
mov esi, dword [ebx + 4]
mov eax, esi
mov edx, dword [eax + 0x3c]
add edx, eax
mov eax, edx
movzx eax, word [eax + 0x16]
and ax, 0x2000
cmp ax, 0x2000
sete al
test al, al
je 0x422acf
push 0
push 0
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov edx, eax
mov eax, esi
xor ecx, ecx
call fcn.0040fc20
test eax, eax
seta byte [ebp - 5]
jmp 0x422b07
lea eax, [ebp - 4]
call fcn.004214b4
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408220
mov eax, dword [ebp - 4]
push eax
call fcn.004125ec
push 1
mov eax, dword [ebp - 4]
call fcn.00404a00
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x1f
seta byte [ebp - 5]
jmp 0x422b07
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x422b1b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422b45
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404594
lea eax, [ebp - 4]
call fcn.00404570
ret
Function at 0x422c1c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x430], edx
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x428], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049f0
xor eax, eax
push ebp
push 0x422de1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x421]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xc]
mov edx, 0x422dfc
call fcn.00404608
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a00
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
call fcn.00402da8
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x422d96
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x422d8c
lea eax, [ebp - 8]
mov edx, 0x422e10
call fcn.00404608
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a00
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x422d8c
push 0x422e34
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp - 0x20]
movzx edx, word [edx]
shl edx, 0x10
or eax, edx
lea ecx, [ebp - 0x428]
mov edx, 8
call fcn.00406e70
push dword [ebp - 0x428]
push 0x422e50
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404904
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x42c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404888
mov eax, dword [ebp - 0x42c]
call fcn.00404a00
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x422d8c
lea eax, [ebp - 0x430]
mov edx, dword [ebp - 0x20]
call fcn.00404e38
mov edx, dword [ebp - 0x430]
mov eax, 0x422e58
call fcn.00404fec
test eax, eax
setg byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x422da0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.00402dc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422de8
lea eax, [ebp - 0x430]
call fcn.00404d24
lea eax, [ebp - 0x42c]
mov edx, 2
call fcn.00404594
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404594
ret
Function at 0x423098
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x423156
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00422b64
mov eax, dword [0x4490f0]
cmp dword [eax + 0x1510], 1
jne 0x42313b
mov eax, dword [0x449144]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00425458
mov edx, dword [ebp - 4]
mov eax, 0x44910c
call fcn.004045c4
mov eax, dword [0x449144]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004208cc
mov edx, dword [ebp - 8]
mov eax, 0x449108
call fcn.004045c4
push 0
mov eax, dword [0x449110]
push eax
mov eax, dword [0x449118]
push eax
call fcn.00421f60
mov eax, dword [0x442328]
push eax
push 0
push 0
push 0x422fd8
push 0
push 0
call sub.kernel32.dll_CreateThread
mov eax, dword [0x442328]
push eax
push 0
push 0
push 0x42302c
push 0
push 0
call sub.kernel32.dll_CreateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42315d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404594
ret

Function at 0x423164
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x4232a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x449114]
mov ebx, dword [eax + 4]
mov eax, 0x449144
lea edx, [ebx + 0xde611]
call fcn.004047d4
cmp dword [0x449144], 0
jne 0x4231b0
lea eax, [ebp - 4]
call fcn.00420624
mov edx, dword [ebp - 4]
mov eax, 0x449144
call fcn.004045c4
lea eax, [ebx + 0xde611]
mov edx, dword [0x449144]
mov ecx, 0xff
call fcn.0040480c
mov eax, 0x449148
lea edx, [ebx + 0xde711]
call fcn.004047d4
cmp dword [0x449148], 0
jne 0x4231f4
lea eax, [ebp - 8]
call fcn.00421698
mov edx, dword [ebp - 8]
mov eax, 0x449148
call fcn.004045c4
lea eax, [ebx + 0xde711]
mov edx, dword [0x449148]
mov ecx, 0xff
call fcn.0040480c
mov eax, 0x44914c
lea edx, [ebx + 0xde811]
call fcn.004047d4
cmp dword [0x44914c], 0
jne 0x423238
mov eax, 0x44914c
mov ecx, 0x4232b4
mov edx, dword [0x4420e4]
call fcn.00404888
lea eax, [ebx + 0xde811]
mov edx, dword [0x44914c]
mov ecx, 0xff
call fcn.0040480c
push 0
mov eax, dword [0x44914c]
call fcn.00404a00
push eax
call sub.kernel32.dll_CreateDirectoryA
mov eax, dword [0x44914c]
push eax
call fcn.004125ec
mov edx, dword [0x449114]
mov eax, dword [0x449118]
call fcn.00408860
mov eax, dword [0x449118]
call fcn.0040e480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4232a7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404594
ret

Function at 0x423b00
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 4]
cmp eax, 6
jae 0x423b21
cmp eax, 5
jae 0x423b25
xor eax, eax
jmp 0x423b27
mov al, 1
add esp, 0x94
ret