joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fa16
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40fa12
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40fa30
movzx eax, ax
lea eax, [eax + eax*4]
add al, 0x80
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40fa8e
mov edx, edi
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40fa75
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40fa7e
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40fa88
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40fa6a
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40f9f4
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40fadb
dec eax
je 0x40fad2
sub eax, 3
je 0x40fac9
mov dword [ebp - 4], 0x40
jmp 0x40faf8
mov dword [ebp - 4], 4
jmp 0x40fade
mov dword [ebp - 4], 0x20
jmp 0x40fade
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40fb2a
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40faaa
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040f33b
cli
dec edi
and esi, dword [ecx + 0x6a1475ff]
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x40fb36
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40fa50
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
Function at 0x40fa63
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40fa12
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40fa30
movzx eax, ax
lea eax, [eax + eax*4]
add al, 0x80
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40fa8e
mov edx, edi
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40fa75
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40fa7e
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40fa88
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40fa6a
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40f9f4
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40fadb
dec eax
je 0x40fad2
sub eax, 3
je 0x40fac9
mov dword [ebp - 4], 0x40
jmp 0x40faf8
mov dword [ebp - 4], 4
jmp 0x40fade
mov dword [ebp - 4], 0x20
jmp 0x40fade
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40fb2a
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40faaa
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040f33b
cli
dec edi
and esi, dword [ecx + 0x6a1475ff]
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x40fb36
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ff36
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x40ff50
push dword [ebp + 0x14]
call fcn.0040f300
sal bl, 0xff
inc dword [ebx - 0x7a76f33c]
cld
invalid
invalid
call fcn.0040f33b
dec dword [esp + ebx*4]
pop ebx
inc eax
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
invalid
movsd dword es:[edi], dword [esi]
out dx, eax
Function at 0x41029b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push es
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
test dword [edi + 0x3afffffc], esp
Function at 0x4a04c7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4a0506
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4a0506
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4a0506
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4a0506
cmp dword [ecx + 0x74], 0xe
jbe 0x4a0506
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4b20d4
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b6961

Function at 0x4b4220
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b424d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b424d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4b4621
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4dc748
push 0x4dc740
push str.FlsAlloc
push 0x1e
call fcn.004b4cb4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b4655
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x4b465b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4b469f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4dc758
push 0x4dc750
push str.FlsGetValue
push 0x20
call fcn.004b4cb4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b46d6
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4b637f
Capabilities:
Hash data using murmur3
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0x505f74], eax
pushal
pushfd

Function at 0x4b638e
Capabilities:
Hash data using murmur3
Read file via mapping

Disassembly:
shl edx, 0x17
call fcn.004a01e7
xor ebx, 0x1a511840
sub edx, eax
xchg ecx, eax
rol esi, 0x17
shr esi, 7
add esi, eax
neg edi
add edx, eax
dec eax
xor edx, 0x18be5184
dec eax
xor ecx, esp
mov ebx, eax
add esi, eax
mov ebx, edx
and esi, edi
xor esi, eax
not esi
test esi, 0x2ca2625
jo 0x4b6422
xor esi, eax
sub edi, 0x940a10
mov esi, dword [0x50250a]
mov edi, ebp
or esi, edi
not edi
rol edx, 0xb
not edx
dec esi
shr ecx, 0x12
invalid
loopne 0x4b640f

Function at 0x4b6408
Capabilities:
Encode data using xor
Read file via mapping

Disassembly:
ror byte [edx - 9], cl
fadd dword [edi - 0xd78b10e]
mov esi, eax
rol eax, 4
mov eax, ecx
call fcn.00401ab2
dec ebx
xor esi, eax
sub ecx, dword [0x5026ee]
test ebx, esp
jo 0x4b6418
mov esi, eax
add eax, eax
call fcn.00406360
sub eax, 0xb9fff4ff
xchg edi, eax
in eax, 0x81
invalid
Function at 0x4b6700
Capabilities:
Read file via mapping

Disassembly:
inc eax
xchg byte [esi], bl
rol edx, 0x11
xor eax, edi
dec esi
inc esi
push 0
xor eax, 0x4382130
not edx

Function at 0x4b6714
Capabilities:
Read file via mapping

Disassembly:
sub edi, dword [0x506a5e]
rol edi, 0xd
add esi, 0x2f9acd8a
xor eax, esp
not esi
dec esi
xor eax, esp
ror edx, 0x1d
rol edx, 0x1d
xor eax, esp
inc esi
not esi
xor eax, esp
sub esi, 0x2f9acd8a
ror edi, 0xd
not edx
xor eax, 0x4382130
push 0x40
add esi, eax
xor esi, eax
not edx
inc esi
neg esi
ror eax, 0x15
xor ecx, dword [0x506c1e]
and dword [0x50628a], 0x21b57e00
ror esi, 0x10
add esi, eax
sub edi, dword [0x506a14]
inc eax
sub esi, 0x112b040
neg eax
sub esi, 0xbcf9e68
xor dword [0x50643c], ecx
dec esi
xor edx, dword [0x506f21]
call fcn.0040767c
call fcn.00405a6b
inc esi
add esi, 0xbcf9e68
neg eax
add esi, 0x112b040
dec eax
sub esi, eax
rol esi, 0x10
rol eax, 0x15
neg esi
dec esi
not edx
xor esi, eax
sub esi, eax
push 0
not esi
xchg eax, eax
add dword [0x5061a9], 0x231ff303
not edi
xchg eax, edx
sub dword [0x506312], 0x3a684d4
not eax
rol eax, 0x15
xor ebx, edi
rol edx, 0x13
xor esi, dword [0x506e50]
sub edi, dword [0x506e70]
xor edx, 0xc772a28
sub ecx, dword [0x506911]
call fcn.00402358
xor dword [0x5067cc], 0x1eedeb80
xor dword [0x506428], 0x1e78a316
xor edx, 0xc772a28
ror edx, 0x13
xor ebx, edi
ror eax, 0x15
not eax
or dword [0x506820], 0x23e66560
xchg eax, edx
not edi
xchg eax, eax
not esi
push 0xffffffffffffffff
sub edi, dword [0x506aa8]
dec esi

Function at 0x4b683c
Capabilities:
Read file via mapping

Disassembly:
sub ecx, eax
mov dword [0x5062ac], ebx
sub edi, dword [0x506e6a]
or dword [0x506594], 0x7dc9727
mov dword [0x506432], ecx
ror edx, 0x1d
neg esi
or dword [0x5064fb], ebx
mov dword [0x50617c], ecx
neg esi
rol edx, 0x1d
mov dword [0x506773], ecx
add dword [0x50621c], 0x16882240
mov dword [0x5060f0], ebx
add ecx, eax
inc esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esi, dword [0x506d4c]
mov dword [0x50623a], ebx
sub edi, dword [0x506f54]
sub dword [0x506397], 0x17e27424
call fcn.004015d3
sub dword [0x506636], 0x1e16ed7a
not esi
mov dword [0x50639e], edx
xor esi, eax
or dword [0x506566], ebx
call fcn.00404fe7
ror eax, 0xa
dec eax
ror ecx, 0x17
rol ecx, 0x17
inc eax
rol eax, 0xa
mov dword [0x5062fc], edi
xor esi, eax
not esi
invalid

Function at 0x4b68e8
Capabilities:
Read file via mapping

Disassembly:
add byte [edx - 0x13], bh
push ss
push ds
or eax, 0x506288
push ds
or al, 0x21
or ch, al
jecxz 0x4b68b5
hlt

Function at 0x4b6923
Capabilities:
Read file via mapping

Disassembly:
inc edx
push eax
add byte [ebx], ch
cmp eax, 0x506d6f
Function at 0x4b6961
Capabilities:
Read file via mapping

Disassembly:
push eax
add byte [edi - 0x3f387e10], al
xchg dl, ch
add dword [eax + 0x33], eax
or eax, 0x506e9e
xor ebx, eax
add edx, esi
inc eax
mov dword [0x506294], edx
mov dword [0x50684c], 0x4e2e7b2
add edx, eax
sub edx, eax
or dword [0x5066d8], 0x113e944
dec eax
sub edx, esi
xor ebx, eax
dec eax
sub edi, 0x1ea86c0
xchg eax, esi
xor dword [0x506284], edx
not eax
sub edx, 0x2baedd30
scasb al, byte es:[edi]
sub ebp, dword [edx]
add edx, dword [0x506cf4]
call fcn.0040169f
or dword [0x5067da], ecx
dec edx
or dword [0x5065bc], edx
rol esi, 1
add edx, esi
sub ebx, dword [0x506d9f]
rol eax, 0x1a
add ecx, dword [0x506c32]
insb byte es:[edi], dx
push eax
add byte [ebx], dh
xor eax, 0x506c24
ror eax, 0x1a
sub edx, esi
ror esi, 1
mov dword [0x506774], ebx
inc edx
and dword [0x506798], edx
push 0x22
sub esi, dword [0x506c90]
xor eax, ebp
sub edx, dword [0x5069be]
add byte [ecx], dh
xor eax, 0x50650c
rol esi, 0x13
add edi, edx
sub edx, esi
inc edx
call fcn.0040477a
add ebx, esp
sub ebx, esp
dec edx
add edx, esi
sub edi, edx
ror esi, 0x13
or dword [0x50634f], ecx
xor eax, ebp
push eax
xor esi, eax
xor ebx, dword [0x506c19]

Function at 0x4b69dc
Capabilities:
Read file via mapping

Disassembly:
push eax
add byte [edi - 0x3f387e10], al
xchg dl, ch
add dword [eax + 0x33], eax
or eax, 0x506e9e
xor ebx, eax
add edx, esi
inc eax
mov dword [0x506294], edx
mov dword [0x50684c], 0x4e2e7b2
add edx, eax
sub edx, eax
or dword [0x5066d8], 0x113e944
dec eax
sub edx, esi
xor ebx, eax
dec eax
sub edi, 0x1ea86c0
xchg eax, esi
xor dword [0x506284], edx
not eax
sub edx, 0x2baedd30
scasb al, byte es:[edi]
sub ebp, dword [edx]
add edx, dword [0x506cf4]
call fcn.0040169f
or dword [0x5067da], ecx
dec edx
or dword [0x5065bc], edx
rol esi, 1
add edx, esi
sub ebx, dword [0x506d9f]
rol eax, 0x1a
add ecx, dword [0x506c32]
insb byte es:[edi], dx
push eax
add byte [ebx], dh
xor eax, 0x506c24
ror eax, 0x1a
sub edx, esi
ror esi, 1
mov dword [0x506774], ebx
inc edx
and dword [0x506798], edx
push 0x22
sub esi, dword [0x506c90]
xor eax, ebp
sub edx, dword [0x5069be]
add byte [ecx], dh
xor eax, 0x50650c
rol esi, 0x13
add edi, edx
sub edx, esi
inc edx
call fcn.0040477a
add ebx, esp
sub ebx, esp
dec edx
add edx, esi
sub edi, edx
ror esi, 0x13
or dword [0x50634f], ecx
xor eax, ebp
push eax
xor esi, eax
xor ebx, dword [0x506c19]

Function at 0x4b6a3a
Capabilities:
Read file via mapping

Disassembly:
dec eax
rol esi, 6
xchg eax, eax
inc ecx
add edi, eax
rol eax, 0x1d
sub esi, eax
sub ecx, dword [0x506d0a]
add esi, eax
ror eax, 0x1d
sub edi, eax
dec ecx
xchg eax, eax
ror esi, 6
inc eax
xor esi, eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub edx, 0x4bc1c8
dec edx
Function at 0x4016a8
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x4b53ac
call fcn.0048ccab
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
lea edi, [esi + 4]
push 1
mov dword [esi], ebx
mov dword [ebp - 0x10], edi
call fcn.00413009
pop ecx
pop ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x4016dc
mov dword [eax], edi
jmp 0x4016de
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [edi], eax
mov dword [ebp - 4], 5
call fcn.004083e9
lea ecx, [edi + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x81], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov dword [edi + 0x1c], ebx
mov dword [ebp - 4], 7
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 8
lea eax, [ebp - 0x10]
push eax
call fcn.0040efdd
pop ecx
mov byte [ebp - 4], 9
push dword [eax]
lea eax, [esi + 0x3c]
push eax
call fcn.0040151e
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x10]
call fcn.0040392e
push ebx
push ebx
push esi
push 0x401e6e
push ebx
push ebx
call fcn.00488fcc
add esp, 0x18
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0048cd83
ret 4
Function at 0x409005
Capabilities:
Check if file exists

Disassembly:
push 0x10
mov eax, 0x4b3033
call fcn.0048ccde
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea edi, [esi + 0x24]
push dword [ebp + 8]
mov ecx, edi
call fcn.00403ce6
push 0x24
call fcn.004896b9
pop ecx
mov dword [ebp + 8], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x409049
push eax
call fcn.00408eb2
jmp 0x40904b
xor eax, eax
mov byte [ebp - 4], bl
mov dword [esi + 0x28], eax
xor eax, eax
cmp byte [esi + 0x2c], bl
sete al
dec eax
and eax, 0xfffefffb
add eax, 0x10006
mov dword [ebp + 8], eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push edi
call fcn.00403c69
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], bl
call fcn.0040ce12
mov byte [ebp - 4], 3
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov edi, dword [esi + 0x28]
push 1
call fcn.0043ff82
push ebx
push dword [ebp + 8]
push edi
push dword [ebp - 0x14]
call fcn.00478fe7
add esp, 0x1c
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x4090ca
push dword [edi]
call fcn.00454b59
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [esp], 0x4ced1c
lea eax, [ebp - 0x18]
push eax
call fcn.0048ab18
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.0040392e
mov eax, dword [esi + 0x28]
xor ecx, ecx
cmp byte [esi + 0x2c], bl
sete cl
dec ecx
and ecx, 0xffff9e58
add ecx, 0x7530
push ecx
push dword [eax]
call fcn.004445c1
pop ecx
pop ecx
cmp byte [esi + 0x2c], bl
jne 0x409103
mov ecx, esi
call fcn.00409174
xor eax, eax
cmp dword [esi + 0x28], ebx
setne al
jmp 0x409119
call fcn.0048cd83
ret 4
Function at 0x409462
Capabilities:
Reference sql statements

Disassembly:
push 0x28
mov eax, 0x4b2f10
call fcn.0048ccde
mov esi, dword [ebp + 8]
mov byte [ebp - 0x15], 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004098c8
mov edi, dword [esi + 0x18]
mov eax, dword [esi]
cmp dword [ebp - 0x20], 0
je 0x409492
cmp dword [ebp - 0x20], eax
je 0x409497
call fcn.004891d9
cmp dword [ebp - 0x1c], edi
jne 0x409532
lea eax, [ebp + 0xc]
push eax
lea edi, [ebp - 0x2c]
mov ebx, esi
call fcn.004097fc
lea ecx, [ebp - 0x1c]
call fcn.0040389d
and dword [ebp - 4], 0
push dword [ebp + 0xc]
push str.CREATE_TABLE_scanned__x_file_id_INTEGER__file_time_INTEGER__detection_name_TEXT__t_on_INTEGER__
lea eax, [ebp - 0x1c]
push eax
call fcn.0040ac2e
add esp, 0xc
mov byte [ebp - 4], 1
push dword [ebp - 0x1c]
mov ebx, dword [esi + 0x28]
call fcn.0041affd
and dword [ebp - 4], 0
jmp 0x4094f0
push dword [ebp + 0xc]
push str.CREATE_INDEX_fileIndex_ON_scanned__x_file_id__file_time__
lea eax, [ebp - 0x1c]
push eax
call fcn.0040ac2e
add esp, 0xc
mov byte [ebp - 4], 3
push dword [ebp - 0x1c]
mov ebx, dword [esi + 0x28]
call fcn.0041affd
and dword [ebp - 4], 0
jmp 0x409526
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040392e
mov dword [ebp - 4], 5
lea ecx, [ebp + 8]
call fcn.0040389d
mov byte [ebp - 4], 6
push dword [ebp + 0xc]
push str.SELECT_detection_name_FROM_scanned__x_WHERE_file_id____AND_file_time____AND_t_on_____
lea eax, [ebp + 8]
push eax
call fcn.0040ac2e
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [esi + 0x28]
call fcn.0041afb8
mov byte [ebp - 4], 7
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
lea eax, [ebp - 0x20]
call fcn.0041af7e
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 2
lea eax, [ebp - 0x20]
call fcn.0041af7e
push 0
call fcn.0048964d
pop ecx
sub eax, 0x15180
push eax
push 3
lea eax, [ebp - 0x20]
call fcn.0041af47
lea eax, [ebp - 0x34]
push eax
lea edi, [ebp - 0x20]
call fcn.0041adbc
mov byte [ebp - 4], 8
cmp byte [ebp - 0x2c], 0
jne 0x4095cf
lea esi, [ebp - 0x34]
call fcn.0041aa51
push eax
mov ecx, dword [ebp + 0x20]
call fcn.00403994
mov byte [ebp - 0x15], 1
mov byte [ebp - 4], 7
lea esi, [ebp - 0x34]
call fcn.0041abdd
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x20]
call fcn.0041ac1d
mov byte [ebp - 4], 5
lea ecx, [ebp + 8]
call fcn.0040392e
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x15]
call fcn.0048cd83
ret 0x1c
Function at 0x40cf1f
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov eax, SysReAllocString
mov dword [ebp - 4], esi
cmp dword [ebp + 8], esi
je 0x40cf4f
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push 2
push esi
push esi
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x40cf75
mov eax, dword [ebp - 4]
cmp dword [ebp + 0x10], esi
je 0x40cf78
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
jne 0x40cf68
jmp 0x40cf6a

Function at 0x40cff7
Capabilities:
Get token privileges

Disassembly:
push ebp
lea ebp, [esp - 0xf8c]
mov eax, 0x100c
call fcn.0048bdb0
mov eax, dword [0x4dc104]
xor eax, ebp
mov dword [ebp + 0xf88], eax
push ebx
xor ebx, ebx
push 0xfff
lea eax, [ebp - 0x77]
push ebx
push eax
mov byte [ebp - 0x78], bl
call fcn.0048ad80
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push 0xf01ff
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40d093
lea eax, [ebp - 0x80]
push eax
push 0x1000
lea eax, [ebp - 0x78]
push eax
push 3
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40d093
xor ecx, ecx
cmp dword [ebp - 0x78], ebx
jbe 0x40d080
lea eax, [ebp - 0x6c]
mov dword [eax], 2
inc ecx
add eax, 0xc
cmp ecx, dword [ebp - 0x78]
jb 0x40d071
push ebx
push ebx
push dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
push ebx
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [ebp - 0x7c], ebx
pop ebx
je 0x40d0a2
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xf88]
xor ecx, ebp
call fcn.00488689
add ebp, 0xf8c
leave
ret

Function at 0x40d0b7
Capabilities:
Get common file path

Disassembly:
push 0x28
mov eax, 0x4b2dbb
call fcn.0048cd14
xor ebx, ebx
push ebx
push 0x104
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], ebx
call fcn.00412f37
xor esi, esi
inc esi
mov dword [ebp - 4], esi
push esi
push 0x23
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00410794
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push ebx
lea ecx, [ebp - 0x2c]
test eax, eax
jne 0x40d0fe
push ebx
jmp 0x40d119
call fcn.00410794
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x40d106
sub eax, edx
sar eax, 1
push ebx
push eax
lea ecx, [ebp - 0x2c]
call fcn.004113d5
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40d12a
lea eax, [ebp - 0x28]
push eax
mov ecx, edi
call fcn.00403c8f
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], bl
push ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.00405617
mov eax, edi
call fcn.0048cd97
ret
Function at 0x40d270
Capabilities:
Get file version info

Disassembly:
push 0x48
mov eax, 0x4b2d7f
call fcn.0048ccab
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp + 8]
call fcn.0040389d
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
je 0x40d3f8
push ecx
mov dword [ebp - 0x1c], esp
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x1c], esp
call fcn.0041163f
mov dword [ebp - 4], esi
lea eax, [ebp - 0xd]
push eax
push edi
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 0xd], bl
call fcn.004115ce
mov dword [ebp - 4], 2
push ebx
lea ecx, [ebp - 0x54]
call fcn.00410f95
push eax
push edi
push ebx
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40d3ed
push ebx
lea ecx, [ebp - 0x54]
call fcn.00410f95
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0040d1d2
pop ecx
pop ecx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x30]
xor edi, edi
sar eax, 2
test eax, eax
jbe 0x40d3e0
lea ecx, [ebp - 0x14]
call fcn.0040389d
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x2c]
mov ecx, eax
sub ecx, dword [ebp - 0x30]
sar ecx, 2
cmp edi, ecx
jb 0x40d343
call fcn.004891d9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
sub eax, ecx
sar eax, 2
lea esi, [ecx + edi*4]
cmp edi, eax
jb 0x40d357
call fcn.004891d9
push dword [ebp + 0x10]
movzx eax, word [esi + 2]
push eax
mov eax, dword [ebp - 0x30]
movzx eax, word [eax + edi*4]
push eax
lea eax, [ebp - 0x14]
push str.StringFileInfo_04x_04x_s
push eax
call fcn.00412d65
add esp, 0x14
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x54]
push ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.00410f95
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40d3a6
cmp dword [ebp - 0x1c], ebx
je 0x40d3a6
cmp dword [ebp - 0x18], ebx
ja 0x40d3c6
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.0040392e
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x30]
inc edi
sar eax, 2
cmp edi, eax
jb 0x40d320
jmp 0x40d3e0
push dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
push dword [ebp - 0x1c]
call fcn.00410396
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.0040392e
mov byte [ebp - 4], 2
lea eax, [ebp - 0x3c]
push eax
call fcn.0041d5e3
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x54]
call fcn.00410f6b
mov eax, dword [ebp + 8]
call fcn.0048cd83
ret