joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bca1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x49876c
call fcn.00497cb0
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + 0x630]
mov dword [ebp - 4], 0x2b
call fcn.004835c3
lea ecx, [esi + 0x60c]
mov byte [ebp - 4], 0x2a
call fcn.004835c3
lea ecx, [esi + 0x5e8]
mov byte [ebp - 4], 0x29
call fcn.004835c3
lea ecx, [esi + 0x5c4]
mov byte [ebp - 4], 0x28
call fcn.004835c3
lea ecx, [esi + 0x5a0]
mov byte [ebp - 4], 0x27
call fcn.004835c3
lea ecx, [esi + 0x57c]
mov byte [ebp - 4], 0x26
call fcn.004835c3
lea ecx, [esi + 0x558]
mov byte [ebp - 4], 0x25
call fcn.004835c3
lea ecx, [esi + 0x534]
mov byte [ebp - 4], 0x24
call fcn.004835c3
lea ecx, [esi + 0x510]
mov byte [ebp - 4], 0x23
call fcn.004835c3
lea ecx, [esi + 0x4ec]
mov byte [ebp - 4], 0x22
call fcn.004835c3
lea ecx, [esi + 0x4c8]
mov byte [ebp - 4], 0x21
call fcn.004835c3
lea ecx, [esi + 0x4a4]
mov byte [ebp - 4], 0x20
call fcn.004835c3
lea ecx, [esi + 0x480]
mov byte [ebp - 4], 0x1f
call fcn.004835c3
lea ecx, [esi + 0x45c]
mov byte [ebp - 4], 0x1e
call fcn.004835c3
lea ecx, [esi + 0x438]
mov byte [ebp - 4], 0x1d
call fcn.004835c3
lea ecx, [esi + 0x414]
mov byte [ebp - 4], 0x1c
call fcn.004835c3
lea ecx, [esi + 0x3f0]
mov byte [ebp - 4], 0x1b
call fcn.004835c3
lea ecx, [esi + 0x3cc]
mov byte [ebp - 4], 0x1a
call fcn.004835c3
lea ecx, [esi + 0x3a8]
mov byte [ebp - 4], 0x19
call fcn.004835c3
lea ecx, [esi + 0x384]
mov byte [ebp - 4], 0x18
call fcn.004835c3
lea ecx, [esi + 0x360]
mov byte [ebp - 4], 0x17
call fcn.004835c3
lea ecx, [esi + 0x33c]
mov byte [ebp - 4], 0x16
call fcn.004835c3
lea ecx, [esi + 0x318]
mov byte [ebp - 4], 0x15
call fcn.004835c3
lea ecx, [esi + 0x2f4]
mov byte [ebp - 4], 0x14
call fcn.004835c3
lea ecx, [esi + 0x2d0]
mov byte [ebp - 4], 0x13
call fcn.004835c3
lea ecx, [esi + 0x2ac]
mov byte [ebp - 4], 0x12
call fcn.004835c3
lea ecx, [esi + 0x288]
mov byte [ebp - 4], 0x11
call fcn.004835c3
lea ecx, [esi + 0x264]
mov byte [ebp - 4], 0x10
call fcn.004835c3
lea ecx, [esi + 0x240]
mov byte [ebp - 4], 0xf
call fcn.004835c3
lea ecx, [esi + 0x21c]
mov byte [ebp - 4], 0xe
call fcn.004835c3
lea ecx, [esi + 0x1f8]
mov byte [ebp - 4], 0xd
call fcn.004835c3
lea ecx, [esi + 0x1d4]
mov byte [ebp - 4], 0xc
call fcn.004835c3
lea ecx, [esi + 0x1b0]
mov byte [ebp - 4], 0xb
call fcn.004835c3
lea ecx, [esi + 0x18c]
mov byte [ebp - 4], 0xa
call fcn.004835c3
lea ecx, [esi + 0x168]
mov byte [ebp - 4], 9
call fcn.004835c3
lea ecx, [esi + 0x144]
mov byte [ebp - 4], 8
call fcn.004835c3
lea ecx, [esi + 0x120]
mov byte [ebp - 4], 7
call fcn.004835c3
lea ecx, [esi + 0xfc]
mov byte [ebp - 4], 6
call fcn.004835c3
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 5
call fcn.004835c3
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 4
call fcn.004835c3
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 3
call fcn.004835c3
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 2
call fcn.004835c3
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 1
call fcn.004835c3
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 0
call fcn.004835c3
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004835c3
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41cd83
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4987de
call fcn.00497cb0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebx], eax
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov al, byte [esi + 8]
mov byte [ebx + 8], al
mov al, byte [esi + 9]
mov byte [ebx + 9], al
push edi
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.004833a7
and dword [ebp - 4], 0
add esi, 0x30
push 5
pop ecx
lea edi, [ebx + 0x30]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp + 0xc]
lea eax, [edi + 0x48]
lea esi, [ebx + 0x48]
call fcn.0041cdf6
mov eax, dword [edi + 0x74]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x74], eax
mov eax, dword [edi + 0x78]
pop edi
mov dword [ebx + 0x78], eax
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x422046
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4bb2b0]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x42205d
mov al, byte [eax + 0x70]
jmp 0x42205f
xor al, al
mov byte [ebp - 1], al
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push ebx
push str.SOFTWARECat_SoftServ_U
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4220fc
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
mov esi, str.UPnPConfigure
push esi
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4220f2
cmp dword [ebp - 8], ebx
mov eax, str.1_la
jne 0x4220b7
mov eax, 0x4a4924
push eax
mov eax, dword [0x4bb2b0]
push str.UseUPnP
push str.GLOBAL
call fcn.00473e54
cmp dword [ebp - 8], ebx
mov eax, dword [0x4bb2b0]
setne cl
mov byte [eax + 0x70], cl
cmp dword [ebp - 8], ebx
je 0x4220e8
mov byte [ebp - 1], 1
call fcn.004719ef
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, byte [ebp - 1]
pop ebx
leave
ret

Function at 0x426f3c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
lea eax, [ebp - 0x140]
push str.CLSID_
push eax
mov bl, 1
mov dword [ebp - 4], 0xc8
call sub.MSVCR71.dll_strcpy
push dword [ebp + 8]
lea eax, [ebp - 0x140]
push eax
call sub.MSVCR71.dll_strcat
add esp, 0x10
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x140]
push eax
push accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x427039
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x426fb9
xor bl, bl
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x427039
mov eax, dword [ebp - 4]
test eax, eax
mov dword [ebp - 0xc], eax
jbe 0x426fe2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.00482777
pop ecx
pop ecx
cmp dword [ebp - 0x10], 1
jne 0x427039
cmp dword [ebp - 0xc], 0x1c
jne 0x427039
push 0x1c
lea eax, [ebp - 0x140]
push eax
push edi
call sub.MSVCR71.dll_memcpy
lea eax, [ebp - 0x78]
push eax
call fcn.0048d9a7
push 0xc
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0048e235
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0048e2d0
push 0x10
lea eax, [ebp - 0x20]
push edi
push eax
call sub.MSVCR71.dll_memcmp
add esp, 0x30
neg eax
sbb al, al
inc al
jmp 0x42703b
xor al, al
pop ebx
leave
ret 4
Function at 0x4270d5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push esi
push edi
xor esi, esi
xor edi, edi
call fcn.0046802b
test al, al
je 0x42711a
push 1
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push esi
push esi
push 1
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x28]
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x10]
lea eax, [ebp - 0x100]
push str.CLSID_
push eax
call sub.MSVCR71.dll_strcpy
push dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call sub.MSVCR71.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x100]
push eax
push accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4271f0
lea eax, [ebp - 0x158]
push eax
call fcn.0048d9a7
push 0xc
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.0048e235
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0048e2d0
push 0x10
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 0xc]
push eax
call sub.MSVCR71.dll_memcpy
push 0x1c
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x100]
push eax
call sub.MSVCR71.dll_memcpy
lea eax, [ebp - 0x100]
push 0x1c
push eax
call fcn.00482718
lea eax, [ebp - 0x100]
push eax
call sub.MSVCR71.dll_strlen
add esp, 0x3c
inc eax
push eax
lea eax, [ebp - 0x100]
push eax
push 1
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret 0x20
Function at 0x431bd8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
push ebx
push esi
push str.Serv_UID.txt
mov esi, 0x15e
lea eax, [ebp - 0x168]
push esi
push eax
mov byte [ebp - 1], 0
call fcn.00482dd8
push 4
pop ebx
lea eax, [ebp - 0x168]
push 2
push eax
call dword [sym.imp.MSVCR71.dll__access]
add esp, 0x14
test eax, eax
jne 0x431cbc
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 5]
call fcn.0048d7de
test al, al
push esi
lea eax, [ebp - 0x428]
push eax
jne 0x431c50
push 0x7f4
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_LoadStringA]
push 2
pop ebx
jmp 0x431c74
push 0x7f5
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_LoadStringA]
push dword [ebp + 8]
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 5]
call fcn.0048d5b1
mov byte [ebp - 1], 1
push ebx
lea eax, [ebp - 0x428]
push eax
push 0x12
or ecx, 0xffffffff
call fcn.0041b172
push str.Serv_UID.old
lea eax, [ebp - 0x2c8]
push esi
push eax
call fcn.00482dd8
lea eax, [ebp - 0x2c8]
push eax
call dword [sym.imp.MSVCR71.dll__unlink]
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.MSVCR71.dll_rename]
add esp, 0x24
mov al, byte [ebp - 1]
pop esi
pop ebx
leave
ret 4

Function at 0x433841
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov esi, eax
push 5
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xc5
push dword [esi + 0x1c]
call edi
push 0
push dword [esi + 0x20]
push 0x30
push dword [esi + 0x1c]
call edi
push 1
call fcn.00433883
pop edi
pop esi
ret

Function at 0x433b89
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4a0a5a
call fcn.00497cb0
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi], 0x4a5978
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [ebp - 4], 1
push esi
mov dword [esi + 8], ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], ecx
call fcn.00469980
push ebx
mov byte [esi + 0x24], bl
mov byte [esi + 5], bl
mov byte [esi + 4], bl
call dword [sym.imp.MSVCR71.dll_time]
pop ecx
push eax
call dword [sym.imp.MSVCR71.dll_srand]
pop ecx
push esi
call fcn.00434284
push esi
call fcn.0043451e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x4534c3
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4983fb
call fcn.00497cb0
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + 0xc]
call fcn.00483344
and dword [ebp - 4], 0
lea ecx, [esi + 0x30]
call fcn.00483344
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.00483344
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 2
call fcn.00483344
lea ecx, [esi + 0x9c]
mov byte [ebp - 4], 3
call fcn.00483344
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 4
call fcn.00483344
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 5
call fcn.00483344
lea ecx, [esi + 0x108]
mov byte [ebp - 4], 6
call fcn.00483344
lea ecx, [esi + 0x12c]
mov byte [ebp - 4], 7
call fcn.00483344
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x453559
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4983fb
call fcn.00497cb0
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + 0x12c]
mov dword [ebp - 4], 7
call fcn.004835c3
lea ecx, [esi + 0x108]
mov byte [ebp - 4], 6
call fcn.004835c3
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 5
call fcn.004835c3
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 4
call fcn.004835c3
lea ecx, [esi + 0x9c]
mov byte [ebp - 4], 3
call fcn.004835c3
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 2
call fcn.004835c3
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.004835c3
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 0
call fcn.004835c3
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.004835c3
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x466477
Capabilities:
Create mailslot
Get hostname
Get session user name

Disassembly:
mov eax, 0x49af3f
call fcn.00497cb0
sub esp, 0x6c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.004845ea
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [edi + 0x20]
mov dword [edi], 0x4a7990
call fcn.00483344
lea ecx, [edi + 0x44]
mov byte [ebp - 4], 1
call fcn.00483344
lea esi, [edi + 0x84]
push esi
mov byte [ebp - 4], 2
call fcn.00402c0f
lea eax, [edi + 0xf0]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [edi + 0x100]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov ebx, dword [ebp + 0xc]
push edi
mov byte [ebp - 4], 5
call fcn.00466fda
mov eax, dword [ebp + 0x10]
xor ebx, ebx
push str.NETAPI32.DLL
mov dword [edi + 0x68], eax
mov byte [edi + 0x71], bl
mov byte [edi + 0x70], bl
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], ebx
mov dword [edi + 0x80], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [edi + 0x78], eax
je 0x466529
push str.NetUserGetInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0x7c], eax
mov eax, dword [edi + 0x78]
cmp eax, ebx
je 0x466542
push str.NetApiBufferFree
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0x80], eax
push str..mailslot_
lea ecx, [ebp - 0x54]
call fcn.00483361
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x54]
push str.RegCheckServ_U
lea ecx, [ebp - 0x54]
call dword [eax + 0x14]
cmp dword [ebp - 0x38], 0x10
mov eax, dword [ebp - 0x4c]
jae 0x46656d
lea eax, [ebp - 0x4c]
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
cmp eax, 0xffffffff
mov dword [edi + 0x74], eax
je 0x466613
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x10], 0x1e
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
mov eax, dword [esi]
je 0x4665a4
lea ecx, [ebp - 0x30]
push ecx
jmp 0x4665a9
push str.Unknown
mov ecx, esi
call dword [eax + 8]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x10], 0x1e
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x466601
lea ecx, [edi + 0xa8]
mov eax, dword [ecx]
lea edx, [ebp - 0x30]
push edx
call dword [eax + 8]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x78]
push eax
mov ecx, edi
call fcn.00466921
lea ecx, [edi + 0xcc]
mov byte [ebp - 4], 7
mov edx, dword [ecx]
push eax
call dword [edx + 0xc]
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 6
call fcn.004835c3
call fcn.0046674e
push ebx
push 0x1f4
mov ecx, edi
call fcn.0048450b
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 5
call fcn.004835c3
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x46674e
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
mov eax, 0x49aedc
call fcn.00497cb0
sub esp, 0x224
cmp dword [edi + 0x74], 0xffffffff
je 0x466915
mov eax, dword [edi + 0x108]
mov ecx, dword [edi + 0x104]
push ebx
push esi
push eax
push ecx
lea eax, [ebp - 0x10]
lea esi, [edi + 0x100]
push eax
call fcn.004670d9
mov byte [edi + 0x72], 0
mov byte [edi + 0x71], 0
cmp dword [edi + 0xa0], 0x10
jb 0x4667a0
mov esi, dword [edi + 0x8c]
jmp 0x4667a6
lea esi, [edi + 0x8c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
push eax
push esi
lea eax, [ebp - 0x9c]
push str._s__08x
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x10
lea ecx, [edi + 0x44]
mov eax, dword [ecx]
lea edx, [ebp - 0x9c]
push edx
call dword [eax + 8]
push 4
lea eax, [ebp - 0x230]
push 0x4a7a10
push eax
call sub.MSVCR71.dll_memcpy
lea eax, [ebp - 0x9c]
push eax
call sub.MSVCR71.dll_strlen
inc eax
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x22c]
push eax
call sub.MSVCR71.dll_memcpy
lea eax, [ebp - 0x9c]
push eax
call sub.MSVCR71.dll_strlen
mov esi, eax
mov eax, dword [edi + 0x38]
add esp, 0x20
add esi, 5
cmp dword [edi + 0x3c], 0x10
jb 0x46682a
mov ecx, dword [edi + 0x28]
jmp 0x46682d
lea ecx, [edi + 0x28]
inc eax
push eax
push ecx
lea eax, [ebp + esi - 0x230]
push eax
call sub.MSVCR71.dll_memcpy
mov eax, dword [edi + 0x38]
add esp, 0xc
cmp dword [edi + 0xa0], 0x10
lea esi, [esi + eax + 1]
mov eax, dword [edi + 0x9c]
jb 0x46685e
mov ecx, dword [edi + 0x8c]
jmp 0x466864
lea ecx, [edi + 0x8c]
inc eax
push eax
push ecx
lea eax, [ebp + esi - 0x230]
push eax
call sub.MSVCR71.dll_memcpy
mov eax, dword [edi + 0x9c]
add esp, 0xc
lea eax, [esi + eax + 1]
push str.mailslot_
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x10], eax
call fcn.00483361
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x38]
push str.RegCheckServ_U
lea ecx, [ebp - 0x38]
call dword [eax + 0x14]
cmp dword [ebp - 0x1c], 0x10
mov eax, dword [ebp - 0x30]
jae 0x4668b0
lea eax, [ebp - 0x30]
push esi
push 0x80
push 3
push esi
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x466907
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
call ebx
mov dword [edi + 0x6c], eax
lea eax, [edi + 0x84]
push eax
lea eax, [edi + 0x100]
call fcn.00467096
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [edi + 0x72], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004835c3
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x4669f5
Capabilities:
Read file on windows
Read from mailslot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [esi + 0x74]
cmp eax, 0xffffffff
je 0x466a93
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
push edi
xor edi, edi
push edi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push edi
push eax
jmp 0x466a8b
cmp dword [ebp - 0xc], edi
je 0x466a91
cmp dword [ebp - 4], 0xffffffff
je 0x466a91
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x1a0]
push eax
push dword [esi + 0x74]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x466a91
xor eax, eax
cmp dword [ebp - 8], 4
jbe 0x466a57
movsx eax, byte [ebp - 0x1a0]
dec eax
je 0x466a6e
dec eax
jne 0x466a7e
push dword [ebp - 8]
lea ecx, [ebp - 0x1a0]
push esi
call fcn.00466de5
jmp 0x466a7e
push dword [ebp - 8]
lea ecx, [ebp - 0x1a0]
mov edx, esi
call fcn.00466a95
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push dword [esi + 0x74]
call ebx
test eax, eax
jne 0x466a21
pop edi
pop ebx
leave
ret
Function at 0x467626
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4a13be
call fcn.00497cb0
sub esp, 0x824
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 8]
mov dword [esi], 0x4a7a24
call fcn.00483344
xor ebx, ebx
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], ebx
call fcn.00483344
push 0x7fb
lea eax, [ebp - 0x830]
mov byte [ebp - 4], 1
push eax
mov dword [0x4bbb8c], esi
mov byte [esi + 0x50], bl
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebx
mov edi, 0x4a46f4
lea eax, [ebp - 0x830]
push edi
push eax
call fcn.00484244
add esp, 0xc
test al, al
jne 0x4676b2
push 1
lea eax, [ebp - 0x830]
push 0x4a46f0
push eax
call fcn.00484244
add esp, 0xc
test al, al
je 0x4676b2
mov byte [ebp - 0x82d], bl
jmp 0x467718
push ebx
lea eax, [ebp - 0x830]
push 0x4a478c
push eax
call fcn.00484244
add esp, 0xc
test al, al
lea eax, [ebp - 0x830]
je 0x46770b
push edi
push eax
call sub.MSVCR71.dll_strcat
push ebx
push ebx
lea eax, [ebp - 0x82e]
push 0x5c
push eax
call fcn.00483d45
add esp, 0x18
cmp eax, ebx
je 0x467705
push ebx
push ebx
inc eax
push 0x5c
push eax
call fcn.00483d45
add esp, 0x10
cmp eax, ebx
je 0x467705
mov byte [eax], bl
jmp 0x467718
lea eax, [ebp - 0x830]
push 0x4a4918
push eax
call sub.MSVCR71.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x830]
push eax
push 0x4b9334
call sub.MSVCR71.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
push 2
pop ecx
mov edx, esi
call fcn.004679bd
mov byte [ebp - 4], 2
cmp dword [eax + 0x1c], 0x10
jb 0x467748
mov eax, dword [eax + 8]
jmp 0x46774b
add eax, 8
push eax
lea eax, [esi + 0x2c]
push 0x4ac
push eax
call fcn.00483931
add esp, 0xc
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.004835c3
cmp byte [ebp + 0xc], bl
je 0x467790
push 0x48
call sub.MSVCR71.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp + 0xc], eax
cmp eax, ebx
mov byte [ebp - 4], 3
je 0x467789
push eax
call fcn.00430fad
jmp 0x46778b
xor eax, eax
mov dword [esi + 4], eax
jmp 0x467793
mov dword [esi + 4], ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x467847
Capabilities:
Get file version info

Disassembly:
mov eax, 0x4982d2
call fcn.00497cb0
sub esp, 0x13c
cmp dword [ebx + 0x20], 0
jne 0x46792f
push esi
push edi
lea esi, [ebx + 8]
mov eax, dword [esi]
push 0x4a7b40
mov ecx, esi
call dword [eax + 8]
push 0x104
lea eax, [ebp - 0x148]
push eax
push dword [0x4bbb68]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x148]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x46792d
lea eax, [edi + 1]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
push edi
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x148]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push str.StringFileInfo040904b0FileVersion
push dword [ebp - 0x20]
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call sub.VERSION.dll_VerQueryValueA
cmp eax, edi
je 0x46791b
cmp dword [ebp - 0x14], edi
je 0x46791b
mov ecx, dword [ebp - 0x10]
cmp ecx, edi
je 0x46791b
lea eax, [ebp - 0x44]
push eax
call fcn.00467949
mov dword [ebp - 4], edi
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.004835c3
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
cmp dword [ebx + 0x24], 0x10
jb 0x46793a
mov eax, dword [ebx + 0x10]
jmp 0x46793d
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret