joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x40f59e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40f5b2
test al, 0x10
je 0x40f5b2
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x40f860
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0x10
push edi
jb 0x40f872
mov eax, dword [ebx]
jmp 0x40f874
mov eax, ebx
lea ecx, [ebp + 8]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x40f8a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.UBASE::GetResourceVersionInfo
push str.__s__GetFileVersionInfoSizeA_return_size0__LastError:_d
call fcn.004190e0
add esp, 0xc
pop edi
xor al, al
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x10]
mov ecx, esi
cmp edi, eax
ja 0x40f8ba
push 0xffffffffffffffff
push edi
call fcn.0040125f
jmp 0x40f8c6
mov edx, edi
push 0
sub edx, eax
push edx
call fcn.0040375f
cmp dword [esi + 0x14], 0x10
jb 0x40f8d0
mov eax, dword [esi]
jmp 0x40f8d2
mov eax, esi
push edi
push 0
push eax
call fcn.00473a10
mov eax, 0x10
add esp, 0xc
cmp dword [esi + 0x14], eax
jb 0x40f8ea
mov esi, dword [esi]
cmp dword [ebx + 0x14], eax
jb 0x40f8f3
mov eax, dword [ebx]
jmp 0x40f8f5
mov eax, ebx
push esi
push edi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
pop esi
test eax, eax
jne 0x40f923
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.UBASE::GetResourceVersionInfo
push str.__s__GetFileVersionInfoA_failed__LastError:_d
call fcn.004190e0
add esp, 0xc
pop edi
xor al, al
pop ebx
pop ebp
ret
pop edi
mov al, 1
pop ebx
pop ebp
ret
Function at 0x40f930
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d930
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4b8914]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov edi, 0x10
mov byte [ebp - 0x11], 0
cmp dword [esi + 0x14], edi
jb 0x40f970
mov eax, dword [esi]
jmp 0x40f972
mov eax, esi
push 0
push 0
push 3
push 0
push 3
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
jne 0x40f9c9
cmp dword [esi + 0x14], edi
jb 0x40f999
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.CreateFileA__s_failed__LastError__d
push str.UBASE::FsReadFileData
push 2
call fcn.004191b0
add esp, 0x14
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x40fb1e
test edi, edi
jne 0x40fa07
cmp dword [esi + 0x14], 0x10
jb 0x40f9e9
mov esi, dword [esi]
push esi
push str._s_FileSize_is_0
push str.UBASE::FsReadFileData
push 1
call fcn.004191b0
add esp, 0x10
mov byte [ebp - 0x11], 1
jmp 0x40fb02
push 0x4bb4c8
push edi
call fcn.00475b17
mov ebx, eax
add esp, 8
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x40faff
mov ecx, dword [ebp + 8]
push 0
lea eax, [ebp - 0x1c]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40fad2
mov eax, dword [ebp - 0x1c]
cmp eax, edi
jne 0x40fab1
mov ecx, dword [ebp + 0xc]
push edi
push ebx
mov dword [ebp - 4], 0
call fcn.004010b2
mov byte [ebp - 0x11], 1
jmp 0x40faf6
cmp dword [esi + 0x14], 0x10
jb 0x40fab9
mov esi, dword [esi]
push eax
push edi
push esi
push str.ReadFile__s_failed__ExpectedSize:_d_ActualSize:_d
push str.UBASE::FsReadFileData
push 2
call fcn.004191b0
add esp, 0x18
jmp 0x40faf6
cmp dword [esi + 0x14], 0x10
jb 0x40fada
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.ReadFile__s_failed__LastError__d
push str.UBASE::FsReadFileData
push 2
call fcn.004191b0
add esp, 0x14
push ebx
call fcn.00473a8a
add esp, 4
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 0x10
jb 0x40fb26
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.GetFileSize__s_failed__LastError:_d
push str.UBASE::FsReadFileData
push 2
call fcn.004191b0
add esp, 0x14
jmp 0x40fb02
Function at 0x413690
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x4b8914]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
push 0x288
mov dword [ebp - 0x4c], eax
xor bl, bl
call fcn.00473c68
mov edi, eax
add esp, 4
mov dword [ebp - 0x48], 0x288
test edi, edi
jne 0x4136d6
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x48]
push ecx
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x4136f8
push edi
call fcn.0047381f
mov edx, dword [ebp - 0x48]
push edx
call fcn.00473c68
add esp, 8
mov edi, eax
push esi
lea eax, [ebp - 0x48]
push eax
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x4137a8
mov esi, edi
test edi, edi
je 0x4137b5
mov eax, 6
lea ebx, [ebx]
cmp dword [esi + 0x1a0], eax
je 0x413730
mov esi, dword [esi]
test esi, esi
jne 0x413720
jmp 0x4137a8
push 0x3f
lea ecx, [ebp - 0x43]
push 0
push ecx
mov byte [ebp - 0x44], 0
call fcn.00473a10
movzx edx, byte [esi + 0x199]
movzx eax, byte [esi + 0x198]
movzx ecx, byte [esi + 0x197]
push edx
movzx edx, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push ecx
movzx ecx, byte [esi + 0x194]
push edx
push eax
push ecx
lea edx, [ebp - 0x44]
push str._02X__02X__02X__02X__02X__02X
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x44]
add esp, 0x2c
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413790
mov ecx, dword [ebp - 0x4c]
sub eax, edx
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004010b2
mov bl, 1
test edi, edi
je 0x4137b5
push edi
call fcn.0047381f
add esp, 4
mov ecx, dword [ebp - 4]
pop esi
pop edi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00471528
mov esp, ebp
pop ebp
ret

Function at 0x4137d0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00413690

Function at 0x4164b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push 2
push 0
push ebx
mov dword [ebp - 4], ecx
call fcn.00477062
add esp, 0xc
test eax, eax
je 0x4164d8
mov eax, 0xfffffffd
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
push ebx
call fcn.00476f73
mov edi, eax
add esp, 4
test edi, edi
jns 0x4164f5
pop edi
mov eax, 0xfffffffd
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push edi
call fcn.00473b13
mov esi, eax
add esp, 4
test esi, esi
jne 0x416511
lea eax, [esi - 2]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push ebx
call fcn.00477062
push ebx
push edi
push 1
push esi
call fcn.00476dc2
add esp, 0x1c
cmp eax, edi
je 0x416543
push esi
call fcn.00473a8a
add esp, 4
pop esi
pop edi
mov eax, 0xfffffffd
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
push eax
push esi
call fcn.00416390
push esi
mov edi, eax
call fcn.00473a8a
add esp, 4
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4171d0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e510
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4b8914]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
push str.SWWanXCom
push ebx
push 4
mov dword [ebp - 4], ebx
mov byte [ebp - 0x49], bl
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov esi, eax
cmp esi, ebx
je 0x41724e
push 0x32000
push ebx
push ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, ebx
jne 0x417321
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x10
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x50], esp
push 3
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push 0x496eb0
mov byte [ecx], bl
call fcn.004010b2
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00416ff0
add esp, 0x20
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 5
call fcn.004023a2
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], esi
jb 0x4172a0
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00471f65
add esp, 4
push 1
push 0x4aa590
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.004010b2
mov edi, dword [ebp - 0x54]
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x48]
push ecx
push edi
mov byte [ebp - 4], 6
call fcn.00412280
add esp, 0xc
cmp dword [ebp - 0x18], esi
jb 0x4172e5
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00471f65
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
cmp dword [ebp - 0x34], esi
jb 0x417303
mov eax, dword [ebp - 0x48]
push eax
call fcn.00471f65
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
lea ecx, [edi + 0x1b0]
push ecx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00402d1e
cmp dword [ebp - 0x1c], ebx
je 0x417356
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x48]
call fcn.004023a2
mov byte [ebp - 0x49], 1
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x10
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], esi
jb 0x41737d
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00471f65
add esp, 4
cmp byte [ebp - 0x49], bl
jne 0x4172a0
jmp 0x417253
Function at 0x417390
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e561
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4b8914]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x30], eax
mov edx, 0xf
mov dword [esi + 0x14], edx
mov dword [esi + 0x10], eax
mov dword [ebp - 0x34], esi
mov byte [esi], al
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x38], esp
push 6
mov dword [ecx + 0x14], edx
mov dword [ecx + 0x10], eax
push str.CityId
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 1
mov byte [ecx], al
call fcn.004010b2
lea eax, [ebp - 0x2c]
push eax
call fcn.00416ff0
add esp, 0x20
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.004023a2
cmp dword [ebp - 0x18], 0x10
jb 0x417424
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00471f65
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret
Function at 0x417da0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e741
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4b8914]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
push 0x20219
push str.SOFTWAREICafe8
push reloc.WS2_32.dll_bind
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 1
call fcn.0041a300
mov byte [ebp - 4], 2
cmp dword [ebp - 0x54], ebx
je 0x417e61
lea eax, [ebp - 0x4c]
push eax
push str.CityId
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x4c], ebx
call fcn.0041a200
cmp eax, ebx
jne 0x417e59
mov ecx, dword [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x48]
push 0x495b94
push edx
call fcn.00413050
add esp, 0xc
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.004023a2
cmp dword [ebp - 0x34], 0x10
mov byte [ebp - 4], 2
jb 0x417e59
mov eax, dword [ebp - 0x48]
push eax
call fcn.00471f65
add esp, 4
lea ecx, [ebp - 0x54]
call fcn.0041a270
cmp dword [ebp - 0x1c], ebx
jne 0x417e92
lea ecx, [ebp - 0x2c]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 2
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push 0x496f74
mov byte [ecx], bl
call fcn.004010b2
call fcn.004178e0
add esp, 0x20
lea edx, [ebp - 0x2c]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push edx
mov ecx, esi
mov byte [esi], bl
call fcn.004023a2
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x58], 1
mov byte [ebp - 4], 1
call fcn.0041a270
cmp dword [ebp - 0x18], 0x10
jb 0x417ece
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00471f65
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret
Function at 0x418500
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp esi, edi
jne 0x418522
lea ebx, [edi + 0x57]
jmp 0x4185c8
push edi
lea eax, [ebp - 4]
push eax
push edi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
push edi
call fcn.00402d3d
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x418557
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x418557
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4185c2
mov edx, dword [ebp - 8]
push edx
call fcn.00473c68
mov esi, eax
mov eax, dword [ebp + 0xc]
add esp, 4
mov dword [eax], esi
test esi, esi
je 0x4185ad
mov ecx, dword [ebp - 4]
push ecx
call fcn.00473c68
mov edi, eax
add esp, 4
test edi, edi
je 0x4185ad
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 4]
push eax
push edi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
push esi
call fcn.00402d3d
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x4185b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4185b2
mov ebx, 8
test edi, edi
je 0x4185bf
push edi
call fcn.0047381f
add esp, 4
mov esi, dword [ebp + 0xc]
xor edi, edi
cmp ebx, edi
je 0x4185d7
cmp dword [esi], edi
je 0x4185d7
push esi
mov dword [esi], edi
call fcn.0047381f
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4190e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e920
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4b8914]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4b6fc8]
xor ebx, ebx
cmp eax, 0xffffffff
je 0x41918e
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x41918e
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x48]
push edx
mov dword [ebp - 4], ebx
call fcn.00412c80
add esp, 0xc
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004023a2
cmp dword [ebp - 0x34], 0x10
mov byte [ebp - 4], bl
jb 0x419169
mov eax, dword [ebp - 0x48]
push eax
call fcn.00471f65
add esp, 4
push esi
lea ecx, [ebp - 0x2c]
push ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.00418fc0
add esp, 0x10
cmp dword [ebp - 0x18], 0x10
mov bl, al
jb 0x41918e
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00471f65
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret
Function at 0x419460
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x4b8914]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 0x808]
push edx
lea edx, [ebp - 0x404]
push edx
lea edx, [ebp - 0x80c]
push edx
push 0
push eax
mov eax, dword [ecx]
push eax
mov dword [ebp - 0x80c], 1
mov dword [ebp - 0x808], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x419569
mov eax, dword [ebp - 0x80c]
cmp eax, 1
jne 0x4194fc
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4194d0
sub eax, edx
push eax
lea ecx, [ebp - 0x404]
push ecx
mov ecx, edi
call fcn.004010b2
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret 8
cmp eax, 2
jne 0x419564
push 0x400
lea edx, [ebp - 0x804]
push edx
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 0x808], eax
test eax, eax
je 0x41954d
cmp eax, 0x400
ja 0x41954d
lea ecx, [ebp - 0x804]
push ecx
mov ecx, edi
call fcn.00402d1e
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret 8
pop edi
mov eax, 0xea
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00471528
mov esp, ebp
pop ebp
ret 8

Function at 0x4195d0
Capabilities:
Enumerate device drivers on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e9a8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4b8914]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push ebx
push ebx
mov dword [ebp - 0x10], ebx
call sub.PSAPI.DLL_EnumDeviceDrivers
test eax, eax
je 0x419672
mov edi, dword [ebp - 0x10]
shr edi, 2
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 4
mul edx
seto cl
push 0x4bb4c8
neg ecx
or ecx, eax
push ecx
call fcn.00475b17
mov esi, eax
add esp, 8
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x419672
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x10]
push eax
push ecx
push esi
call sub.PSAPI.DLL_EnumDeviceDrivers
test eax, eax
je 0x419669
cmp edi, ebx
jle 0x419669
mov ebx, dword [ebp + 8]
push esi
mov ecx, ebx
call fcn.0040d5c0
add esi, 4
dec edi
jne 0x419658
mov esi, dword [ebp - 0x14]
push esi
call fcn.00471f65
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419c80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
je 0x419ddc
cmp dword [ebp + 0xc], edi
je 0x419ddc
push esi
call fcn.00419bd0
add esp, 4
test eax, eax
je 0x419ddc
mov eax, dword [esi + 0x3c]
lea ecx, [eax + esi]
mov edx, 0x20b
cmp word [ecx + 0x18], dx
mov edx, dword [eax + esi + 0x50]
push ebx
movzx ebx, word [ecx + 6]
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x18], ecx
lea edx, [ebx + ebx*4]
jne 0x419ce1
lea eax, [eax + edx*8 + 0x108]
jmp 0x419ce8
lea eax, [eax + edx*8 + 0xf8]
movzx edx, word [ecx + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [edx + ecx + 0x24]
cmp ebx, edi
jbe 0x419d48
mov dword [ebp - 0x10], ebx
lea ebx, [ebx]
mov edx, dword [eax - 4]
mov ecx, dword [eax + 4]
mov edi, edx
cmp edx, ecx
ja 0x419d0e
mov edi, ecx
mov esi, dword [eax]
add edi, esi
cmp dword [ebp - 0xc], edi
ja 0x419d22
cmp edx, ecx
ja 0x419d1d
mov edx, ecx
add esi, edx
mov dword [ebp - 0xc], esi
add ecx, dword [eax + 8]
cmp dword [ebp - 8], ecx
ja 0x419d2d
mov dword [ebp - 8], ecx
add eax, 0x28
dec dword [ebp - 0x10]
jne 0x419d00
mov eax, dword [ebp - 8]
cmp dword [ebp + 0xc], eax
jb 0x419d80
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 4], ecx
jb 0x419d80
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 4]
push 0x40
push 0x3000
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x419d89
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 4]
push eax
push str.VirtualAlloc_failed__SizeOfImage:_x__LastError:_d
push str.UBASE::PeMapImage
push 2
call fcn.004191b0
add esp, 0x14
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push ecx
push 0
push edi
call fcn.00473a10
mov edx, dword [ebp - 0x14]
push edx
push esi
push edi
call fcn.00471540
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax + 0x14]
add esp, 0x18
lea eax, [ecx + eax + 0x18]
test ebx, ebx
je 0x419dd3
lea esi, [eax + 0x14]
mov eax, dword [esi]
mov edx, dword [esi - 4]
add eax, dword [ebp + 8]
mov ecx, dword [esi - 8]
push edx
push eax
add ecx, edi
push ecx
call fcn.00471540
add esp, 0xc
add esi, 0x28
dec ebx
jne 0x419db5
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a3b0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [edi], 0xffffffff
mov ebx, 0x10
mov dword [eax], 0
cmp dword [esi + 0x14], ebx
jb 0x41a3d9
mov eax, dword [esi]
jmp 0x41a3db
mov eax, esi
push 0
push 0
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x41a420
cmp dword [esi + 0x14], ebx
jb 0x41a3ff
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.CreateFileA__s_GENERIC_READ_failed__LastError:_d
push str.UBASE::MmMapFile
push 2
call fcn.004191b0
add esp, 0x14
jmp 0x41a4dd
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
test eax, eax
je 0x41a4b7
cmp eax, 0xffffffff
je 0x41a4b7
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push 0
push 0
push 0
push 2
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
test eax, eax
jne 0x41a47f
cmp dword [esi + 0x14], ebx
jb 0x41a461
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.CreateFileMapping__s_PAGE_READONLY_failed__LastError:_d
push str.UBASE::MmMapFile
push 2
call fcn.004191b0
add esp, 0x14
jmp 0x41a4dd
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x41a4fe
cmp dword [esi + 0x14], ebx
jb 0x41a499
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.MapViewOfFile__s_FILE_MAP_READ_failed__LastError:_d
push str.UBASE::MmMapFile
push 2
call fcn.004191b0
add esp, 0x14
jmp 0x41a4dd
cmp dword [esi + 0x14], ebx
jb 0x41a4be
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi]
push eax
push edx
push esi
push str.GetFileSize__s_failed__FileSize:_d_LastError:_d
push str.UBASE::MmMapFile
push 2
call fcn.004191b0
add esp, 0x18
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41a4ef
push eax
call esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp eax, 0xffffffff
je 0x41a4fc
push eax
call esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret