joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4100c0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4101b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4100fe
cmp eax, 3
je 0x410108
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x410108
test al, 0x10
je 0x410108
xor esi, esi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
movzx ecx, word [ebx]
mov eax, ebx
push edi
xor edi, edi
test cx, cx
je 0x4101a0
lea esp, [esp]
cmp cx, 0x5c
movzx ecx, word [eax + 2]
cmove edi, eax
add eax, 2
test cx, cx
jne 0x410120
test edi, edi
je 0x4101a0
push dword [ebp + 0xc]
xor eax, eax
push ebx
mov word [edi], ax
call fcn.004100c0
mov esi, eax
mov eax, 0x5c
mov word [edi], ax
test esi, esi
js 0x4101b5
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x410195
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x41017f
mov esi, 1
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
test esi, esi
jle 0x4101b5
movzx esi, si
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
mov esi, 0x80070003
push esi
push 0x82
push 0x42b4d4
call fcn.004109e0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4101c0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], 0
push 0
mov dword [ebp - 0xc], 0
call fcn.004102d0
mov esi, eax
test esi, esi
js 0x4102be
push edi
push 0
push 0x80
push dword [ebp + 0x10]
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x410254
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x410238
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, 0x80004005
cmovns esi, eax
push esi
push 0xe7
push str.resrutil.cpp
call fcn.004109e0
jmp 0x4102a8
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 1
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4102a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x410287
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, 0x80004005
cmovns esi, eax
push esi
push 0xed
push str.resrutil.cpp
call fcn.004109e0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
test esi, esi
jns 0x4102bc
cmp dword [ebp - 0xc], 0
je 0x4102bc
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410490
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x218], eax
mov esi, 0x80004005
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x21c], eax
or edi, 0xffffffff
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x41051f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x410508
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x41051f
push esi
push 0x4be
push 0x42b4f8
call fcn.004109e0
jmp 0x4105ec
push ebx
xor ebx, ebx
cmp edi, 0xffffffff
jne 0x4105b4
push dword [ebp - 0x220]
lea eax, [ebp - 0x20c]
push ebx
push dword [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push str._s_s_05d._s
push eax
call fcn.0040fdf0
mov esi, eax
add esp, 0x18
test esi, esi
js 0x4105eb
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4105a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x410597
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070050
jne 0x4105a3
xor esi, esi
jmp 0x4105a7
test esi, esi
js 0x4105eb
inc ebx
cmp ebx, 0x3e8
jl 0x410522
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4105c3
mov dword [eax], edi
or edi, 0xffffffff
mov ecx, dword [ebp - 0x218]
test ecx, ecx
je 0x4105df
mov eax, dword [ebp - 0x210]
mov dword [ecx], eax
mov dword [ebp - 0x210], 0
cmp edi, 0xffffffff
je 0x4105eb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x4105fc
push eax
call fcn.0040ffd0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004114dd
mov esp, ebp
pop ebp
ret 0x10
Function at 0x410610
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, 1
test edi, edi
cmovne ebx, eax
cmp dword [ebp + 0x14], esi
je 0x41062f
or ebx, 2
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x410712
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test edi, edi
jne 0x41066b
cmp esi, 0x50
je 0x41065d
cmp esi, 0xb7
jne 0x41066b
mov esi, 1
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
cmp esi, 3
jne 0x410705
mov edx, dword [ebp + 0xc]
xor edi, edi
mov eax, edx
movzx ecx, word [edx]
test cx, cx
je 0x4106f7
cmp cx, 0x5c
movzx ecx, word [eax + 2]
cmove edi, eax
add eax, 2
test cx, cx
jne 0x410683
test edi, edi
je 0x4106f7
xor eax, eax
push eax
push edx
mov word [edi], ax
call fcn.004100c0
mov esi, eax
mov eax, 0x5c
mov word [edi], ax
test esi, esi
js 0x410712
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x410712
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4106dc
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x410712
push esi
push 0x42e
push 0x42b4f8
call fcn.004109e0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
mov esi, 0x80070003
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
test esi, esi
jle 0x410712
movzx esi, si
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x425c72
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00417375
mov dword [ebp - 0x14], eax
cmp dword [0x439b9c], esi
jne 0x425d65
push 0x800
push esi
push 0x431db8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x425cf2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x425e45
push esi
push esi
push 0x431db8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x425e45
push 0x431dd0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x425e45
push eax
call ebx
push 0x431ddc
push edi
mov dword [0x439b9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x431dec
push edi
mov dword [0x439ba0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x431e00
push edi
mov dword [0x439ba4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x439bac], eax
test eax, eax
je 0x425d62
push 0x431e1c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x439ba8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x425d8a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x425d7d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x425d9f
push 4
pop eax
jmp 0x425e47
cmp dword [ebp - 0x14], esi
je 0x425d9f
push dword [0x439b9c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x425d84
mov eax, dword [0x439ba8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x425dfd
cmp dword [0x439bac], edi
je 0x425dfd
push eax
call ebx
push dword [0x439bac]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x425dfd
test eax, eax
je 0x425dfd
call ecx
test eax, eax
je 0x425df2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x425df2
test byte [ebp - 8], 1
jne 0x425dfd
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x425e2d
mov eax, dword [0x439ba0]
cmp eax, edi
je 0x425e2a
push eax
call ebx
test eax, eax
je 0x425e2a
call eax
mov esi, eax
test esi, esi
je 0x425e2a
mov eax, dword [0x439ba4]
cmp eax, edi
je 0x425e2a
push eax
call ebx
test eax, eax
je 0x425e2a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x439b9c]
call ebx
test eax, eax
je 0x425e45
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x425e47
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004114dd
mov esp, ebp
pop ebp
ret
Function at 0x403ead
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x488180]
xor eax, esp
mov dword [esp + 0x120], eax
push esi
mov esi, ecx
cmp byte [esi + 0x300], 0
je 0x403f19
push 0x110
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00447690
add esp, 0xc
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 5
jne 0x403f0a
mov ecx, esi
call fcn.00403b6d
jmp 0x403f1b
cmp dword [esp + 0xc], 6
jb 0x403f19
push esi
call fcn.00403190
jmp 0x403f1b
xor eax, eax
mov ecx, dword [esp + 0x124]
pop esi
xor ecx, esp
call fcn.00443d6d
mov esp, ebp
pop ebp
ret
Function at 0x409c7a
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x45e443
call fcn.00447f12
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x38], edi
cmp dword [edi + 0x3c], ebx
je 0x409d8d
cmp byte [edi + 0x41], bl
je 0x409d8d
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x409cb2
xor al, al
jmp 0x409d8f
push ebx
push 8
pop esi
lea eax, [ebp - 0x30]
call fcn.004095da
lea eax, [edi + 0x44]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
call fcn.0042a2c2
mov esi, eax
call fcn.00408942
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x30]
call fcn.0042a2c2
mov esi, eax
call fcn.00408942
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x34]
push esi
mov esi, dword [ebp - 0x40]
add ebx, esi
push ebx
push eax
push dword [ebp - 0x3c]
call dword [edx + 0x18]
sub eax, 0
je 0x409d25
dec eax
je 0x409d29
dec eax
dec eax
je 0x409d89
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004097af
mov al, bl
jmp 0x409d8f
mov byte [edi + 0x41], 0
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
call fcn.0042a2c2
mov esi, eax
call fcn.00408942
mov ebx, dword [ebp - 0x34]
sub ebx, eax
je 0x409d67
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x30]
call fcn.0042a2c2
mov esi, eax
call fcn.00408942
push dword [edi + 0x4c]
push ebx
push 1
push eax
call fcn.0044499c
add esp, 0x10
cmp ebx, eax
jne 0x409d13
cmp byte [edi + 0x41], 0
je 0x409d89
test ebx, ebx
jne 0x409cc7
push ebx
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.004095fc
mov edi, dword [ebp - 0x38]
jmp 0x409cc7
mov bl, 1
jmp 0x409d15
mov al, 1
call fcn.00447f95
ret

Function at 0x40cf81
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40cfe5
cmp dword [ebp + 0xc], 1
je 0x40cfbd
cmp dword [ebp + 0xc], 2
je 0x40cfbd
push 0xd
pop eax
jmp 0x40cfe5
mov eax, dword [ebp - 4]
test edi, edi
je 0x40cfdf
test eax, eax
je 0x40cfda
test al, 1
jne 0x40cfb8
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40cfdf
jmp 0x40cfb8
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x40dfcc
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.0043cb62
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [esi + 0x64]
call edi
push 1
push dword [esi + 0x68]
call edi
push 0
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
ret
Function at 0x410a95
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x410aac
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x410ae1
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x410add
cmp edi, eax
jae 0x410ae1
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x410acf
cmp edi, eax
jb 0x410ae5
xor eax, eax
jmp 0x410aee
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x411d9b
Capabilities:
Create thread
Resume thread

Disassembly:
push 0x4c
mov eax, 0x462c27
call fcn.00447ea9
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x30]
push ecx
push 4
push eax
push 0x43d5b1
xor esi, esi
push esi
push esi
call fcn.00446a11
add esp, 0x18
cmp eax, esi
je 0x411def
mov ecx, dword [edi]
xor edx, edx
add ecx, 4
inc edx
lock xadd dword [ecx], edx
mov ecx, dword [edi]
push eax
lea esi, [ecx + 8]
call fcn.00411af4
mov edi, dword [edi]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
call fcn.00447f81
ret
lea eax, [ebp - 0x58]
call fcn.00401a5a
push eax
mov dword [ebp - 4], esi
call fcn.0040b5b7
int3

Function at 0x4125d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46294b
mov eax, dword fs:[0]
push eax
mov eax, 0x107c
call fcn.00456fe0
mov eax, dword [0x488180]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push ecx
push edi
push str.Bootstrapper::CreateProcess_module___S__args___S
lea esi, [eax + 0x188]
mov dword [ebp - 0x101c], ecx
mov dword [ebp - 0x1018], edx
call fcn.0040939b
add esp, 0xc
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x1080]
push ebx
push eax
call fcn.00447690
add esp, 0xc
xor eax, eax
push 0xffe
mov word [ebp - 0x1014], ax
lea eax, [ebp - 0x1012]
push ebx
push eax
mov dword [ebp - 0x1084], 0x44
call fcn.00447690
add esp, 0xc
cmp word [edi], 0x22
mov esi, 0x800
lea eax, [ebp - 0x1014]
je 0x4126ae
push 0x46d8a4
push esi
push eax
call fcn.00445b6d
add esp, 0xc
push edi
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.00445df7
add esp, 0xc
push 0x46d8a4
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.00445df7
jmp 0x4126b6
push edi
push esi
push eax
call fcn.00445b6d
add esp, 0xc
push 0x46d8a8
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.00445df7
add esp, 0xc
push dword [ebp - 0x101c]
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.00445df7
add esp, 0xc
push edi
push str.CreateProcess__S_failed
lea esi, [ebp - 0x1038]
call fcn.0042a6df
pop ecx
pop ecx
mov esi, eax
push dword [ebp - 0x1018]
lea eax, [ebp - 0x1084]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1014]
push eax
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x412729
mov eax, esi
call fcn.004270a1
push ebx
push 1
lea ecx, [ebp - 0x1038]
call fcn.004097af
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00443d6d
leave
ret 4
Function at 0x412bf0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x488180]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00447690
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x412c43
cmp dword [ebp - 0x70], 2
jne 0x412c43
cmp dword [ebp - 0x7c], 5
jne 0x412c43
mov al, 1
jmp 0x412c45
xor al, al
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.00443d6d
add ebp, 0x98
leave
ret

Function at 0x412c5a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x488180]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00447690
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x412cab
cmp dword [ebp - 0x7c], 6
jne 0x412cab
xor eax, eax
inc eax
cmp dword [ebp - 0x78], eax
je 0x412cad
xor al, al
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.00443d6d
add ebp, 0x98
leave
ret
Function at 0x412eaa
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4600c7
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x488180]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
push edi
mov eax, dword [0x488180]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, vtable.ATL::CAccessToken.0
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
lea eax, [esp + 0x34]
mov byte [esp + 0xa8], 1
call fcn.00412e1c
mov byte [esp + 0xa8], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ecx, [esp + 0x10]
push ecx
push 1
mov edi, 0x2000a
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x412f66
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x10]
push ecx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x412f79
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x14]
call dword [eax + 4]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
push 2
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x412fa1
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x24]
call dword [eax + 4]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x412fc0
cmp dword [esp + 0x10], ebx
setne bl
lea ecx, [esp + 0x34]
call fcn.00412da5
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], esi
call fcn.00412e6c
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
call fcn.00412e6c
mov al, bl
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00443d6d
mov esp, ebp
pop ebp
ret
Function at 0x4139cd
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462918
mov eax, dword fs:[0]
push eax
mov eax, 0x28a4
call fcn.00456fe0
mov eax, dword [0x488180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x28b0]
push eax
lea eax, [ebp - 0x28ac]
push eax
mov dword [ebp - 0x28b0], 0x2880
call sub.IPHLPAPI.DLL_GetAdaptersInfo
lea edi, [ebp - 0x28ac]
cmp dword [edi + 0x1a0], 6
jne 0x413ab9
movzx eax, byte [edi + 0x19b]
push eax
movzx eax, byte [edi + 0x19a]
push eax
movzx eax, byte [edi + 0x199]
push eax
movzx eax, byte [edi + 0x198]
push eax
movzx eax, byte [edi + 0x197]
push eax
movzx eax, byte [edi + 0x196]
push eax
movzx eax, byte [edi + 0x195]
push eax
movzx eax, byte [edi + 0x194]
push eax
push str._02x__02x__02x__02x__02x__02x__02x__02x
lea esi, [ebp - 0x2c]
call fcn.0042a6df
add esp, 0x24
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x413a8e
lea eax, [ebp - 0x28]
lea ecx, [edi + 0x10c]
push ecx
push eax
push str.MAC:__s_Name:__s
lea esi, [ebx + 0x188]
call fcn.0040939b
or dword [ebp - 4], 0xffffffff
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004097af
mov edi, dword [edi]
test edi, edi
jne 0x413a21
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00443d6d
leave
ret
Function at 0x41692d
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x25c
lea ebp, [esp - 4]
mov eax, dword [0x488180]
xor eax, ebp
mov dword [ebp + 0x25c], eax
push 0x1c
mov eax, 0x463469
call fcn.00447ea9
lea eax, [ebp + 0x38]
push eax
mov ecx, ebx
call fcn.004168c8
and dword [ebp - 4], 0
cmp dword [ebp + 0x50], 8
mov eax, dword [ebp + 0x3c]
jae 0x41696c
lea eax, [ebp + 0x3c]
push eax
lea edi, [ebx + 0x188]
push str.Bootstrapper::deploySelf___Final_file_path_S
mov esi, edi
call fcn.0040939b
cmp dword [ebp + 0x50], 8
mov eax, dword [ebp + 0x3c]
pop ecx
pop ecx
jae 0x41698d
lea eax, [ebp + 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x416a6e
push str._PathFileExists
call fcn.0040939b
lea ecx, [ebp - 0x28]
mov dword [esp], str.Error_when_getting_bootstrapper_filename_for_selfDeploy
call fcn.004084cc
push 0x104
lea eax, [ebp + 0x54]
push eax
push 0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4169d6
lea eax, [ebp - 0x28]
call fcn.004270a1
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.004097af
lea eax, [ebp + 0x54]
push eax
lea esi, [ebp + 0x1c]
call fcn.0040858a
mov byte [ebp - 4], 2
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x416a02
lea eax, [ebp + 0x20]
push eax
push str.GetModuleFileName:__S
mov esi, edi
call fcn.0040939b
pop ecx
pop ecx
mov ecx, dword [ebp + 0x3c]
push 8
pop esi
cmp dword [ebp + 0x50], esi
jae 0x416a1f
lea ecx, [ebp + 0x3c]
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x34], esi
jae 0x416a2a
lea eax, [ebp + 0x20]
push ecx
push eax
mov ecx, edi
call fcn.0042745c
pop ecx
pop ecx
mov ecx, dword [ebp + 0x3c]
cmp dword [ebp + 0x50], esi
jae 0x416a40
lea ecx, [ebp + 0x3c]
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x34], esi
jae 0x416a4b
lea eax, [ebp + 0x20]
push ecx
push eax
push str.Copy:_from___S_to__S
mov esi, edi
call fcn.0040939b
add esp, 0xc
push 0
push 1
lea esi, [ebp + 0x1c]
mov byte [ebp - 4], 0
call fcn.00409a53
jmp 0x416a79
push str.PathFileExists
call fcn.0040939b
pop ecx
mov eax, dword [ebx]
lea ecx, [ebp]
push ecx
mov ecx, ebx
call dword [eax + 0x68]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0xa4]
mov byte [ebp - 4], 4
cmp dword [ebp + 0x18], 8
mov ecx, dword [ebp + 4]
jae 0x416aa6
lea ecx, [ebp + 4]
cmp dword [eax + 0x18], 8
jb 0x416ab1
mov eax, dword [eax + 4]
jmp 0x416ab4
add eax, 4
push ecx
push eax
mov ecx, ebx
call fcn.0041561a
xor edi, edi
push edi
push 1
lea esi, [ebp - 0x28]
call fcn.00409a53
push edi
push 1
lea esi, [ebp]
call fcn.00409a53
push edi
push 1
lea esi, [ebp + 0x38]
call fcn.00409a53
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x25c]
xor ecx, ebp
call fcn.00443d6d
add ebp, 0x260
leave
ret