joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411487
Capabilities:
Create process on windows

Disassembly:
cmp dword [0x45e91c], 0
push esi
mov esi, ecx
je 0x411583
mov eax, dword [esi + 0x14]
shr eax, 0x19
test al, 1
je 0x4114bb
mov eax, dword [esi + 0x36c]
test eax, eax
je 0x411583
push eax
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
test eax, eax
jne 0x41154e
mov al, 1
pop esi
ret
mov eax, dword [esi + 0x364]
test eax, eax
je 0x411583
or dword [eax + 0x268], 3
mov ecx, dword [esi + 0x364]
push ebx
lea eax, [ecx + 0x294]
push eax
lea eax, [ecx + 0x2b0]
push eax
push dword [ecx + 0x260]
push 0
push dword [ecx + 0x268]
push 1
push 0
push 0
push dword [ecx + 0x4c]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne bl
cmp byte [0x4e0338], 0
je 0x41153d
cmp byte [0x4e0380], 0
je 0x41153d
mov eax, dword [esi + 0x364]
push dword [eax + 0x294]
push str.CreateProcess:_Info.hProcess__p
push 0
push 8
push 0x4602e0
call fcn.004166a0
add esp, 0x14
push dword [esi + 0x358]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test bl, bl
pop ebx
je 0x411583
movzx eax, byte [esi + 0x370]
push eax
call dword [0x45e91c]
mov ecx, esi
call fcn.00410a60
mov ecx, dword [esi + 0x36c]
test ecx, ecx
je 0x411583
mov eax, dword [0x45e918]
test eax, eax
je 0x411579
push ecx
call eax
mov dword [esi + 0x36c], 0
mov al, 1
pop esi
ret

Function at 0x411590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x228
mov eax, dword [0x45ce14]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
mov esi, dword [esp + 0x230]
test esi, esi
je 0x411625
cmp word [esi], 0
je 0x411625
push 0
push 0x108
push 2
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x14]
call fcn.00403130
mov eax, dword [esp + 0x14]
xor ecx, ecx
push 0x45ef20
push esi
mov word [eax], cx
lea ecx, [esp + 0xc]
call fcn.00407d80
test al, al
je 0x41161c
push ebx
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea ecx, [esp + 8]
setne bl
call fcn.004031c0
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0041e282
add esp, 0x228
ret
lea ecx, [esp + 4]
call fcn.004031c0
mov ecx, dword [esp + 0x228]
xor al, al
pop esi
xor ecx, esp
call fcn.0041e282
add esp, 0x228
ret

Function at 0x412580
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x228
mov eax, dword [0x45ce14]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push esi
mov esi, dword [esp + 0x234]
lea eax, [esp + 0x1c]
push 0
push 0x108
push 2
push eax
lea ecx, [esp + 0x18]
call fcn.00403130
mov eax, dword [esp + 0x18]
xor ecx, ecx
push 0x45ef20
push esi
mov word [eax], cx
lea ecx, [esp + 0x10]
call fcn.00407d80
test al, al
je 0x4125e7
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4125e7
test al, 1
je 0x4125e7
mov bl, 1
jmp 0x4125e9
xor bl, bl
lea ecx, [esp + 8]
call fcn.004031c0
mov ecx, dword [esp + 0x22c]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.0041e282
add esp, 0x228
ret
Function at 0x4130b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
push ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
push esi
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
push 0
push dword [esp + 0x34]
movlpd qword [esp + 0x14], xmm0
push dword [esp + 0x34]
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
sete bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x413129
cmp eax, 0x3e5
jne 0x413129
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
test bl, bl
jne 0x41313b
pop esi
xor al, al
pop ebx
add esp, 0x14
ret 0x14
test bl, bl
jne 0x41311f
test eax, eax
jne 0x41311f
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov eax, dword [esp + 8]
test eax, eax
je 0x41314e
cmp eax, 0x103
je 0x41314e
test ecx, ecx
je 0x41311f
pop esi
mov al, 1
pop ebx
add esp, 0x14
ret 0x14

Function at 0x413960
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x20
push esi
mov esi, ecx
mov eax, dword [esi + 0x284]
lea ecx, [esi + 0x284]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x413a47
push 0
push dword [esi + 0x288]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 4], eax
test eax, eax
je 0x413a47
push ebx
push 1
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0x441710
mov dword [esp + 0x14], 0
call fcn.00403100
push 0
push dword [esp + 0xc]
lea ecx, [esp + 0x1c]
call fcn.004031e0
test al, al
je 0x413a2b
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push dword [esp + 0x30]
push dword [esi + 0x288]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4139ee
mov eax, dword [esp + 0x24]
mov byte [eax], 0
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
inc eax
push eax
call fcn.0040b8e0
test eax, eax
je 0x413a2b
mov ecx, dword [esp + 8]
push ecx
push dword [esp + 0x28]
inc ecx
push ecx
push eax
call fcn.0040a8d0
add esp, 0x10
lea ecx, [esp + 0xc]
call fcn.0040bbb0
push eax
lea ecx, [esi + 0x34]
call fcn.0040b520
mov bl, al
jmp 0x413a2d
xor bl, bl
lea ecx, [esp + 0x14]
call fcn.004031c0
lea ecx, [esp + 0xc]
call fcn.0040b470
mov al, bl
pop ebx
pop esi
add esp, 0x20
ret
mov al, 1
pop esi
add esp, 0x20
ret
Function at 0x413be0
Capabilities:
Delete file
Set file attributes

Disassembly:
sub esp, 0x228
mov eax, dword [0x45ce14]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
mov ebx, dword [esp + 0x234]
push esi
mov esi, dword [esp + 0x234]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x413c82
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 3
je 0x413c2d
sub eax, 2
je 0x413c9c
sub eax, 0xc9
jne 0x413cbe
push 0
push 0x108
push 2
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
call fcn.00403130
mov eax, dword [esp + 0x1c]
xor ecx, ecx
push ebx
push esi
mov word [eax], cx
lea ecx, [esp + 0x14]
call fcn.00407d80
test al, al
je 0x413cb5
push 0x80
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x413cb5
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x413cb5
lea ecx, [esp + 0xc]
call fcn.004031c0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0041e282
add esp, 0x228
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x413cbe
push esi
call edi
test eax, eax
je 0x413cbe
jmp 0x413c82
lea ecx, [esp + 0xc]
call fcn.004031c0
push esi
mov ecx, ebx
call fcn.00404b00
mov ecx, dword [esp + 0x230]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041e282
add esp, 0x228
ret

Function at 0x414700
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c4]
lea ecx, [esi + 0x1c4]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x414726
push 0
push dword [esi + 0x1c8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
ret
Function at 0x414730
Capabilities:
Terminate process

Disassembly:
sub esp, 0x430
mov eax, dword [0x45ce14]
xor eax, esp
mov dword [esp + 0x42c], eax
push esi
mov esi, ecx
test byte [esi + 0x17], 1
je 0x41488b
cmp dword [0x45ecf4], 0
je 0x41488b
cmp dword [0x45ecfc], 0
je 0x41488b
push ebx
push edi
push 0
push 0x108
push 2
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
call fcn.00403130
mov eax, dword [esp + 0x1c]
xor ecx, ecx
push 0x208
push ecx
mov word [eax], cx
lea eax, [esp + 0x238]
push eax
call fcn.0041ff40
add esp, 0xc
lea ecx, [esp + 0xc]
push 0
call fcn.004074f0
push 0x44553c
lea ecx, [esp + 0x10]
call fcn.004079d0
lea ecx, [esp + 0xc]
call fcn.00407330
push 0
lea eax, [esp + 0x234]
push 0
push eax
call fcn.00403f50
add esp, 4
lea ecx, [esp + 0x14]
push eax
call fcn.00406ec0
push 1
push 0x445ba8
lea ecx, [esp + 0x14]
call fcn.00407900
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [esp + 0x34]
mov edi, 0x104
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
test ebx, ebx
je 0x414880
cmp dword [0x45ecfc], 2
mov eax, 0x106
push 0
push 0
push 0
cmove edi, eax
push edi
push ebx
push dword [esi + 0x36c]
push dword [esi + 0x350]
call dword [0x45ecf4]
test eax, eax
jne 0x414879
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x414879
cmp byte [0x4e0338], 0
je 0x414879
cmp byte [0x4e0380], 0
je 0x414879
push str.Debugger:_MiniDump_Failed_to_write._n
push 0
push 8
push 0x4602e0
call fcn.004166a0
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xc]
call fcn.004031c0
pop edi
pop ebx
push 1
push dword [esi + 0x350]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0x430]
mov dword [esi + 0x350], 0xffffffff
pop esi
xor ecx, esp
call fcn.0041e282
add esp, 0x430
ret

Function at 0x415f00
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov edi, ecx
push 0
lea esi, [edi + 0x80050]
push esi
call fcn.004123f0
add esp, 8
test eax, eax
je 0x415f4a
cmp dword [edi + 0x80010], 0
je 0x415f3f
push 0
push esi
call fcn.004123f0
push eax
push 0x446468
push 0
push 0xffffffffffffffff
push edi
call fcn.004166a0
add esp, 0x1c
jmp 0x415f4a
push str.Messages_missed__likely_during_startup._r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [edi + 0x8003c]
call fcn.0040b470
lea ecx, [edi + 0x80020]
call fcn.00406060
lea ecx, [edi + 0x8000c]
call fcn.00415fa0
lea ecx, [edi + 0x8000c]
call fcn.004031c0
mov ecx, edi
pop edi
pop esi
jmp fcn.00403600
Function at 0x4181a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
je 0x4181dc
call fcn.00411b80
push eax
mov eax, dword [esi + 0x14]
lea ecx, [esi + 0x2c]
add eax, eax
push eax
call fcn.00403380
test al, al
je 0x418327
push 0
push 0x8800
lea ecx, [esi + 0x40]
call fcn.004031e0
test al, al
je 0x418327
mov ecx, dword [esi + 0x50]
mov eax, dword [esi + 0x14]
add ecx, 0x400
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x3c]
mov dword [esi + 4], eax
lea eax, [ecx + 0x8000]
mov dword [esi + 0x10], 0
mov dword [esi + 0x74], ecx
mov dword [esi + 0x78], eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0x80], ecx
mov dword [esi + 0x7c], ecx
mov dword [esi + 0xa4], 1
mov dword [esi + 0xc], 1
nop word [eax + eax]
cmp dword [esi + 0x18], 0
je 0x4182b0
mov ecx, esi
call fcn.004187c0
mov edx, dword [esi + 0x14]
mov dword [esi + 0x10], eax
sub edx, dword [esi + 0x1c]
je 0x4182a4
mov ecx, dword [esi + 8]
push 0x45ef20
push edx
push dword [esi + 0x3c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x94]
call eax
test al, al
je 0x41829d
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x14]
shr eax, 0xd
test al, 1
jne 0x41829d
mov eax, dword [esi + 0x3c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x1c], eax
jmp 0x4182a4
mov dword [esi + 0x10], 0xffffffff
cmp dword [esi + 0x10], 0
je 0x418250
nop word [eax + eax]
mov ecx, esi
call fcn.004187c0
mov edx, dword [esi + 0x14]
mov dword [esi + 0x10], eax
sub edx, dword [esi + 0x1c]
je 0x418305
mov ecx, dword [esi + 8]
push 0x45ef20
push edx
push dword [esi + 0x3c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x94]
call eax
test al, al
je 0x4182fe
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x14]
shr eax, 0xd
test al, 1
jne 0x4182fe
mov eax, dword [esi + 0x3c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4182b0
jmp 0x418308
mov dword [esi + 0x10], 0xffffffff
mov eax, dword [esi + 0x10]
test eax, eax
je 0x418343
cmp eax, 1
je 0x418343
mov eax, dword [esp + 8]
push dword [esp + 0xc]
push str.Decompression_error_in___s_._File_may_be_corrupted
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
add esp, 0xc
mov eax, dword [esi + 0xac]
lea ecx, [esi + 0xac]
mov dword [esi + 0x10], 0xfffffffc
call dword [eax + 0xc]
xor al, al
pop esi
ret 8
mov eax, dword [esi + 0xac]
lea ecx, [esi + 0xac]
call dword [eax + 0xc]
mov al, 1
pop esi
ret 8
Function at 0x419210
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 0xc]
sub esp, 0x154
push ebp
push esi
mov esi, dword [esp + 0x160]
push edi
push 0xa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4192d3
push ebx
lea ecx, [esp + 0x10]
xor bl, bl
call fcn.0040cd50
push dword [esp + 0x16c]
lea ecx, [esp + 0x14]
push 0x400
push dword [esp + 0x17c]
call fcn.0040f210
test al, al
je 0x4192b6
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [esp + 0x174]
lea ecx, [esp + 0x14]
push dword [esp + 0x170]
push ecx
push esi
push eax
lea ecx, [esp + 0xbc]
call fcn.00416c20
mov ecx, eax
call fcn.004181a0
lea ecx, [esp + 0xa8]
mov bl, al
call fcn.00416c90
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [esp + 0x10]
call fcn.0040da00
mov al, bl
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x154
ret
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x154
ret
Function at 0x4192f0
Capabilities:
Delete file

Disassembly:
sub esp, 0x298
mov eax, dword [0x45ce14]
xor eax, esp
mov dword [esp + 0x294], eax
push ebx
mov ebx, dword [esp + 0x2a4]
lea eax, [esp + 0x88]
push ebp
mov ebp, dword [esp + 0x2a4]
lea ecx, [esp + 0x78]
push esi
push edi
push 0
push 0x108
push 2
push eax
mov dword [esp + 0x24], ebp
call fcn.00403130
mov eax, dword [esp + 0x90]
xor ecx, ecx
push 0x5c
push ebx
mov word [eax], cx
call fcn.0040a990
mov esi, eax
push esi
call fcn.0040a800
add esp, 0xc
lea ecx, [esp + 0x80]
mov edi, eax
push 0xffffffffffffffff
push esi
call fcn.00407ac0
cmp edi, 4
jbe 0x419377
mov ecx, dword [esp + 0x90]
xor eax, eax
mov word [ecx + edi*2 - 8], ax
lea ecx, [esp + 0x18]
mov esi, 0x115d
call fcn.0040d190
push ebx
push 0
push 0xa
push 0x2be
push ebp
lea ecx, [esp + 0x2c]
call fcn.0040f670
test al, al
je 0x4193c6
mov eax, dword [esp + 0x70]
mov ecx, 4
cmp eax, ecx
cmova eax, ecx
push eax
push dword [esp + 0x6c]
lea eax, [esp + 0x18]
push eax
call fcn.0041f9c0
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
cmovne esi, eax
push ebp
push esi
push ebx
call fcn.0041e1b0
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.0040dc80
push 0
push dword [esp + 0x94]
push ebp
call fcn.0041ae20
add esp, 0xc
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call ebp
mov edi, 2
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x88]
call fcn.00407ac0
lea ecx, [esp + 0x80]
call fcn.004074e0
mov esi, eax
sub edi, 1
jne 0x419434
push 0x2e
push esi
call fcn.004207e4
add esp, 8
mov esi, eax
test esi, esi
je 0x41945d
push esi
call fcn.0040a830
push eax
lea eax, [esi + 2]
push esi
push eax
call fcn.00406030
add esp, 0x10
mov eax, 0x5f
mov word [esi], ax
push dword [esp + 0x90]
call ebp
test edi, edi
jne 0x419405
push ebx
lea ecx, [esp + 0x84]
call fcn.00407bf0
lea ecx, [esp + 0x80]
call fcn.004074e0
push 0x5f
lea ecx, [esp + 0x84]
mov esi, eax
call fcn.00406d20
push edi
push esi
push dword [esp + 0x1c]
call fcn.0041ae20
add esp, 0xc
lea ecx, [esp + 0x80]
push 1
push 0x447320
call fcn.00407900
push dword [esp + 0x90]
call ebp
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x88]
call fcn.00407ac0
push 1
push str.snap
lea ecx, [esp + 0x88]
call fcn.00407900
push dword [esp + 0x90]
call ebp
lea ecx, [esp + 0x80]
call fcn.004031c0
mov ecx, dword [esp + 0x2a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041e282
add esp, 0x298
ret
Function at 0x41d8a0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x244
mov eax, dword [0x45ce14]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push ebp
mov ebp, dword [esp + 0x254]
push esi
push edi
mov edi, dword [esp + 0x258]
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x41da14
push 1
lea ecx, [esp + 0x1c]
call fcn.00403100
push 0
push esi
lea ecx, [esp + 0x20]
call fcn.004031e0
test al, al
je 0x41d9c2
push dword [esp + 0x28]
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41d9a6
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
push str.StringFileInfo040904B0FileDescription
push dword [esp + 0x34]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41d980
cmp dword [esp + 0x10], 0
je 0x41d95a
push dword [esp + 0x14]
mov ecx, ebp
call fcn.0040b980
lea ecx, [esp + 0x18]
mov bl, al
call fcn.004031c0
jmp 0x41da2c
mov eax, dword [0x45ef20]
mov ecx, 0x45ef20
push 0
push str.Could_not_retrieve_File_Description
mov eax, dword [eax + 4]
call eax
lea ecx, [esp + 0x18]
mov bl, al
call fcn.004031c0
jmp 0x41da2c
mov eax, dword [0x45ef20]
mov ecx, 0x45ef20
push 0
push str.File_Description_could_not_be_found_in_the_Version_resource
mov eax, dword [eax + 4]
call eax
lea ecx, [esp + 0x18]
mov bl, al
call fcn.004031c0
jmp 0x41da2c
push str.Could_not_retrieve_Version_information_for_the_running_binary
mov ecx, 0x45ef20
call fcn.00404b00
lea ecx, [esp + 0x18]
mov bl, al
call fcn.004031c0
jmp 0x41da2c
lea ecx, [esp + 0x18]
call fcn.004031c0
push 0
push 0x108
push 2
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x3c]
call fcn.00403130
mov eax, dword [esp + 0x3c]
xor ecx, ecx
push 0xffffffffffffffff
push edi
mov word [eax], cx
lea ecx, [esp + 0x34]
call fcn.00407ac0
test al, al
je 0x41da34
lea ecx, [esp + 0x2c]
call fcn.004074e0
push eax
mov ecx, ebp
call fcn.0040b980
test al, al
je 0x41da34
mov bl, 1
jmp 0x41da36
mov eax, dword [0x45ef20]
mov ecx, 0x45ef20
push 0
push str.Version_resource_is_not_present_in_the_running_binary
mov eax, dword [eax + 4]
call eax
mov bl, al
test bl, bl
je 0x41d9cb
mov al, 1
jmp 0x41da41
xor bl, bl
lea ecx, [esp + 0x2c]
call fcn.004031c0
mov al, bl
mov ecx, dword [esp + 0x250]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041e282
add esp, 0x244
ret
Function at 0x41da60
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], ecx
push eax
push 0x44a0e4
push 1
push 0
push 0x449a5c
mov dword [esp + 0x2c], vtable.SmartCOMPointer_struct_INetFwMgr_.0
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], vtable.SmartCOMPointer_struct_INetFwPolicy_.0
mov dword [esp + 0x28], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebp, dword [esp + 0x2c]
mov esi, eax
test esi, esi
jns 0x41db0c
push str.Windows_Firewall_Manager
push str.Failed_to_instantiate_COM_object
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x441710
push str._s__Message:___s_
push eax
mov dword [esp + 0x34], 0
call fcn.0040baa0
add esp, 0x10
test al, al
je 0x41daf9
push 0
lea ecx, [esp + 0x24]
call fcn.0040bbb0
push eax
push esi
mov ecx, ebp
call fcn.00404f10
test al, al
je 0x41daf9
mov bl, 1
jmp 0x41dafb
xor bl, bl
lea ecx, [esp + 0x20]
call fcn.0040b470
test bl, bl
je 0x41dc15
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
test ecx, ecx
je 0x41db1e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [eax + 0x1c]
mov esi, eax
test esi, esi
jns 0x41db8e
push str.Windows_Firewall_Local_Policy
push str.COM_error_occurred
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x441710
push str._s__Message:___s_
push eax
mov dword [esp + 0x34], 0
call fcn.0040baa0
add esp, 0x10
test al, al
je 0x41db7b
push 0
lea ecx, [esp + 0x24]
call fcn.0040bbb0
push eax
push esi
mov ecx, ebp
call fcn.00404f10
test al, al
je 0x41db7b
mov bl, 1
jmp 0x41db7d
xor bl, bl
lea ecx, [esp + 0x20]
call fcn.0040b470
test bl, bl
je 0x41dc15
mov esi, dword [esp + 0xc]
add esi, 4
push edi
mov edi, dword [esp + 0x18]
mov ecx, dword [esi]
test ecx, ecx
je 0x41dba6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi], 0
mov eax, dword [edi]
push esi
push edi
call dword [eax + 0x1c]
mov esi, eax
pop edi
test esi, esi
jns 0x41dc19
push str.Windows_Firewall_Profile
push str.COM_error_occurred
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x441710
push str._s__Message:___s_
push eax
mov dword [esp + 0x34], 0
call fcn.0040baa0
add esp, 0x10
test al, al
je 0x41dc06
push 0
lea ecx, [esp + 0x24]
call fcn.0040bbb0
push eax
push esi
mov ecx, ebp
call fcn.00404f10
test al, al
je 0x41dc06
mov bl, 1
jmp 0x41dc08
xor bl, bl
lea ecx, [esp + 0x20]
call fcn.0040b470
test bl, bl
jne 0x41dc19
xor bl, bl
jmp 0x41dc1b
mov bl, 1
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], vtable.SmartCOMPointer_struct_INetFwPolicy_.0
test ecx, ecx
je 0x41dc31
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], vtable.SmartCOMPointer_struct_INetFwMgr_.0
test eax, eax
je 0x41dc47
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x1c
ret 4
Function at 0x435ad3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00435793
Function at 0x401ec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100020
call fcn.004053b0
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edi
push 0x406d28
push edx
mov ebx, ecx
movlpd qword [ebp - 0x100014], xmm0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
add esp, 8
mov dword [ebp - 0x100018], edi
test edi, edi
jne 0x401f4a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push dword [0x4094a0]
push str.fopen:__s:__s_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040470b
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x100014]
push eax
push 3
push esi
push ebx
call dword [sym.imp.imobiledevice.dll_afc_file_open]
add esp, 0x10
test eax, eax
jne 0x401f70
mov eax, dword [ebp - 0x100014]
or eax, dword [ebp - 0x100010]
jne 0x401fb6
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
push esi
push str.afc_file_open_on__s_failed__n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040470b
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x100018]
push edi
push 0x100000
lea eax, [ebp - 0x10000c]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edi, eax
add esp, 0x10
test edi, edi
je 0x402092
xor esi, esi
nop word [eax + eax]
lea eax, [ebp - 0x10001c]
mov dword [ebp - 0x10001c], 0
push eax
push edi
lea eax, [ebp - 0x10000c]
push eax
push dword [ebp - 0x100010]
push dword [ebp - 0x100014]
push ebx
call dword [sym.imp.imobiledevice.dll_afc_file_write]
add esp, 0x18
test eax, eax
jne 0x40201f
add esi, dword [ebp - 0x10001c]
cmp esi, edi
jb 0x401fe0
jmp 0x402039
push eax
push str.AFC_Write_error:__d_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
cmp esi, edi
je 0x401fb0
push edi
push esi
push str.Error:_wrote_only__u_of__u_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
push dword [ebp - 0x100010]
push dword [ebp - 0x100014]
push ebx
call dword [sym.imp.imobiledevice.dll_afc_file_close]
add esp, 0x1c
push dword [ebp - 0x100018]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040470b
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x100010]
push dword [ebp - 0x100014]
push ebx
call dword [sym.imp.imobiledevice.dll_afc_file_close]
add esp, 0xc
push dword [ebp - 0x100018]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [ebp - 8]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.0040470b
mov esp, ebp
pop ebp
ret